In 2036 a battery arrives at a recycler. He scans the code that was printed on the housing in 2026 and gets the product passport. The company that stored the passport back then may no longer exist. The scan still has to prove that the data is real: that it came from the manufacturer and that nobody has changed a character since.
That is the heart of the matter. A Digital Product Passport has to stay verifiable for ten years and longer. A software platform rarely lasts that long. So trust must not hang on the provider. It has to stick to the record itself.
This article explains how Transpareo solves that: with two seals on every version of a passport, with Transpareo Proofchain, which chains every version to the one before, with an issuer identifier on your own domain, with an archive that outlives the provider, and with a check anyone can run in a browser without asking us.
Every version carries two seals
Before a passport is published, Transpareo checks whether all mandatory fields of its product category are present. If one is missing, publication is refused.
Only a complete passport is signed.
Transpareo then freezes the content as a version and gives it two independent signatures: one from the manufacturer and one from Transpareo. The manufacturer can hold its key itself and run its own signing service. Transpareo never sees that private key and only adds its own counter-signature. The manufacturer’s signature is therefore one we could not produce ourselves.
The signature commits to every individual entry. That is why the fields a repairer or an authority additionally gets to see still carry the same proof, with no re-signing. Why that matters to us is in disclosure doesn’t cost you the signature.
Verification happens in the viewer’s browser. The open-source viewer Transpareo Time Machine loads the passport, recomputes its fingerprint and checks both signatures itself. Anyone who is suspicious can read the code.
Transpareo Proofchain: every version points to the one before
A passport rarely stays as it was on day one. Suppose the maker of our battery finds in 2029 that it overstated the recycled share of the cobalt, and corrects it. In Transpareo that correction overwrites nothing. It becomes a new version, and the previous one stays frozen beside it.
A correction is added, and the earlier entry stays where it was.
Every new version carries the fingerprint of the one before, computed over its public part. That reference sits in the signed content, so both signatures cover it. The result is a chain from the first version to the current one: Transpareo Proofchain.
If someone later changes an entry in an earlier version, its signatures no longer match, and any verifier sees it. Only whoever holds the keys could sign it again, and even then the fingerprint in the next version gives away any change to the public part. If you hold your own key, not even Transpareo can sign a version of your passport again.
The chain can be checked without us. In the browser, Transpareo Time Machine walks it back from the current version to the first, recomputes the fingerprint of each earlier version from that version’s own data and compares it with the reference in the one that follows. So in 2036 the recycler sees both cobalt figures, the original and the corrected one, and can work out for himself that neither has been changed afterwards.
We could have called this a blockchain. It is deliberately built more simply: a chain of fingerprints inside the passports themselves, which anyone can recompute with open methods, without joining a network.
The issuer identifier stands on your own domain
So that a verifier finds the public keys, every manufacturer publishes its identifier on its own domain, at a fixed address every verifier knows (for the standards-minded: following the W3C standard DID:web). Certificate chains, the classic route, expire over decades; an address on your own domain stays robust and under your control.
If a key changes, older signatures remain verifiable. The old key continues to confirm what it once signed; it simply signs nothing new. And because a manufacturer might give up its domain one day, Transpareo mirrors every public key at the moment of publication to a permanent address. So every version stays verifiable, even if the original address stops answering at some point.
The EU registration carries a qualified seal
Registration in the EU DPP register, operational since 20 July 2026, requires more than an ordinary signature: you prove your identity through eIDAS, the EU-wide rules for electronic signatures, and a qualified electronic seal under the eIDAS Regulation 910/2014 is one of the accepted means. Such a seal is hardware-backed and bound to a verified legal person, the highest level of trust that EU law knows.
This capability is planned for as soon as the eIDAS legal act is final and the register accepts passports. Transpareo plans its own sealing service, with a self-held seal device and a qualified certificate from a recognised trust-service provider, so manufacturers without their own seal infrastructure can seal their passports without their own hardware.
An archive that outlives the provider
As soon as the passports are registered with the EU register, every version is additionally archived immutably for ten years in Transpareo Vault. Neither the manufacturer nor Transpareo can change it afterwards. If the manufacturer itself closes down, the public part of its passports keeps answering at the same addresses.
The company that runs this archive is built to last as well: 51 per cent of the share capital of Transpareo AG goes to the non-profit Transpareo Foundation in Zug (in formation, as of October 2026). Once it is established, the Central Switzerland Foundation Supervisory Authority (ZBSA) oversees that it serves its purpose.
This is how a third party checks the passport, entirely without us
The decisive test is whether someone can verify the passport without our infrastructure. The procedure:
- Fetch the passport from any source: the CDN, the public archive, the EU register or a third-party archive.
- Bring the data set into a fixed order and compute its fingerprint.
- Retrieve the public keys of the manufacturer and of Transpareo at the addresses named in the passport.
- Check both signatures against the fingerprint. If both match, the passport is genuine and unchanged.
No login, no call to Transpareo, no dependency on a running platform. Which method does the computing is in the questions at the end.
What runs today and what is prepared
Signatures, the chaining of versions in Transpareo Proofchain, verification in the browser, the issuer identifier on the manufacturer’s own domain and the manufacturer’s own key are in use. The immutable ten-year archive is in place and takes effect as soon as the passports are registered with the EU register. The qualified seal for the EU registration is planned for as soon as the eIDAS legal act is final and the register accepts passports.
What is once signed and archived stays verifiable, regardless of who runs the platform tomorrow.
Questions on this article
Who holds our signing key?
You do, if you want to. The manufacturer can run its own signing service, and Transpareo never holds the private key; it only adds the independent counter-signature. Every passport version therefore carries two signatures from two mutually independent parties, and the manufacturer’s signature is one Transpareo cannot produce on its own.
Can we correct an entry after publishing?
Yes, as a new version. The correction overwrites nothing; the previous version stays frozen beside it. The new version carries the fingerprint of the one before in its signed content, which forms a chain from the first version to the current one, Transpareo Proofchain. Anyone who later changes an earlier version breaks its signatures or the chain, and Transpareo Time Machine shows that to any verifier, who never has to ask us.
What happens to our passports if Transpareo one day ceases to exist?
They stay verifiable, because the trust sticks to the record. Every version is signed with keys published at the addresses named in the passport itself, and Transpareo mirrors every public key at the moment of publication to a permanent address, so verification survives the original address disappearing. From EU registration on, every version also sits unchanged in Transpareo Vault, the immutable ten-year archive. The company itself is built to last as well, since 51 per cent of the share capital of Transpareo AG goes to the non-profit Transpareo Foundation in Zug (in formation, as of October 2026). Once it is established, the Central Switzerland Foundation Supervisory Authority (ZBSA) oversees that it serves its purpose.
Why does the issuer identifier sit on our own domain?
Because certificate chains expire over decades and a passport has to stay verifiable for ten years and longer. The manufacturer publishes its identifier at a fixed address under /.well-known/ on its own domain (following the W3C standard DID:web), which stays robust and under your control, including across a change of provider. A verifier fetches the public keys from there without having to ask anyone for permission.
What happens to older passports when we change a key?
They keep verifying. The old key continues to confirm what it once signed; it simply stops signing new passports. Because every public key is mirrored for good at publication, a verifier still finds the right key years later. That is what makes a key change a routine operation that leaves the history intact.
Do we need a qualified electronic seal of our own for the EU register?
Not necessarily. Registration is your own act, and you prove your identity through eIDAS, with a qualified electronic signature or seal or a qualified attestation of attributes. Transpareo will run its own sealing service, with a self-held seal device and a qualified certificate from a recognised trust-service provider, so manufacturers without their own seal infrastructure meet the obligation without buying hardware. That capability is planned for as soon as the eIDAS legal act is final and the register accepts passports.
What happens if a passport is incomplete when we publish it?
It does not get signed. Before freezing, the data set is checked against the mandatory fields of its product category, and publication is refused when that check fails. Only a complete, rule-compliant passport is committed as a version. A signature on a Transpareo passport therefore also says the mandatory fields were there.
Does disclosing extra fields destroy the signature?
No, and that is exactly what the method is built for. The signature commits to every individual entry in the data set, which is why the fields additionally disclosed to a repairer or an authority still carry the same proof, with no re-signing. More on that in disclosure doesn’t cost you the signature.
Can a customer verify a passport without us?
Yes, and that is the decisive test. Fetch the passport from any source, bring the data set into its fixed order and compute its fingerprint, retrieve the public keys of the manufacturer and of Transpareo through the addresses named in the passport, then check both signatures against the fingerprint. The method behind it is the open W3C proof ecdsa-sd-2023. No login, no call to us, no dependency on a running platform. The open-source viewer Transpareo Time Machine does exactly this in the viewer’s browser.
