Digital Product Passports are intended to provide data accessibility for decades—battery passports must remain readable for 15+ years, construction product data for 50+ years. Yet many DPP implementations create dangerous dependencies on platform vendors that may not survive these timeframes.
The Vendor Lock-In Problem
Most DPP platforms follow a SaaS model: manufacturers upload data to the vendor's cloud infrastructure, where it's stored in proprietary formats. Data verification requires querying the vendor's APIs. This creates several risks:
Business Continuity Risk
What happens when your DPP platform vendor:
- Goes out of business or is acquired?
- Changes pricing to unsustainable levels?
- Deprecates the API version your systems depend on?
- Suffers a catastrophic data loss incident?
Regulatory Risk
ESPR explicitly requires that DPP data remain accessible throughout the product lifecycle. If your verification infrastructure depends on a defunct vendor, you may be in technical non-compliance even though you originally followed best practices.
The Portable Evidence Alternative
Cryptar's protocol produces self-contained evidence files that verify independently of any platform. Each evidence file includes:
- The sealed data itself: Product sustainability information, test results, certificates
- Cryptographic signatures: Using qualified electronic seals from regulated trust service providers
- Validation metadata: Certificate chains, timestamp tokens, revocation information
- Human-readable documentation: Explaining what was verified and by whom
Long-Term Verification
Because evidence files are self-contained, verification doesn't require Cryptar's infrastructure. Any party with standard cryptographic libraries can validate the seals and confirm data integrity. This architectural choice mirrors how PDF signatures work—the verification capability is embedded in open standards, not proprietary platforms.
Migration Freedom
Portable evidence enables manufacturers to:
- Switch vendors: Move to a different DPP platform without losing verification capability
- Insource verification: Bring verification infrastructure in-house if business needs change
- Distribute widely: Share verified data with partners, customers, and regulators without platform dependencies
Technical Implementation
Under the hood, portable evidence uses standardized formats: JSON-LD for data structuring, JWS (JSON Web Signatures) for sealing, and RFC 3161 timestamps for time-stamping. This standards-based approach ensures that verification tools will remain available even if specific vendors exit the market.
Storage Flexibility
Evidence files can be stored anywhere: your own servers, cloud object storage, IPFS, or even blockchain-anchored distributed storage. The verification process works identically regardless of storage location.
Cost of Ownership Analysis
While portable evidence may have slightly higher upfront implementation costs compared to turnkey SaaS platforms, the total cost of ownership over a 15-year battery passport lifecycle heavily favors the portable approach:
- No recurring platform fees for data access
- No migration costs when switching vendors
- No exposure to vendor price increases
For manufacturers implementing DPP systems now, choosing portable evidence architecture future-proofs compliance strategy against vendor market dynamics.