Your product passport, your secrets

Summary

A Digital Product Passport (DPP) under the EU Ecodesign Regulation (ESPR) or the Batteries Regulation has to show what is in a product. As a rule, the manufacturer does not have to disclose how the product is made or whom it buys from. Formulations, process parameters and sources of supply are trade secrets within the meaning of EU Directive 2016/943. They are protected, however, only if the company takes reasonable steps to keep them secret, and one of those steps is the choice of DPP platform.

Transpareo, the Swiss DPP platform, protects this knowledge at six points:

1. It does not query source systems such as ERP or PLM.
2. It keeps every customer in a database of its own.
3. Suppliers ask their own suppliers anonymously.
4. Every data field is signed individually and has its own access level (W3C ecdsa-sd-2023).
5. AI requests go straight from the browser to the chosen provider.
6. All data can be exported in full, with no lock-in.

A product passport is meant to show what is in a product, not how you make it and whom you buy from. Where Transpareo draws this line, explained at six points.

A case from practice

A mid-sized manufacturer builds battery systems for forklift trucks. From February 2027 every system it newly places on the market needs a product passport. The data for it has long been at hand, in the ERP, in the PLM and in the test records from production.

The managing director still hesitates. One provider wants read access to the ERP. Another asks, in its supplier form, for the name and address of the cell manufacturer. And the cathode material comes from a single business that no competitor knows about so far.

His concern is justified. Whoever gives access to the source systems hands over more than the passport. Whoever types sources of supply into a platform makes themselves replaceable. And whoever pools data with one provider has to trust that provider.

What the passport requires, and what it does not

A product passport does not show everyone the same thing. The Batteries Regulation distinguishes three groups: the public, persons with a legitimate interest such as repairers or recyclers, and authorities and notified bodies. The Ecodesign Regulation likewise lets the rules for the other product groups set who may see which data.

Much of what a manufacturer wants to protect, the passport does not require at all: process parameters, terms, the names of sub-suppliers, unless the delegated act expressly asks for them. What it does require is often seen only by an authority or an entitled business.

The law is on your side here. The European Trade Secrets Directive expressly names information on customers and suppliers. In Switzerland the Federal Act against Unfair Competition and the Criminal Code (both in German) protect manufacturing and trade secrets.

One point is often overlooked: under the directive a secret is protected only if you take reasonable steps to keep it secret. The choice of your DPP platform is therefore one such step in itself.

Six points where Transpareo protects your knowledge

1. Your source systems stay closed

Transpareo never queries your ERP, MES, PIM or PLM and receives no credentials for them. Your system submits a released data package, and all that comes back are receipts: the URL of the passport, the version ID, the publication status and validation messages. That keeps your security concept short, because the data flows into the passport in one direction only.

2. Your data is kept apart, and every access is limited

Every customer has a database of its own, and secrets such as API keys are encrypted with a key of their own for each workspace. Every API user gets credentials of its own, and everything you have not expressly allowed is blocked. You limit an access to products, a lifetime and IP addresses, and you revoke it at any time. Transpareo staff open your workspace only through a sign-in that appears in your security log.

3. Sources of supply stay with the supplier

Your supplier passes your questions on to its own suppliers, across any number of tiers and, if it wishes, without your brand and your product. You do not see whom it asked, only how many requests were passed on. Every request is protected by a PIN, and every answer arrives as a proposal and changes your record only once you accept it field by field. Why this is exactly what brings better data is set out in our article on your suppliers’ sources of supply.

4. Everyone sees only their fields and can check them

The public sees the public passport, a repairer a few fields more, an authority everything. Fields a reader has no claim to are missing from their view altogether. Because we sign every field individually (W3C ecdsa-sd-2023), even a field disclosed in addition verifies offline against your key. With “Bring Your Own Key” you sign through a signing service of your own, the private key stays with you, and we cannot invent a field after the fact.

5. The AI assistant works for you alone

You choose the AI provider, European providers come first in the list, and a model in your own house is possible too. The requests of the assistant in the application manager go from your browser straight to the provider, and your conversations never reach our servers. The assistant never has more rights than the person using it, and publishing waits for your approval.

6. You can leave at any time

Your plan can be cancelled monthly. You export all your data as CSV, XLSX, JSON-LD or SQL, or fetch it through the REST API, for another DPP application or for purchasing, production and engineering. The passport appears under your domain, without Transpareo branding, and the viewer app Transpareo Time Machine is open source.

Point	What stays protected
Import	Access to ERP, MES, PIM and PLM
Storage	Your data, from other customers and from us
Supply chain	The sources of your suppliers and of their suppliers
Disclosure	Fields a group of readers is not entitled to
AI assistant	Your conversations and your choice of provider
Exit	Your independence from Transpareo

What we choose not to see, and what that costs

Some of these limits apply to us as well. We hold no credentials for your source systems. We do not read your conversations with the AI assistant, because they never reach our servers. We do not see whom your suppliers have asked. And with your own key, we cannot sign any value in your name.

That has a price, and we state it openly. You lose the overview of who in your supply chain answered which question. The history of your conversations with the assistant lives only in the browser in which you held them. We think both are the right price.

What a platform does not see, it can neither lose nor exploit nor hand over.

This is also set down in the contract. Transpareo processes personal data under a data processing agreement based on the EU standard contractual clauses, on your instructions only, and your product data under our terms and conditions in the way you set in the platform, on servers in Germany. If you ask for deletion after cancelling, your workspace’s key is destroyed, and of your database only what keeps your published passports available remains, as the law requires. Once your passports are registered with the EU registry, their versions are also kept in the prescribed archive, as a rule for ten years from registration.

What you can do next

For every item of data in your future passport, decide who may see it: the public, entitled businesses or authorities only. What the delegated act does not require does not belong in the passport. Then ask every DPP provider you are considering about the six points above. Our checklist for choosing a DPP provider helps with that.

If you want to see it for yourself, open our demo without registering: an open application manager and sample passports.