In 2036 a battery arrives at a recycler. He scans the code that was printed on the housing in 2026 and gets the product passport. The company that stored the passport back then may no longer exist. The scan still has to prove that the data is real: that it came from the manufacturer and that nobody has changed a character since.
That is the heart of the matter. A Digital Product Passport has to stay verifiable for ten years and longer. A software platform rarely lasts that long. So trust must not hang on the provider. It has to stick to the record itself.
This article explains how Transpareo solves that: with two seals on every passport, with an issuer identifier on your own domain, with an archive that outlives the provider, and with a check anyone can run in a browser without asking us.
Every version carries two seals
Before a passport is published, Transpareo checks whether all mandatory fields of its product category are present. If one is missing, publication is refused.
Only a complete passport is signed.
Transpareo then freezes the content as a version and gives it two independent signatures: one from the manufacturer and one from Transpareo. The manufacturer can hold its key itself and run its own signing service. Transpareo never sees that private key and only adds its own counter-signature. The manufacturer’s signature is therefore one we could not produce ourselves.
The signature does not commit to the document as one block but to every individual entry. That is why the fields a repairer or an authority additionally gets to see still carry the same proof, with no re-signing. Why that matters to us is in disclosure doesn’t cost you the signature.
Verification happens in the viewer’s browser. The open-source viewer Transpareo Time Machine loads the passport, recomputes its fingerprint and checks both signatures, without contacting a server of ours. Anyone who is suspicious can read the code.
The issuer identifier stands on your own domain
So that a verifier finds the public keys, every manufacturer publishes its identifier on its own domain, at a fixed address every verifier knows (for the standards-minded: following the W3C standard DID:web). Deliberately not a classic certificate: certificate chains expire over decades, an address on your own domain stays robust and under your control.
If a key changes, older signatures remain verifiable. The old key continues to confirm what it once signed; it simply signs nothing new. And because a manufacturer might give up its domain one day, Transpareo mirrors every public key at the moment of publication to a permanent address. So every version stays verifiable, even if the original address stops answering at some point.
The EU registration carries a qualified seal
Registration in the EU DPP register, operational since 20 July 2026, requires more than an ordinary signature: you prove your identity through eIDAS, the EU-wide rules for electronic signatures, and a qualified electronic seal under the eIDAS Regulation 910/2014 is one of the accepted means. Such a seal is hardware-backed and bound to a verified legal person, the highest level of trust that EU law knows.
This capability is planned for as soon as the eIDAS legal act and the register interface are final. Transpareo plans its own sealing service, with a self-held seal device and a qualified certificate from a recognised trust-service provider, so manufacturers without their own seal infrastructure can seal their passports without their own hardware.
An archive that outlives the provider
As soon as the passports are registered with the EU register, every version is additionally archived immutably for ten years. Neither the manufacturer nor Transpareo can change it afterwards. So that this archive remains reachable even if Transpareo were one day to cease to exist, its financing is secured through a notarial escrow in Switzerland. The promise is therefore not only technical, but also contractually designed for longevity.
This is how a third party checks the passport, entirely without us
The decisive test is whether someone can verify the passport without our infrastructure. The procedure:
- Fetch the passport from any source: the CDN, the public archive, the EU register or a third-party archive.
- Bring the data set into a fixed order and compute its fingerprint.
- Retrieve the public keys of the manufacturer and of Transpareo at the addresses named in the passport.
- Check both signatures against the fingerprint. If both match, the passport is genuine and unchanged.
No login, no call to Transpareo, no dependency on a running platform. Which method does the computing is in the questions at the end.
What runs today and what is prepared
Signatures, verification in the browser, the issuer identifier on the manufacturer’s own domain and the manufacturer’s own key are in use. The immutable ten-year archive is in place and takes effect as soon as the passports are registered with the EU register. The qualified seal for the EU registration is planned for as soon as the eIDAS legal act and the register interface are final.
What is once signed and archived stays verifiable, regardless of who runs the platform tomorrow.
Questions on this article
Who holds our signing key?
You do, if you want to. The manufacturer can run its own signing service, and Transpareo never holds the private key; it only adds the independent counter-signature. Every passport version therefore carries two signatures from two mutually independent parties, and the manufacturer’s signature is one Transpareo cannot produce on its own.
What happens to our passports if Transpareo one day ceases to exist?
They stay verifiable, because the trust sticks to the record rather than to us. Every version is signed with keys published at the addresses named in the passport itself, and Transpareo mirrors every public key at the moment of publication to a permanent address, so verification survives the original address disappearing. The immutable ten-year archive is financed through a notarial escrow in Switzerland, so its reachability does not depend on the company still trading.
Why an issuer identifier on our own domain rather than a certificate?
Because certificate chains expire over decades and a passport has to stay verifiable for ten years and longer. The manufacturer publishes its identifier at a fixed address under /.well-known/ on its own domain (following the W3C standard DID:web), which stays robust and under your control, including across a change of provider. A verifier fetches the public keys from there without having to ask anyone for permission.
What happens to older passports when we change a key?
They keep verifying. The old key continues to confirm what it once signed; it simply stops signing new passports. Because every public key is mirrored for good at publication, a verifier still finds the right key years later. That is what makes a key change a routine operation rather than an event that devalues the history.
Do we need a qualified electronic seal of our own for the EU register?
Not necessarily. Registration is your own act, and you prove your identity through eIDAS, with a qualified electronic signature or seal or a qualified attestation of attributes. Transpareo will run its own sealing service, with a self-held seal device and a qualified certificate from a recognised trust-service provider, so manufacturers without their own seal infrastructure meet the obligation without buying hardware. That capability is planned for as soon as the eIDAS legal act and the register interface are final.
What happens if a passport is incomplete when we publish it?
It does not get signed. Before freezing, the data set is checked against the mandatory fields of its product category, and publication is refused when that check fails. Only a complete, rule-compliant passport is committed as a version. A signature on a Transpareo passport therefore also says the mandatory fields were there.
Does disclosing extra fields destroy the signature?
No, and that is exactly what the method is built for. The signature commits to every individual entry in the data set rather than to the document as one block, which is why the fields additionally disclosed to a repairer or an authority still carry the same proof, with no re-signing. More on that in disclosure doesn’t cost you the signature.
Can a customer verify a passport without us?
Yes, and that is the decisive test. Fetch the passport from any source, bring the data set into its fixed order and compute its fingerprint, retrieve the public keys of the manufacturer and of Transpareo through the addresses named in the passport, then check both signatures against the fingerprint. The method behind it is the open W3C proof ecdsa-sd-2023. No login, no call to us, no dependency on a running platform. The open-source viewer Transpareo Time Machine does exactly this in the viewer’s browser.
