Security and data protection
Your data stays yours, and every change stays visible
A battery passport holds information not everyone may see, and it has to be right for years. That is why BatteryPass enforces access rules on the server, logs every change and signs every published passport.
Access
Access tiers, enforced on the server
The Battery Regulation splits the passport's information into tiers: public, for persons with a legitimate interest, and for authorities. BatteryPass filters on the server; protected information is never in a public response.
Traceability
Who changed what, and when?
A log entry for every change
Every change writes an entry to the organisation's log, in the same transaction as the change itself. The log is only appended to, never overwritten.
Four eyes
Whoever enters a value cannot approve it. Roles separate editing, reviewing and administration.
Provenance of every value
Values are not overwritten but superseded: the earlier version stays with its source, evidence and person.
Integrity
Signed, versioned passports
Signatures that verify offline
Every published version is signed with Ed25519. The public keys are published, so anyone can check a signature without our server.
Versions by date
Earlier versions stay retrievable. Whoever scans a QR code sees the current version and can trace the older ones.
Access control
Sign-in, keys and integrations
Sign-in
Passwords with Argon2id, sessions on the server, cookies only over HTTPS and protected against requests from other sites. Two-factor sign-in and SSO are planned.
API keys with scopes
Integration keys read data, report condition data or stage imports. They never approve and never publish; that stays with people.
Suppliers without an account
Suppliers and service partners work through a link that is valid for exactly one request or one unit.
Operations
Operation, backup and export
One image, one host
BatteryPass runs as one container image with PostgreSQL and S3-compatible file storage. Where it runs is stated in the data processing agreement.
Backup and restore
Database and files are backed up; we have run a complete restore as a drill.
No lock-in
The full export is documented and can be imported again. Passports use open formats and GS1 identifiers.
Data protection
Data protection without small print
This website
No cookies, no third-party content, no analytics. We serve fonts and images ourselves.
AI assistant only on request
The assistant is in testing and off until the operator activates it and an owner allows it for the organisation. Then conversations and the data read for them go to Anthropic; BatteryPass says so before it is switched on.
Frequently asked questions about security
Who can see the protected information of a passport?
The public sees only the public tier. Information for persons with a legitimate interest and for authorities is released by the server only when the manufacturer has granted access per email address, and every read is logged. This feature is limited until the implementing act under Art. 77(9) defines who is entitled.
Can we get all our data out?
Yes. The organisation export contains every value, document, unit and the log in a documented format with checksums that can be imported again.
Is there two-factor sign-in?
Not for customers yet; two-factor sign-in and SSO are planned. Passwords are stored with Argon2id, and sessions live on the server.
Does the website use cookies or tracking?
No. This website sets no cookies, loads nothing from third parties and has no analytics switched on. The demo form sends your details directly to our application.