Passport access

The same code on the item opens a different view depending on who scans it, and the regulation expects it: a consumer, a business partner and an authority need different subsets of the same data, and some of it should never reach the public at all.

The customer

A consumer scans the code and lands on a plain web page. It confirms that the item is genuine, shows its custody state and its batch, and carries whatever you chose to show publicly: care instructions, materials, the repair offer, the story of the piece. It never shows the purchase order number or the price. Some fields are hidden from the public by default (the internal SKU, the manufacturer and legal entity identifiers, and the technical proofs behind the record), because none of them help a customer and some of them would expose your supply chain.

A consumer scan only reads the passport. It does not write an event to the passport, and it collects no personal data about the person scanning.

The partner

A reseller, a repairer or a returns site scans the same code and gets structured data rather than a page: more fields than the consumer, enough to authenticate a second-hand piece or to confirm that the item coming back across the counter is the one that went out. By default a partner sees almost everything, with only the audit proofs held back. It is the view a return is checked against, and the one a resale uses to transfer ownership without losing the item's history.

The regulator

An authority sees the full record: the identifier, the provenance, the declared compliance, the materials and the proofs, without asking you for a paper file. The regulation is written around this view, which is why the record is kept complete even when the public page shows a fraction of it. When a passport is in the published state, this view is served live from the same record the other two read.

The customer sees the fields that help them, the regulator sees everything, and you decide the line between.

Disclosure layers

The disclosure policy in your account shows which fields each audience is allowed to see, seeded from the official disclosure matrix. That screen shows the rules in force, and account-specific overrides are set through the API. The policy stops sensitive data reaching consumers, so whenever a default is overridden the next step is the resolver preview, which takes a product's QR link and shows the consumer, partner and regulator views side by side. Look at the consumer view as a customer would, before publishing.

The daily anchor

Every day the tracking events in your account are reduced to a cryptographic anchor, and any single event can later be shown to have been part of that day's record, unaltered. It exists for the one situation where an auditor, a regulator or a customer disputes whether, or when, something was recorded, and it proves that your own log was not changed after the fact.

After the sale

Because the passport belongs to the item's identifier rather than to an order, the three views keep working after delivery. A repair is written to the item with the parts used. A resale moves ownership and keeps the history. A recall can be limited by identifier to the affected items and the customers who received them. And at end of life the record carries the declared composition for the sorting centre, which reads it with partner access.