Redy coordinates manufacturer requests, supplier evidence, approvals, APIs, and passport outputs. This page explains the controls behind that workflow and separates current posture from certification roadmap.
Only manufacturer workspaces with issuer authority can create, publish, export, or revoke DPPs.
Suppliers can operate independently while grants and requests keep manufacturer access explicit.
DPP issuer scopes and supplier-platform scopes stay separated at creation and rotation.
Unauthenticated contact surfaces are guarded and escaped before email delivery.
Redy separates manufacturer issuer workspaces from supplier workspaces. Runtime guards check organization capability before issuer actions, and API scopes are minted from the same lane model.
DPP operations preserve state transitions, version history, provenance context, and audit attribution so teams can explain what changed before a passport was published.
Portal and B2B flows use scoped APIs, lane-specific permissions, idempotency patterns, and webhooks so integrations can move approved data without bypassing workflow controls.
Buyers need to know Redy understands QR access, unique identifiers, GS1 Digital Link patterns, and resolver behavior. The public claim still has to stay inside what is implemented and supportable.
The EU Battery Regulation requires QR-based access and unique identifiers for in-scope battery passports from 18 February 2027. Redy positions GS1 Digital Link as a strong implementation pattern, not as a regulation-mandated requirement.
Redy resolver design follows GS1 Digital Link URI patterns such as GTIN, batch/lot, and serial segments so one product identifier can point to the right DPP resources.
The resolver model can separate public passport pages, machine-readable data, certification context, sustainability evidence, safety information, and role-based resources.
Redy publishes a public, unauthenticated DPP data dictionary following the EN 18223 section 4.3 decoupled-dictionary model, with English and Spanish labels and cross-references to schema.org, the GS1 Web Vocabulary, and CIRPASS-2. Paywalled catalogues like ECLASS stay opt-in cross-references, never a requirement.
View the dictionaryGTIN-level passport or product model resource.
Batch or lot-level evidence and status.
Item-level resource for a serialized battery or product unit.
Trust pages should not invent certifications. Redy can still give buyers a useful diligence path by showing implemented controls, roadmap items, and the documents teams can request.
Access control, auditability, rate limiting, key scope separation, and supplier/manufacturer workspace boundaries are documented as buyer diligence material.
Redy holds a qualified electronic seal issued by a qualified trust service provider (QTSP) under eIDAS. It is held at organisation level; passport credential signing is separate and runs at substantial assurance today.
Redy should not claim SOC 2 certification until an audit is complete. The trust page tracks the readiness posture and the path to formal attestation.
Control families can be mapped to ISO 27001 expectations as the platform moves from launch posture toward formal certification.
Buyer review should have a clear path for data processing terms, subprocessor visibility, and privacy questions before production onboarding.
Redy treats AI-assisted work as an extension of the governed workflow, not a shortcut around consent, review, or audit.
See AI controlsThe public page should answer first-pass questions. Enterprise buyers can request the deeper materials behind the current posture and roadmap.