Get listed as a trusted GC supplier, in four steps
The GC Supplier Trust Registry tells every federal department, automatically, that a document you signed really comes from you and that you are an admitted supplier. To get in, you prove who you are once, through Gaia-X, the European framework for trusted business data, run here by a Canadian clearing house that checks your company with Corporations Canada. The registry then checks it against its own rules. TrustDID does the technical part for you.
1
One identity Your company's verifiable identity on your own web domain.
2
One Gaia-X credential Proof, checked by a clearing house, that you are a real, active company.
3
One listing Departments see "Trusted signer: Yes" on everything you sign.
Pilot.This runs on our development environment with a Canadian clearing house we operate. It isn't accredited by Gaia-X yet, and the GC Supplier registry is a demonstration, not an official Government of Canada registry.
Can you apply?
You can, if all of these are true:
You are a federal corporation that Corporations Canada lists as active. Check yours below.
You have your own web domain (for example yourcompany.ca) and can add one DNS record.
You can declare that GC customer data stays in Canada and that you accept the GC Supplier terms.
How it works
About an hour of your time, most of it in step 1. Then a review by the registry's officer.
Get TrustDID
You · about 30 minutes
You need to download the TrustDID software and set up your company's digital identity, on your own web domain. Start at trustdid.ca with Get Early Access.
The TrustDID tools on one computer of your organisation (Windows or Linux), and your company's identity published at https://yourcompany.ca/.well-known/did.json. Your signing keys are created on that computer and never leave it.
Run one command
You · about 10 minutesonce, then every 90 days
It does three things: proves who you are to Gaia-X, collects your Gaia-X credential, and sends your application to the registry. It asks before anything is signed in your name.
A Gaia-X key is created on your computer, and a certificate for it comes from Let's Encrypt. The first time, you add one DNS record it shows you.
Our Notary checks your corporation number with Corporations Canada.
You sign your company description and the Gaia-X terms; the clearing house checks them and issues your Gaia-X credential.
It reads the registry's rules, asks you to confirm the declarations, then applies.
An officer reviews your application
The registry · usually a few days
Most checks are automatic; a person makes the decision. If something is missing, the officer asks for it and the same command tells you what.
What the officer sees
Your company name, corporation number, your Gaia-X credential, each of the registry's rules met or not with its proof, and 16 automatic checks (signatures, freshness, nothing changed since Gaia-X checked it). They approve, reject, or ask for evidence, always with a written reason.
You're listed
Immediately after approval
Run the command once more to collect your membership. From then on, any department that checks a document you signed sees that you are an admitted GC supplier. Renew every 90 days with the same command.
The rules you'll be checked against
Two sets, written the same way. Most are checked automatically; a few you agree to.
Gaia-X (applied by our clearing house)
PA1.1
Describe your company and accept the Gaia-X termsautomatic
Your legal name, address and registration number, signed with a key backed by a certificate, plus your signature on the Gaia-X Terms & Conditions. The command prepares and signs both.
CA-CORP
An active federal corporationautomatic
Our Notary checks your number with Corporations Canada, live, and signs the result.
The full Gaia-X rulebook
For companies, Gaia-X has one rule (PA1.1). Its 60 other rules are for services you might list later (contracts, data protection, security, portability, where data is kept, sustainability), at four levels from self-declaration to certification. Gaia-X Compliance Document 3.1.0
GC Supplier registry
Loading the registry's current rules…
Read them as published
The registry publishes its rules; this page shows the current version, live.rulebook.json
Check yourself
Is my corporation number accepted?
The same check our Notary runs in step 2.
Am I listed?
What every department's verifier asks the registry.
Questions
Gaia-X is European. Does my data go to Europe?
No. Gaia-X is a set of rules and a credential format. Your Gaia-X credential is issued by a clearing house we run in Canada, and it only describes your company (name, number, address). Your customers' data is not involved.
What if I'm a provincial corporation, not a federal one?
Not yet. Our Notary checks federal corporations today; provincial registries are on the list. Tell us which province, it helps us prioritize.
What does it cost?
During the pilot, we set you up. Pricing will come with general availability.
What if the registry suspends me?
A suspension shows at the next check, everywhere, with nothing to re-issue. It's recorded with a reason, and reinstatement is just as fast once the matter is resolved.
Do I need ISO 27001?
Not today: the security baseline is optional in the current rules, because no certification body issues verifiable certificates yet. We are working on certificates signed by the certification body itself.