Platform rules

Last updated 25 October 2026

A battery passport is only useful if people can trust it. These rules explain what everyone who uses Serial Passport agrees to. They are part of our Terms of Service. If the two ever conflict, the Terms of Service apply.

1. Who these rules apply to

• Customers: economic operators (manufacturers, importers, distributors and authorised representatives) that issue passports, and everyone they invite to their workspace.
• Verified parties: repairers, recyclers, second-life operators, notified bodies and authorities with access to restricted passport data.
• Developers who use the Serial Passport API.
• Visitors who scan a passport or use this website.

2. Keep passport data accurate

• The economic operator is responsible for the data in its passports. Serial Passport hosts the data but does not verify it on your behalf.
• Publish a product model only when its data is complete and correct, and correct mistakes as soon as you find them.
• Record lifecycle events (repair, second life, recycling) only when they really happened, with the real date. Do not backdate or invent events.
• Corrections are added as new entries. The history of a passport is never rewritten, so earlier versions stay traceable.

3. No false or misleading passports

You may not:

• issue passports for batteries you do not place on the market, or for batteries that do not exist;
• copy, reuse or imitate passport numbers, QR labels or certificates of another operator or of Serial Passport;
• claim compliance, certifications or test results you do not hold;
• use a passport to advertise unrelated products or to send visitors somewhere misleading.

4. Accounts, roles and employees

• Every account belongs to one person. Do not share passwords or sign-in links.
• Give each employee the role with the least access they need. Remove people who leave your organisation straight away.
• The workspace owner is responsible for who has access and for everything done in the workspace.
• Every change is recorded in the audit trail with the person who made it. Do not try to hide or remove audit entries.

5. Restricted data

• Verified parties may use restricted data only for the purpose they were verified for: repair, remanufacturing, recycling, second-life use or supervision.
• Do not copy restricted data in bulk, resell it, or combine it into other databases.
• Every view of restricted data is logged and visible to the economic operator.

6. API and fair use

• Keep API keys secret. Rotate a key immediately if you think it has been exposed.
• Stay within the rate limits of your plan. Contact us before running load tests.
• Do not try to get around rate limits, access controls or other security measures.

7. Never allowed

• Trying to access another organisation's workspace or data.
• Uploading malware or anything that harms the service or its users.
• Putting personal data in public fields such as event notes. Public passport data can be read by anyone who scans the label.
• Anything unlawful under EU law or the law of the country you operate in.

8. Reporting problems

• Security vulnerabilities: open a Security ticket. See our Security page.
• A passport with wrong or suspicious data: use Report a passport with the passport number. We forward it to the responsible operator.
• Requests from authorities: open an Authorities and legal ticket.

9. What happens if the rules are broken

Depending on how serious it is, we may warn you, restrict features, suspend accounts or end the agreement, as set out in the Terms of Service. Passports that are already on batteries stay reachable where the law requires it. We keep the audit trail and may share it with authorities when we are legally required to.

10. Changes to these rules

We will announce material changes at least 30 days before they take effect, by email to workspace owners and on this page.