Anyone in Switzerland who keeps something valuable thinks of steel doors: the strongrooms of the banks, and the fortresses built deep into the rock of the Alps. Protection and discretion have long gone together in Switzerland, and in that spirit we treat our customers’ data like the contents of a vault. So with us, behind every door lies the next, and each has its own lock.
A maker of e-bike batteries keeps something just as valuable at Transpareo: the data on its batteries, the detailed composition of its cells, its suppliers’ answers and the digital product passports its batteries need from 18 February 2027. Before it does, it wants to know how data security stands with us. The Ecodesign Regulation requires of every digital product passport a high level of security and privacy.
Transpareo is all about longevity and security. A passport is meant to last ten years and more, and in that time nobody should change what it says unnoticed, or read what they have no right to read. The company and its foundation in Zug are Swiss; the data is kept in data centres in the EU, backups included. We show what lies behind each door with the example of the battery maker.
How Transpareo secures your product passports
Six doors, in the order this article opens them:
- Every customer has a database of its own and a key of its own for its sensitive data.
- Our servers are hardened and checked regularly, and each stands on its own.
- Every four hours an encrypted backup is made and kept in two places in the EU far apart, and a failed server is replaced within a very short time.
- Two logs record every change and every sign-in, and a second factor protects sign-in.
- Every published passport is signed twice and can be checked by anyone in the browser.
- A foundation as majority owner, an archive, Transpareo Vault and stable terms keep your passports reachable and meaningful for the long term.
With our provider checklist you can check these points with any provider, us included.
A database of its own for every workspace
At Transpareo every company works in a workspace of its own, and every workspace sits in a database of its own. The battery maker’s batteries, passports, users and logs never sit beside another customer’s data, and every query runs in the workspace it belongs to.
Every workspace also has a key of its own, which locks its sensitive data. That key is in turn locked with a key of the server, kept outside the database.
Anyone who gets hold of a copy of the database alone cannot read its sensitive data.
Transpareo has no master key that opens every workspace. The battery maker sets nothing up for this: Transpareo creates its key the moment its workspace is created.
Hardened servers: when someone attacks a server
An attacker goes after one of our servers, hoping to reach the battery maker’s data from there.
Every server stands on its own, with keys of its own, sealed off from all the others. Only someone holding a registered key gets onto the servers, and should one fall into the wrong hands despite all this, the break-in ends there.
If the battery maker’s data sits on another server, it stays locked to the attacker.
We check our security regularly in audits and close whatever a check finds with a security update of its own.
Encrypted backups: when a data centre burns
A fire or a flood hits the data centre where the battery maker’s server stands.
Every four hours Transpareo backs up every workspace and encrypts the backup before it leaves the server, with a key known only to that server; inside it, each customer’s sensitive data stays locked as well, with its own key. The backups are kept in two places in the EU, more than a thousand kilometres apart, and at the more distant one the servers can store them but can neither delete nor overwrite them.
Transpareo replaces the lost server with a new one within a very short time and brings its workspaces back from the backups. Its keys survive as well: we keep the key set of every server sealed and offline, at several secured locations that are geographically apart.
A fire in the data centre costs the battery maker at most the last four hours of work.
Beyond the workspaces, Transpareo also backs up the archive of every published passport, each signed version included. Should everything else fail, the battery maker’s passports, and those of every other customer, would be back online within a very short time.
The General Data Protection Regulation asks for the ability to make data available again quickly after an incident. So a backup counts for us only once it can be restored, and we regularly restore backups on trial.
Detailed logs: when someone asks who changed a value
In the passport of a battery, the weight no longer matches the data sheet, and the battery maker’s quality team wants to know who changed it and when.
The answer is in its workspace’s change log. Transpareo records every change, in the application manager and through the interface alike: who made it, to which entry, which value applied before and which after, when, and from which IP address. Every entry is kept for five years, none can be changed or deleted in the application manager, and only those the administrator allows may read it.
A second log is kept for security. For one year it lists every sign-in, every failed attempt and every lock after too many failed attempts, with IP address and browser. If someone from Transpareo signs in to the workspace to help with a question, that is listed there too, beside the sign-ins of the battery maker’s team.
Whoever changes something in the workspace or signs in to it leaves a trail the battery maker can read for itself.
A second factor protects sign-in, and the administrator can require it of the whole team.
Signed passports: when someone doubts a passport
Two years after the sale, a competitor claims the battery maker massaged the carbon footprint in its passport after the fact, and a market surveillance authority asks about it.
What counts then is what anyone can recompute. Transpareo signs every published version of a passport twice, with the workspace’s key and with a counter-signature from Transpareo, and chains it to the previous one: that is Transpareo Proofchain. A correction becomes a new version, and the old one stays visible. Transpareo Time Machine, our open-source viewer, checks both signatures every time a passport is opened. A click on Verified by Transpareo at the top of the passport opens exactly these details: which signatures are valid, and whether each version is chained to the one before. On our page for checking product passports anyone can check a passport on its own as well. If a version has been altered, even in a single value, the check fails.
Nobody has to ask us whether a passport is genuine. The reader’s browser works it out for itself.
The battery maker shows the detailed composition of its cells only to readers with a legitimate interest. The public passport without it still passes the check, because the signature covers every value on its own. There is more in our article on selective disclosure in the product passport and in our article on signatures and certificates in the product passport.
Built to last: your passports in 2035
In 2035 a recycler scans a battery that the battery maker sells today. Will Transpareo still be there?
We have made provision for that as well as a company can. 51 per cent of the share capital of Transpareo AG is held by the non-profit Transpareo Foundation in Zug, and the Federal Supervisory Authority for Foundations oversees that the foundation serves its purpose. There is more on our page about the company and its foundation.
If the battery maker closes its workspace, the public part of its passports stays online for ten years at the same addresses, as our article on product passports after an insolvency shows. From registration with the EU registry, Transpareo Vault keeps every version with all restricted data for ten years, and until that period runs out, nobody can change or delete anything there, us included. It is built and takes effect with registration.
The passport keeps its meaning too: a published term never changes, and when Transpareo moved its passports to a signature method of the World Wide Web Consortium in 2026, every older passport stayed verifiable. How we think about long-lived signatures we have also put forward in our comments on the UN Transparency Protocol.
A single lock to which only we hold the key would have been simpler to build.
We built Transpareo so that you have to take our word for as little as possible.
That took more work. For data that customers, repair shops and authorities are to rely on for ten years, we think it is the right way.
The battery maker requests the data for its passports with Transpareo Upstream directly from its cell manufacturers, and once the data is in, the passports are published in a few minutes. From then on they are locked away: in a database of their own, backed up encrypted, signed and open to anyone’s check.
Questions on this article
Where does Transpareo store the data of a digital product passport?
In data centres in the EU, backups included. Every workspace has a database of its own, and the backups are kept in two separate places in the EU, more than a thousand kilometres apart. The company Transpareo and its foundation in Zug are Swiss.
What security does the EU require of the digital product passport?
The Ecodesign Regulation requires genuine, intact data and a high level of security and privacy that avoids fraud. At Transpareo every version carries two signatures for this, which every reader checks in the browser.
Can a published product passport be altered afterwards?
At Transpareo a correction becomes a new, signed version, and the old one stays visible. Every version carries two signatures, the workspace’s and a counter-signature from Transpareo. Anyone who alters a published version afterwards makes the check in the browser fail, and the reader sees it at once.
How often does Transpareo back up my data?
Every four hours. Each backup is encrypted on the server before it leaves, and is then kept in two separate places in the EU. At the more distant place the servers can store their backups but can neither delete nor overwrite them.
