DPP Hosting: the choice that ensures you can’t go wrong with ESPR

Why Hosting Is a Strategic Decision, Not Just a Technical One

When designing a Digital Product Passport (DPP), the focus often falls on the data: what information to collect, from which suppliers, and in what format. However, a subsequent question arises that carries long-term implications: where will these passports be hosted?

The starting point is straightforward yet binding: the passport must remain accessible throughout the entire lifespan of the product, even if the technology provider—or the company that originally created the passport—changes over time. A QR code printed today on a product with a fifteen-year lifespan must remain functional for those fifteen years, regardless of mergers, changes in software vendors, the decommissioning of platforms, or business failures.

This shifts the nature of hosting from a mere infrastructural choice to a decision concerning business continuity and regulatory compliance.

The Regulatory Framework: What the ESPR Requires

The governing framework is Regulation (EU) 2024/1781, known as the ESPR (Ecodesign for Sustainable Products Regulation), which entered into force on July 18, 2024. The rules regarding the digital product passport are primarily outlined in Articles 9 through 13, while specific delegated acts will determine which product categories must carry a passport and what data it must contain.

Regarding hosting, there are four key points.

1. Who Can Store the Passport

The passport may be stored by the economic operator responsible for its creation or by a digital product passport service provider (DPP service provider). The model is therefore decentralized: there is no single European server that houses all such passports. The ESPR defines a service provider as a third-party, independent natural or legal person—authorized by the economic operator placing the product on the market—who processes passport data to make it available to those entitled to access it.

2. The mandatory backup copy

This is the most significant requirement when choosing a hosting solution. The economic operator placing the product on the market must ensure that a backup copy of the passport—in its most up-to-date version—is made available through an independent service provider.

In practice, even those who choose to host their own passports internally must still rely on a third party for backups. The rationale is clear: should the primary entity cease to exist, the backup copy remains.

3. Continued availability following insolvency or business closure

The passport must remain accessible for the duration specified by the relevant delegated act (which corresponds at least to the expected lifespan of the product), even in the event of insolvency, liquidation, or the cessation of operations within the European Union by the economic operator that created it.

4. Open formats and the avoidance of vendor lock-in

Data must be based on open standards, be in an interoperable and structured format, be machine-readable where necessary, and be transferable without vendor lock-in. Furthermore, service providers are prohibited from selling, reusing, or processing passport data beyond what is strictly necessary for the provision of the service, unless otherwise agreed upon with the economic operator.

The European passport registry

Rounding out the framework is the digital registry for DPPs (Digital Product Passports) mandated by Article 13, which stores at least the unique identifiers and includes a reference list of verified service providers. The implementation procedures have been defined by Implementing Regulation (EU) 2026/1778. The registry does not replace hosting: it acts as an index, while the actual data remains with the operator or their respective providers.

The four possible approaches

When faced with the question, "Where will you host the passports?", there are three realistic options, plus an initial prerequisite.

Proprietary platform

A solution developed and managed in-house or built on a custom, bespoke basis.

Advantages

• Complete control over data, architecture, and the development roadmap.
• Deep integration with existing ERP, PLM, and quality management systems.
• No commercial dependency on a third-party platform provider.

Disadvantages

• High initial and ongoing maintenance costs, incurred over decades.
• Requires qualified personnel with expertise in security, system availability, and standards.
• Does not exempt the operator from the requirement for a backup with an independent third-party provider.
• Risk of "technical debt": an in-house platform that is abandoned after five years creates a compliance issue.

Suitable for: Large corporate groups with strong internal IT capabilities and high product volumes.

SaaS License

A ready-to-use platform available via subscription, managed entirely by the provider.

Advantages

• Rapid implementation and predictable costs.
• Regulatory and technical updates handled by the provider.
• The provider can often also act as a DPP (Digital Product Passport) service provider for primary hosting or backup.

Disadvantages

• Dependence on the provider’s business continuity.
• Risk of vendor lock-in if data export and portability are not contractually guaranteed.
• Limited customization.

Suitable for: SMEs and companies that want to achieve compliance quickly without building internal expertise.

PaaS License

Cloud services (databases, APIs, identity management, storage) upon which you can build your own solution.

Advantages

• A balance between control and speed: the infrastructure is managed for you, while the application logic remains yours.
• Scalability and reliability typical of major cloud providers.

Disadvantages

• Requires development expertise.
• Potential dependence on the specific services of the chosen cloud provider, unless portable abstractions are designed.
• Still requires backups to be maintained with an independent third party.

Suitable for: Companies with a digital team that want a bespoke solution without having to manage the underlying infrastructure.

Undecided

This is a perfectly valid response during the early stages. However, it is important not to delay too long: the choice of hosting influences your identifier schema, the URLs printed on your products, and access management—decisions that become difficult to change once products are already on the market.

Quick Comparison

Criterion	Proprietary	SaaS	PaaS
Implementation time	Long	Short	Medium
Initial cost	High	Low	Medium
Control over data	Maximum	Contractual	High
Internal expertise required	High	Low	Medium
Lock-in risk	Low	Must be managed	Medium
Backup with an independent third party	Mandatory	Mandatory	Mandatory

Questions to ask before choosing

Regardless of the model, before signing a contract or beginning development, it is advisable to verify the following:

1. Where is the primary data stored, and where is the backup copy kept? Is the backup provider truly independent?
2. What happens to the "passports" if the provider goes out of business or is acquired? Are there continuity clauses or data escrow arrangements in place?
3. What happens if our own company ceases operations? Who ensures the continued availability of the data?
4. Can the data be exported in open, standard formats without prohibitive costs or restrictions?
5. Are the URLs and identifiers under our control (e.g., on a company domain with a manageable resolver), or are they tied to the provider’s domain?
6. What is the provider permitted to do with the data? Does the contract prohibit the sale or reuse of the data beyond the scope of the service?
7. How ​​are differentiated access levels managed for consumers, repairers, recyclers, and authorities?
8. For how long must the historical data remain available, and who will bear the costs over time?

A practical tip: separate the URL from the platform

One of the costliest mistakes is printing URLs on products that point directly to the platform provider’s domain. If the provider changes, those QR codes become unusable. Using your own domain (or a resolver based on standards such as GS1 Digital Link) allows you to change backends without affecting products already in circulation. This is the most practical way to ensure the passport remains truly independent of any specific provider.

Key Deadlines to Watch

The battery passport serves as the initial litmus test: starting February 18, 2027, it will become mandatory for batteries used in electric vehicles, light means of transport, and industrial applications exceeding 2 kWh. For other categories—such as textiles, steel, furniture, and electronics—the specific dates will depend on the individual delegated acts outlined in the ESPR (Ecodesign for Sustainable Products Regulation) work plan. Taking action now offers the advantage of being able to select a hosting solution at your own pace, rather than being forced into a last-minute decision.

Conclusion

Deciding where to host your passports essentially means choosing who will safeguard the history of your products in the years to come. Whether you opt for a proprietary, SaaS, or PaaS model, the approach is valid—provided it adheres to three non-negotiable principles mandated by the ESPR: backups held by an independent third party; data availability that outlasts the lifespan of both your company and the service provider; and open, portable data. Everything else is a matter of expertise, budget, and timing.