Security and data handling

What happens to the supplier documents you upload, stated as plainly as we can.

Free gap check (no account)

Files are stored on our server only to run the check, linked to your browser session, and deleted automatically after 60 minutes unless you save the report into an account. You can delete them at once from the result page. We keep a keyed hash of your IP address for 24 hours to limit free checks; we do not store the address itself.

Files are read by our own parser. They are not sent to any AI service.

Accounts

Each organisation's products, documents, values and supplier requests are only visible to its own members. Roles: admin, member and a read-only auditor role for notified bodies or external reviewers.

Documents a supplier marks confidential can only be opened by admins and auditors, every access is logged, and evidence packs contain only their fingerprint (SHA-256), not the file.

AI extraction is off by default for accounts. An admin can switch it on; values found by AI always need human approval.

Deleting a product removes its documents, values, requests and packs. The audit trail of what happened is kept.

Audit trail

Uploads, extractions, reviews, supplier requests, exports and plan changes are recorded in an append-only log: the database rejects edits and deletions, and each event is hash-linked to the previous one. Every evidence pack contains the chain head, and admins can email themselves checkpoints so the history can be verified from outside the application. This makes changes to the history detectable; it does not make them impossible for someone with full server access.

Infrastructure

Hosting details are provided on request. Connections use HTTPS. Passwords are stored as salted hashes. Sign-in, password reset and supplier links are rate-limited.

Sub-processors

No sub-processors are configured on this instance.

Contracts and contact

Questions: contact@dppmaker.com.

The battery-passport requirement set is based on the European Commission's non-binding guidance (v2.0, 15 August 2026). This service helps organise, validate and prepare evidence. It is not legal advice, a conformity assessment or a guarantee of compliance.