DPP Platform
Issue, serve and control Digital Product Passports that hold up to scrutiny - from the battery passport of February 2027 to the packaging paperwork already owed today.
Request a DemoBuilt to the EN 1821x harmonised standards for Digital Product Passports. Seven standards, which we assessed clause by clause, last on 2 September 2026.
Open one before you believe us
Most DPP pages describe a passport. This one links to a published passport on our production platform, with the full battery data set behind it.
Open the demo battery passport
It is a real published passport in a tenant that is clearly fake and registered nowhere. Scan or click it and you see exactly what a consumer sees: the public tier of Annex XIII, and nothing else.
Readiness you can count
Every sector module maps the regulation to named checks. The passport tells you which ones your data satisfies and which it does not; it never tells you that you are compliant.
| Sector | Checks | Categories | Mapped to |
|---|---|---|---|
| Battery | 35 | 9 | Annex XIII, Regulation (EU) 2023/1542 |
| Packaging | 34 | 8 | PPWR conformity record, Regulation (EU) 2025/40 |
| Textile | 23 | 10 | Provisional - ESPR, until the delegated act |
| Metals | 22 | 7 | Provisional - ESPR, until the delegated act |
Textile and metals are marked provisional in the product, not only here: their delegated acts are not adopted, so the matrices follow the regulation, the Commission's preparatory work and the harmonised standards, and are updated when the acts land.
The right data for the right reader
The regulation does not make a passport public or private; it splits it. Battery Annex XIII alone has four groups with four audiences, and the split runs inside a section, not just between sections.
- Public - what anyone reaches through the QR code.
- Restricted - for actors with a legitimate interest: repairers, remanufacturers, second-life operators, recyclers.
- Authority - notified bodies, market-surveillance authorities, the Commission.
Tiers are declared per sector in one manifest, with per-field overrides where the law splits a section. Tiered sections fail closed. Every grant of restricted or authority access is recorded in an append-only table with the grantee's role, so "who saw what, when" is always answerable.
Built to the standards, with honest verdicts
We work clause by clause through the published EN 1821x standards and publish our result per standard, including what is only partial.
| Standard | What it covers | Requirements | In one line |
|---|---|---|---|
| EN 18216 | Data exchange protocols | 7 | HTTPS everywhere, JSON as the machine format |
| EN 18219 | Unique identifiers | 7 | Permanent, globally unique URLs that resolve directly |
| EN 18220 | Data carriers | 4 | QR and NFC encode the identifier and resolve to the passport |
| EN 18221 | Storage, archiving, persistence | 9 | Versioned, retained, restorable, point-in-time retrieval |
| EN 18222 | Lifecycle-management APIs | 8 | The read and lifecycle API is live |
| EN 18223 | System interoperability | 9 | Both JSON serialisations produced from tier-filtered data |
| EN IEC 61406 | Identification Link | 13 | Every rule for the link string enforced in code and pinned by tests |
Two standards cannot be assessed yet: FprEN 18239 (access rights) and prEN 18246 (data authentication) are unpublished. Our access tiers and our Ed25519 signatures exist today; whether they match those texts is reconciled when the texts exist, not guessed at.
Security, in plain terms
- Isolation the database enforces. Every tenant sits behind forced PostgreSQL row-level security, applied even to the table owner. The application never runs as superuser. A live drill asks for another tenant's passport with a valid login and confirms the database refuses it.
- Integrity anyone can verify. Every published passport carries an Ed25519 signature over its content, the public key is published at a well-known URL, and a public endpoint lets anyone check a passport has not been altered since publication.
- Privileged access. Sign-in is OpenID Connect with PKCE; administrators and authorities must pass multi-factor authentication, enforced at the identity provider so an API call cannot bypass it.
- An audit trail that cannot be edited. Append-only at the database level, covering creation, publication, access at every tier, registry submissions and plan changes.
Where we stand with the EU registry
The Commission's DPP Registry has been live since 20 July 2026 and batteries are its first product group. Soverio is a verified economic operator there since 24 August 2026.
Registering passports on another company's behalf is a different status under Implementing Regulation (EU) 2026/1778. The platform generates the registry's own batch files from the Starter plan up, and on Enterprise we prepare and submit your registrations through your verified account, as part of consulting services.
Frequently asked questions
Do I need a Digital Product Passport yet?
Batteries first: every EV, LMT and industrial battery above 2 kWh placed on the EU market from 18 February 2027. Textiles and metals follow once their ESPR delegated acts are adopted. Packaging conformity records are owed already, since 12 August 2026.
Can I try it with my own data?
Yes. The Free plan takes five published passports with the full validator, so you can map real product data before committing.
Does the platform tell me whether I am compliant?
No, and it never will. Each check reports what your data evidences. Compliance is a legal conclusion about your product and your file, not an output of a validator.
What happens to my passports if I leave?
They stay online read-only, as EU law requires, and you can transfer them to another provider at any time. An EU-registered passport cannot be unpublished.
Ready to Prepare for EUDIW Compliance?
Talk to our team about how Soverio can connect your existing systems to the EU Digital Identity Wallet ecosystem.
Request a Demo