The company that keeps your passport alive after you stop selling the product.
A Digital Product Passport does not retire when the product sells out. The EU expects passports to stay accessible for the product’s regulated lifetime — up to 15 years — which is longer than many product lines, IT systems and even companies last. To make that credible, the regulation foresees a dedicated role: the DPP service provider (DPPSP), an entity that hosts, backs up and keeps passports available on behalf of economic operators. Here is what the role involves and how to pick one.
Last updated:
In one line: a DPP service provider hosts and safeguards Digital Product Passports on an operator’s behalf — independent custody, availability for up to 15 years, and a named reference in the EU registry — because the duty to keep a passport online outlives most products and some companies.
Why the role exists
The DPP model has a structural weakness the legislators saw coming: the passport is a live digital record, but the company responsible for it may restructure, be acquired, or disappear long before the last product unit leaves circulation. A QR code on a mattress sold in 2028 must still resolve in the late 2030s. The regulation’s answer is to make passport custody a service that can be professionalised: economic operators may entrust hosting to a DPP service provider, whose job is continuity — keeping the data available, backed up and intact for the full regulated lifetime, independently of the fortunes of any one brand.
What a DPPSP actually does
Hosting and resolution — serving the passport whenever its identifier (typically a GS1 Digital Link QR) is scanned, with the uptime a legal record demands.
Backup custody — maintaining copies so the passport survives failures, including the operator’s own insolvency.
Integrity — keeping the record verifiably authentic and untampered over years.
Registry reference — the EU DPP Registry records who holds each passport, so the provider is a named, accountable part of the compliance chain, not an invisible subcontractor.
Note what is not transferred: the economic operator remains legally responsible for the passport existing and being accurate. The DPPSP carries the operational persistence duty.
What to check before choosing one
EU hosting and jurisdiction — passport data serving an EU legal obligation is safest on EU-sovereign infrastructure, outside the reach of third-country access laws.
Real backup custody — ask precisely what survives if the provider itself fails, and who holds the copy.
Seal support — a qualified eIDAS seal on each passport gives regulators and buyers cryptographic proof of origin and integrity.
Registry integration — the provider should file registration data to the EU DPP Registry (open since 19 July 2026) as part of publication, not leave it to you.
Longevity economics — a 15-year duty needs a pricing model and an organisation built for it, not a startup feature that may be sunset.
Formal requirements and any certification or listing of providers are still being finalised — until then, these substance checks are your best filter.
Where PassPer fits
PassPer performs the DPPSP role as part of an end-to-end service: AI extraction builds the passport from documents you already hold (spec sheets, certificates, supplier declarations) with human review; each passport is signed with a qualified eIDAS seal, published behind a GS1 Digital Link QR, hosted on EU-sovereign infrastructure with backup custody, and filed to the EU registry. Plans run from €79 to €719 per month with a free 30-day pilot and no setup fees — see what your products need with the free readiness check.
Frequently asked questions
Do I have to use a DPP service provider?
No — an operator can host its own passports if it meets the availability, backup and interoperability requirements. In practice most companies choose a provider, because guaranteeing that a web-resolvable data record stays online for up to 15 years — through IT migrations, rebrands and reorganisations — is not a core competence of a furniture maker or an importer.
Is there an official certification for DPP service providers?
The framework anticipates requirements that providers will have to meet, and the details — including any formal certification or listing mechanism — are still being finalised in implementing rules. Until they land, judge providers on the substance: EU hosting, independent backup custody, integrity sealing and registry integration.
What happens to our passports if the provider goes out of business?
This is exactly the scenario the backup-custody requirement addresses: passport data must be kept so that it survives the failure of any single company, including the provider itself. When evaluating a provider, ask specifically how their backup arrangement works and who holds the copy — a vague answer is a red flag.
Is PassPer a DPP service provider?
PassPer operates as one in substance: it hosts passports on EU-sovereign infrastructure with backup custody, seals them with a qualified eIDAS seal, and handles registry filing — alongside building the passports in the first place via AI extraction from your existing documents. As formal designation mechanisms are finalised, PassPer intends to meet them.