Trust centre
Digital Product Passports are compliance-grade data. Here's how we handle it.
Security
Data is isolated per organisation with membership and role checks enforced on every server-side query before it ever runs, not just in the UI. Uploaded documents are stored privately and only reachable via short-lived signed URLs to authorised organisation members.
Privacy
We collect only what's needed to create and maintain your passports. Personal account data is kept separate from product compliance data. See our Privacy Policy for full details on what we collect and why.
Data hosting
Application data is hosted on Neon (PostgreSQL) with the application deployed on Vercel. Specific hosting region configuration is set at deployment time.
Subprocessors
Core subprocessors: Neon (database), AWS S3 (document storage), Vercel (hosting), Stripe (payments), Resend (transactional email), and an AI provider used only for document extraction and explanation (see AI usage below). A full, current subprocessor list is available on request.
Data retention
Digital Product Passports you've downloaded remain yours, and any EU registration already completed stays in place, even if your subscription lapses. Passports stored on the platform that you have not downloaded are deleted if your subscription is cancelled — see our FAQ for the full policy.
AI usage
AI is used to extract structured data from documents you upload and to explain regulatory requirements in plain language. AI never determines whether a legal requirement exists or decides your compliance status — that is handled by our deterministic, versioned rules engine. We do not use your product or document data to train third-party AI models.
Availability
We design for redundant storage and daily backups of passport data, and we support exporting your full passport dataset at any time to avoid lock-in.