What happens to your data, written down so you can check it
Battery passports are compliance data. You need to know where they sit, who can see them and what happens when something goes wrong. This page answers that without marketing - including what we do not have yet.
For the procurement checklist
If you opened this page for a vendor assessment, these are the six answers that usually get asked for.
- Application and database run in the EU, Frankfurt region.
- Data is encrypted at rest with AES-256; every connection uses TLS 1.2 or higher.
- Tenants are separated by row-level security in the database, not only in the application.
- A data processing agreement under Art. 28 GDPR exists and is delivered as a PDF at signup.
- Every sub-processor is named; changes are announced 14 days in advance.
- We hold no ISO 27001 certification. What is verifiable instead is set out below.
Where your data actually sits
Three stops, no more. We run no servers of our own and keep no copy of your data outside this chain.
- 01BrowserYour device
The dashboard is a static application. It talks only to the two stops below. The key with full database access is never part of the shipped code.
- 02Application layerEU - Frankfurt
Serverless functions on Vercel, pinned to region fra1 (Frankfurt). Validation, permission decisions, mail dispatch and scheduled jobs run here.
- 03Database & storageEU - Frankfurt
Postgres, authentication and file storage at Supabase, hosted on AWS in the EU region. Uploaded evidence sits in a per-company folder that the storage policy enforces.
A few providers operate administrative and support systems outside the EU. Each is listed below with location, purpose and legal basis - the full list, not a sample.
Technical and organisational measures
Identical to Annex 2 of the data processing agreement. The agreement is the binding version; this page is the readable one.
Confidentiality
- Encryption
- TLS 1.2 or higher for every connection between browser, application layer and database. AES-256 for data at rest in the database and file storage.
- Access control
- Row-level security in Postgres separates companies per row via the tenant_id column. Roles are enforced at database, API and interface level. Authentication uses JSON Web Tokens.
- Operational access
- Two-factor authentication on every administration console. Full-access keys live only in server-side functions, never in shipped code. No production credentials on developer machines.
Integrity
- Write access
- Every write goes through an authenticated endpoint with input validation. Database transaction semantics prevent half-finished states.
- Traceability
- Security-relevant events such as role changes, cancellation and deletion land in the audit log. Passports and models additionally carry a running hash chain.
- Abuse protection
- Public and unauthenticated endpoints are rate limited. If the counter itself fails, the system lets traffic through rather than blocking legitimate requests.
Availability
- Recovery
- Point-in-time recovery with a seven-day window, accurate to the minute. Plus daily database snapshots and regular restore drills.
- Redundancy
- Serverless execution with automatic scaling. No self-operated server that could fail on its own. Network-level protection against denial-of-service traffic.
- Monitoring
- Runtime errors feed a central collector. The current operating state is published openly.
Deletion & retention
- Cancelling deletes nothing
- Cancellation ends the subscription and drops the account to the free plan. Your data stays readable and exportable.
- Personal data
- An employee account is deleted in full through team management. The plain-text name in the audit log is replaced by a neutral placeholder, and the log chain stays intact.
- Passports under retention duty
- Battery passports must stay reachable under Art. 77 of the regulation. They are frozen technically but remain publicly resolvable, even once you are no longer a customer.
- Final deletion
- Only on the owner's explicit instruction, with a documented transfer of liability. Then a 30-day grace period, after which an automated process removes files, accounts and company data.
Who sees what
Permissions are enforced at three levels: database, API and interface. Hiding a button is not protection as far as we are concerned.
- Owner
Exactly one person per company. On top of all admin rights: company data, billing, transferring ownership, deleting the company.
- Admin
Team, invitations, integrations and API keys, plus everything an editor can do.
- Compliance
Reads everything including the audit log and certificates, changes nothing. Built for auditors and compliance officers.
- Editor
Maintains models, passports, suppliers and certificates. No administrative rights.
- Read only
Read access only, for management or guests.
Outside your company: the public passport page shows only the fields the regulation designates for the general public. Recyclers and authorities reach the extended fields only after an individually approved access grant, and every one of their lookups is logged.
Why you do not have to take our word for it
For compliance data, an assurance that nothing was altered is not enough. So every version of a model and a passport carries a fingerprint that contains the fingerprint of the previous version.
- 1
Every change is sealed
On save, the database computes a SHA-256 hash over the full record plus the previous version. This happens in a database trigger, not in the application - it cannot be bypassed.
- 2
The chain can be recomputed
A public check recalculates the entire chain. If a single hash does not match, the result is invalid. Altering an old version destroys every link that follows it.
- 3
No account, no wallet
Market surveillance, auditors and your customers verify in a browser. The check returns only the result and the hashes, never your passport content.
The company audit log uses the same chain logic. Removing an entry after the fact breaks it visibly.
Sub-processors
The complete list. Anyone not named here processes no data for us. Changes are announced 14 calendar days in advance and you may object.
| Service | Provider | Purpose | Processing location | Legal basis |
|---|---|---|---|---|
| Supabase | Supabase Inc., Singapore | Database, authentication, file storage for uploaded evidence. Uses AWS in the EU region as a further sub-processor. | EU (Frankfurt) / USA | DPA + SCCs |
| Vercel | Vercel Inc., USA | Hosting of the web application and serverless functions, region fra1 (Frankfurt). | EU (Frankfurt) / USA | DPA + SCCs |
| Stripe | Stripe Payments Europe Ltd., Ireland | Payments, invoicing, customer portal. Independent controller for card data, processor for payment metadata. | EU (Ireland) / USA | DPA + SCCs |
| Resend | Resend Inc., USA | Transactional email: invitations, reminders, support replies. | USA | DPA + SCCs |
| Anthropic | Anthropic PBC, USA | Field suggestions extracted from evidence you upload. Only on your explicit trigger, only the selected document, never used to train models. | USA | DPA + SCCs |
| Sentry | Functional Software Inc., USA | Runtime error collection. Active only when configured. | USA | DPA + SCCs |
Every transfer outside the EU is covered by a processing agreement with standard contractual clauses.
What we do not have
This list is here because it comes up in any vendor assessment anyway. We would rather you read it from us.
No ISO 27001 certification
We are not ISO 27001 certified and claim it nowhere. The measures above are implemented and contractually assured, but not audited by a certification body. If your procurement requires a certificate, say so in the first call and we will discuss whether and when that becomes feasible for you.
No external penetration test
There is no report from an independent tester. We state that openly rather than writing “regular security testing” and meaning our own checks.
No guaranteed uptime figure
We do not promise a percentage we neither measure nor could prove in a dispute. Instead we publish the operating state and every incident openly. Binding commitments are part of enterprise contracts.
Some processing outside the EU
Mail delivery, error collection and the optional document extraction run with providers in the USA. That is named openly in the table above. Your passport and model data sit in Frankfurt.
Found a security issue?
Report it to us before you publish it. We reply within two working days and keep you posted on the fix.
support@batteriepasswerk.com- We will not pursue legal action over a report made in good faith without data exfiltration.
- Please avoid testing that exposes other people's data, disrupts the service or touches third-party accounts.
- Include reproduction steps, the affected address and the time.
- On request we will credit you in the changelog once the issue is fixed.
Frequently asked questions
A question left that this page does not answer?
Send it to us. If the answer is useful to others, it ends up on this page.
Last reviewed: