Security and Compliance

The Digital Product Passport holds sensitive product and supply-chain data. Here is how we protect it and which standards we work to.

Data security

• ISO/IEC 27001:2022 certification for information security management (reg. no. BG2026030401).
• Infrastructure on AWS with role-based access and encryption.
• Three access levels — public, professional and authority. Every field and file is classified to one of them, and the public passport shows only the public fields.

Compliance and standards

• Authenticated access for professionals and authorities (eIDAS) is in development; it also depends on the European Commission completing its implementing rules. Until then, restricted fields stay out of the public passport.
• Built to the European CEN-CENELEC standards for the DPP (the EN 18216–18223 series, cited in the Official Journal on 15 July 2026) for identification, security, and long-term data storage.
• Member of the CIRPASS-2 Stakeholder Community — the EU initiative preparing the DPP.

Retention and audit

• An audit trail of every change, with who made it and when; published passports stay public while the subscription is in force.
• No vendor lock-in: you can export all your data at any time — every passport, all files and metadata — in open formats. Every published passport also carries its data as JSON-LD (Schema.org), and everything in your account is reachable through the REST API.

Have a question about the security or compliance of a specific process? Book a free consultation and we’ll answer it concretely.

Our information security management system is certified by an independently accredited body. The details below are what the certificate can be verified against.

• Standard: ISO/IEC 27001:2022 — Information security, cybersecurity and privacy protection. Information security management systems. Requirements.
• Certificate holder: WIARA – DAAS EOOD
• Registration number: BG2026030401
• Certification body: INCERT EOOD
• Scope of certification: Development, maintenance and subsequent monitoring of software.
• Certified site: Plovdiv, Bulgaria
• Initial approval: 4 March 2026
• Valid until: 3 March 2029
• Statement of Applicability: Version 01 / 23 January 2026
• Accreditation: Bulgarian Accreditation Service (ИА БСА), Reg. No. 16 ОСС; IAF MLA signatory
• Verification: incert.bg

Independent verification in the IAF global database of accredited certifications: IAF CertSearch — WIARA – DAAS LTD.

Where. Data and passports are stored on AWS in the Frankfurt region (eu-central-1), inside the European Union. Published passports are served as static pages through a CDN, with a permanent address per product.

Whose. The data belongs to the manufacturer. WIARA processes it only to provide the service and uses it for nothing else.

Your data. You can export all your data at any time — every passport, all files and metadata — in open formats. Everything you enter is also reachable through the REST API, and every published passport carries its data as JSON-LD (Schema.org). More on the portability and backup obligations under the ESPR (Article 10(4) and Article 27).

On termination. Published passports stay public while the subscription is in force, including on the free plan; after that, you need to arrange a new provider for them — as stated on the pricing page. You can export everything — every passport, all files and metadata — in open formats, so if you leave, your data comes with you.

Responsibility. The manufacturer is responsible for the accuracy of the declared data — that is how the ESPR and the CPR work. WIARA is responsible for the platform: availability, data integrity, format to EN 18216–18223, the audit trail and ISO/IEC 27001 security.