can multiple employees from my company log in to the same account

Multiple users per account is the norm, not the exception

Yes, that is the intended way of working at Supplia. One account is linked to one business, not to one person. Colleagues who belong to that business each log in with their own username to the same chain file. This is convenient because in practice the data comes from different angles: someone from HR fills the number of employees in, someone from finance the turnover, and someone from IT or compliance the questions about information security.

Who exactly is allowed access remains within the company's own discretion — Supplia does not prescribe a role allocation for this. However, it is useful to agree internally on who manages which part, especially for sensitive fields. This way, the confidentiality button can be set per answer by whoever understands the subject, without everyone needing to be involved in every detail. This works differently than for example whether the business is ISO 9001-certified, where usually one person manages the certificate but a colleague only confirms the answer before it goes to the client's portal.

Why this is not a security risk in itself

Multiple accounts on one chain file is not a deviation from a security standard, as long as access and roles are managed. That is precisely what Annex A of ISO/IEC 27001 is about: not about whether multiple people have access, but about how that access is granted, logged and revoked. A business that uses this annex as a reference when completing questions about access control can apply the same logic to its own Supplia account: add and remove users individually, rather than sharing one password. This also aligns with Article 21(2) of the NIS2 Directive, where access control is one of the ten measures mentioned — although that article concerns the security of the organisation itself, not specifically the use of Supplia.