DPP vendor evaluation — our answers

TracePass exposes a documented REST API covering products, passports (fields, parties, lifecycle, snapshots, batch creation, QR codes, compliance checks), battery measurements, EU Registry placement and registration, DPP scope checks, category templates, and EPCIS events. It does not mirror the whole dashboard: publishing a passport, setting up webhooks, most account settings (the compliance profile is the exception), CSV import and the tenant export are dashboard-only.

Authentication uses per-organisation API keys (company-wide access) or OAuth 2.0 applications with per-scope consent via the OAuth Apps tab in the dashboard. The OpenAPI spec is published to every customer in the developer portal — no NDA gating, no "talk to our integration team" friction.

Each category template ships with its own CSV template — column names match the schema, types and constraints validated on upload. Upload a CSV or Excel file in the dashboard. For automated pipelines, the Batch API (POST /api/v1/passports/batch) takes JSON, up to 100 passports per call; it does not accept the CSV file itself.

Validation is per-row with column-level error reporting. The batch API endpoint returns a per-item result — rows that pass validation are created, rows that fail are reported individually without blocking the rest.

Every paid plan can route QR codes through the customer's own domain (e.g. id.your-brand.eu/01/...). TracePass resolves under your domain, so URL portability is permanent — even if you exit, the URL on the package keeps working.

Free / trial accounts resolve under id.tracepass.eu/p/...; switching to a paid tier does not break in-flight QR codes that started on the shared domain. After your subscription ends, TracePass continues to resolve your existing passports for 30 days at no cost (see Terms of Service) — for paid customers on a custom domain, that gives you a window to re-point DNS to another vendor's resolver. After the 30-day grace, shared-domain URLs return expired and TracePass stops serving the custom domain. Resubscribing at any point brings the expired passports back online, as many as the plan allows. If you move to another provider, you can forward your passports to it instead, free on every plan including Free: TracePass checks each new address first, and scans of the printed codes then go straight to the new provider, on the shared domain too.

EPCIS 2.0 export, capture, and query are all included on every plan, Free included. Suppliers and ERP systems push events to our Capture endpoint; our EPCIS Query interface answers queries; any passport's events serialise as a standards-valid EPCIS 2.0 JSON-LD document, advertised on the QR's GS1 Digital Link resolver so an EPCIS-aware system discovers the history automatically.

Volume is the meter: Basic 1,000 events/month, Starter 10,000, Growth 100,000, Scale 1,000,000, Pro 10,000,000, Enterprise unlimited. Free tier has 10 events/month as evaluation guardrail. Hitting a paid-plan cap is opt-in overage at a per-1,000-event block rate that drops from €5 (Basic) to €1 (Pro) — see the price table on /pricing. Free hitting its cap requires an upgrade, no surprise charges.

TracePass's AI additionally drafts EPCIS TransformationEvents from supplier datasheets and PDF specs for your reviewer to approve — the same "AI suggests, human approves" gate as the rest of the platform.

TracePass ships a Model Context Protocol server, listed on the official MCP Registry as eu.tracepass/tracepass. Two ways to use it: a hosted endpoint you point an MCP client at, or a local npm package run via npx. Authentication supports both API keys and OAuth 2.0 (the "Connect" button in Claude.ai and compatible MCP clients).

It exposes the platform as MCP tools (products, passports, fields, parties, EPCIS, templates, DPP scope), plus resources and prompts. Write actions are clearly marked — the server tells the assistant which actions are billable or irreversible, so an agent warns you before creating passports or archiving anything.

TracePass ships an n8n community node — n8n-nodes-tracepass — built strictly to n8n's current community-node verification standard. Declarative routing, zero runtime dependencies, MIT-licensed, free. It surfaces five resources (Product, Passport, EPCIS Event, Template, Scope) with the v1 API operations on each.

Install it on a self-hosted n8n instance via Settings → Community Nodes → Install; n8n Cloud allows community nodes only on its Enterprise plan. Authenticate with a `tp_` API key, as for the REST API, or with OAuth2. Risky operations carry safety notes in their descriptions — Archive, for example, is irreversible. Create on Passport makes a draft, which takes no plan slot and is never charged; the plan limit and any overage apply when the passport is published in the dashboard, so a workflow can't surprise-bill the account.

Zapier and Make integrations are not yet shipped — call the REST API directly via their HTTP modules in the meantime; the same `tp_` API key works.

Serial-level passports are native: by default a passport is keyed by GTIN + serial number (GS1 Digital Link), with SKU/model as a secondary field for grouping. Identifiers carry their scheme per EN 18219, so ISO/IEC 15459, IEC 61406, DID and DOI identifiers are supported as well; battery passports accept GS1 and ISO/IEC 15459.

Serial-level passports support per-unit lifecycle data: state of health, repair history, ownership transfers, end-of-life status. The Batch API creates up to 100 passports per call, and the v1 API can address any single passport by its serial number. There is no bulk update across a serial range.

Every passport edit is recorded with timestamp, actor, and field-level diff, shown as a timeline on the passport detail page.

On top of that, every change to a published, suspended, expired or archived passport is archived as a complete snapshot of what the passport asserted, sealed with a SHA-256 content hash (re-verified on every read) and recording who made the change. A change made outside the normal editing paths is captured too, within a day. This is the change archive EN 18221:2026 (clause 4.2) describes.

To answer "what did this passport say on date X", ask for the version valid at that moment: in the dashboard, or through the API with GET /api/v1/passports/{id}/snapshots?at=<date>. The public passport URL always serves the current version.

Every plan, Free included, can export the whole account from Settings → Data export, whatever the billing status and after cancelling. "Export everything" builds one ZIP in the background and emails you when it is ready; the download stays valid for 7 days. It holds every product and passport as JSON-LD, the EPCIS 2.0 events, every uploaded document as the original file, supplier requests with the responses, passport version history with the signed credentials, battery measurements, and daily scan analytics as CSV. "Download JSON-LD" gives the tenant-wide JSON-LD document straight away: every product and passport, plus a reference to each template they use. An admin runs these exports in the dashboard; they are not available through the REST API or an API key, and passport data is not exported as CSV.

The export keeps each field's value, source attribution and per-field audit trail, plus translations; product images and the company logo that TracePass hosts are included as the original files, and an image on your own server is listed by its URL. The public data of each published passport is also served as JSON-LD at its passport URL.

Templates are updated in place: each category has one current template, and every change is logged in the public Regulatory Changelog. Existing passports keep their values, and each published version is archived as a snapshot. A field that becomes required is flagged on existing passports in the compliance view and must be filled before their next publish. Separate schema versions per passport are not kept.

Every regulatory change we track is logged in the public Regulatory Changelog with date, scope, and migration impact. On Growth and above, tracked changes for your product categories appear in your dashboard notifications.

Every public passport URL serves valid JSON-LD when the request carries Accept: application/ld+json. The same URL serves HTML for browsers and JSON-LD for crawlers and authority systems — no separate endpoint to discover.

URLs follow the GS1 Digital Link grammar (.../01/{GTIN}/21/{serial}). Resolver behaviour is self-tested against the v2.0 spec using a published script (tracepass-open/tools/gs1-conformance-check.ts).

Accept: application/json returns the same body as plain JSON — EN 18216 makes JSON the mandatory machine format — and the body carries the EN 18223 passport header as top-level fields (digitalProductPassportId, uniqueProductIdentifier, granularity, dppSchemaVersion, dppStatus, lastUpdated, economicOperatorId). For EV, light-means-of-transport and industrial (over 2 kWh) batteries, plain JSON instead returns the public part of the passport in the European Commission's battery data model, the format the EU DPP Registry reads; application/ld+json keeps the linked-data view. Browsers are served over HTTP/2 or later; machine clients that do not ask for HTML, such as the EU DPP Registry's link check, also over HTTP/1.1.

Each passport carries a structural `parties` block keyed by economic-operator role. Each entry has a validated GS1 GLN (13 digits, mod-10 check digit), legal name, ISO 3166-1 country code, and optional URL. The GLN is emitted in both `gs1:partyGLN` (GS1 Web Vocabulary, spec-precise) and `schema:identifier` with `propertyID: "GS1:GLN"` (schema.org mirror) so DPP-aware readers and standard schema.org crawlers each see what they expect.

For suppliers without a GLN, a `legacyOperatorId` field accepts a VAT, EORI, national tax ID, or internal supplier code — every party stays traceable even before the supplier's GS1 onboarding is complete.

Required roles are set per category in the platform: battery passports ask for manufacturer + recycler + PRO, with importer, authorised representative and distributor optional; toys for manufacturer + importer; packaging-bearing categories (FMCG, packaging) for manufacturer + PRO. Requiring a recycler and a PRO is the platform's choice, not an EU-law requirement: producers may fulfil extended producer responsibility individually or through a PRO (Battery Regulation Art. 57(1), PPWR Art. 47(1)), though a Member State may make a PRO mandatory for batteries. A missing required role is flagged but never blocks publishing. The same role map drives the dashboard editor, the v1 API (`PATCH /api/v1/passports/{id}/parties/{role}`), and the CSV bulk-import templates (dotted-key columns: `manufacturer.gln`, `recycler.legalName`, etc.).

The QR code resolves to an ordinary web address. The same passport opens in any desktop or laptop browser, on a shop kiosk or on a tablet, with no app to install.

Every public passport offers a PDF download of the fields the viewer shows, in the chosen language, with its images embedded, so a retailer or customer-service desk can print it on request.

The viewer is built for assistive technology as well: it passes an automated WCAG 2.1 AA audit, is fully usable by keyboard, reflows on a narrow screen or at 400% zoom, and declares the passport's language so a screen reader uses the right voice (EN 18216 requires EN 301 549 for the human-readable passport).

Two distinct uptime targets on paid plans (the Free plan has none): 99.9% for the application portal where you and your team work; 99.95% for the public resolver that authorities and consumers hit through QR codes. Both are hosted in the EU (Germany) and are not replicated across regions; availability is monitored on the public status page.

The status page tracks both surfaces independently. Outage credits apply per surface — portal credits do not require resolver outage, and vice versa.

Application and database: the TracePass platform, its database and the marketing website are hosted in the EU, in Germany. Email delivery: Resend (EU). File storage — uploads, documents, generated PDFs and database backups — is on Cloudflare R2 in its EU jurisdiction; only the public images passports display are stored without an EU restriction. Full sub-processor list with jurisdictions on the trust page.

AI document processing (extraction and translations) runs through Anthropic in the USA. It runs only on data the customer submits (a document upload, a research request, or a published passport that is then translated), never on its own initiative; it is governed by a DPA with Anthropic, and Anthropic is listed on the trust page's sub-processor register.

Standard processor DPA available; signed before customer data flows. The sub-processor register on the trust page lists every processor with role and jurisdiction; additions trigger advance notification per Article 28.

Subject access and erasure requests are handled on request under the DPA process (the passport content itself is product data, not personal data; the relevant surface is scan analytics). Breach notification: 72 hours from confirmed incident, codified in the DPA.

Operational backups: customer data is backed up automatically every day, encrypted, to separate storage, and each backup is kept for 7 days.

Product-lifecycle retention: while the subscription is active, passports remain live and queryable for the full regulatory lifetime applicable to each product category. After subscription termination, published passports stay publicly resolvable for 30 days at no charge; after that, QR codes return an expired notice. Resubscribing restores access at any point. Passports you forward to a new provider are the exception: their codes lead to the new provider for as long as the passport must stay available.

Default isolation is logical: every read and write is restricted to your organisation's data, and that restriction is continuously tested.

If you need physical isolation, contact us.

Tiered passport allowance. Each plan includes a passport count; overage is metered at a published rate that drops at scale. We never charge per scan — consumer scan volume is unpredictable, and we will not send you a surprise invoice when one of your products trends.

For high-volume battery, EV, and tyre manufacturers with serial-level mandates, we offer a serial-volume bundle with marginal-cost pricing that makes the economics work at scale. Talk to us.

A full-account export (every passport and product as JSON-LD, plus the documents, EPCIS events and version history) is available on demand from the dashboard, on every plan including Free and after cancelling, at no charge. No "export fee."

You can cancel at any time; the plan ends at the end of the current billing month. If a minimum term (3, 6, and 12 months on Scale, Pro, and Enterprise) or a prepaid annual year is still running then, an early-exit fee of up to 3 monthly fees applies; on annual billing it is deducted from the refund of unused months. On request, the service continues for a transition period of up to 30 days at the plan's standard fees, and your data stays retrievable for at least 30 days after that (Terms of Service §10a, under the EU Data Act). If TracePass materially breaches the Terms of Service and does not cure the breach within 30 days of your written notice, you may terminate immediately, including during a minimum term: nothing further is owed, and prepaid fees for the unused period are refunded pro rata (Terms of Service §10).

After your subscription ends, TracePass continues to resolve your existing passports for 30 days at no cost (Terms of Service §10). During that window, QR codes on already-printed packaging keep resolving to your data while you migrate; on a custom domain you re-point DNS to a successor vendor and the printed codes never break. Or, on every plan, forward your passports to your new provider free of charge: TracePass checks each new address first, and the printed codes then lead straight there, on the shared domain too. Updating your EU registry entries stays with you, because registration cannot be delegated.

Customer is the data controller throughout the relationship and after termination. Source escrow can be negotiated as part of an Enterprise contract (Terms of Service §13); no escrow agent is engaged today, so its terms are agreed contract by contract.

If you are moving passports from another DPP provider to TracePass, you can import them from the dashboard: paste up to 100 passport URLs or upload the passport files (JSON / JSON-LD). TracePass reads the formats it supports and creates draft passports for your review; every imported value is pending approval before publication. Coverage depends on what the source publishes.

Liability terms are as set out in the Terms of Service.

E&O insurance is not yet in place.

The data is yours. Every plan, Free included, can export the whole account at no charge, even after cancelling: every passport and product as JSON-LD — each field's provenance and audit trail preserved — plus the original documents and the version history, downloaded by an admin from the dashboard (not through the REST API). There is no export fee and no proprietary format you can't read elsewhere.

The URL is yours. On every paid plan the GS1 Digital Link resolves under your own domain via DNS you control. If you leave, you re-point that DNS to a successor and the QR codes already printed on shipped products keep working — the single biggest, least-discussed lock-in risk in DPP, neutralised by design. On every plan, the shared domain included, you can also forward your passports to your new provider, so the codes already printed lead there.

The continuity is contractual. A 30-day post-termination grace window keeps your passports resolving while you migrate; you remain the data controller throughout; and source escrow can be negotiated into an Enterprise contract. Each of these is detailed in its own answer below.

We publish the GS1 Digital Link conformance test result on the trust page. Schema.org JSON-LD is emitted on every public passport URL. The battery, tyre and textile templates are mapped field by field to the CIRPASS-2 ontologies, in alignment tables published in the open schemas repository.

GS1 GLN (Global Location Number) identifiers are first-class fields on every passport — strict 13-digit mod-10 validation, multi-role keyed (manufacturer / importer / authorised representative / distributor / recycler / producer-responsibility organisation), and emitted in both gs1:partyGLN and schema:identifier 'GS1:GLN' shapes so DPP-aware readers and standard schema.org crawlers each see what they expect.

Where conformance is partial (e.g. CIRPASS recommendations that postdate our last alignment review, or the /414/{gln} resolver path, which is not yet supported), the gap is named explicitly.