Built for auditability, not just storage.

How NormaTrack Works (Under the Hood)

The data architecture is explicitly designed for supply chain immutability:

• Products are created or imported via CSV or API.
• Materials and suppliers are explicitly linked via structured, version-controlled relationships.
• Each product passport is linked to structured product, material, and supplier records.
• A persistent QR code links to a dynamic, constantly updated product record.

The QR code never changes. The data behind it is versioned.

Full Traceability & Audit Logs

Key platform changes are recorded as auditable events with actor, timestamp, and change context. You can instantly track:

• Who changed what.
• When the change occurred.
• What the previous value was before the mutation.

All Audit logs are fully exportable (CSV / JSON) for external compliance reviewers.

No silent edits. Every change leaves a trace.

Security & Infrastructure

EU-Based Hosting

Data is hosted in EU-based infrastructure with backups and recovery procedures in place to support operational resilience.

Encryption

Data is encrypted in transit and at rest to protect sensitive supply chain information.

Access Controls

Access is controlled through role-based permissions, ensuring data boundary safety.

Least-Privilege

Least-privilege access is tightly enforced for platform operations and automated processes.

Data Ownership

• You own your data: NormaTrack acts solely as a data processor on your behalf.
• We do not sell, share, or monetize your supply chain data for advertising, resale, or third-party monetization.
• You can export your complete workspace data at any time without platform vendor lock-in.

What NormaTrack Does NOT Do

We believe trust is built on strict boundaries. Unlike black-box solutions, we stand by these non-negotiables:

• We do not fabricate or interpolate sustainability data without explicit source attribution.
• We do not guarantee automatic regulatory approval (we provide the compliant semantic structure; the auditor provides the stamp).
• We do not modify published passports silently without an explicit, immutable trace in the audit log.

Compliance Support

• Designed to support evolving EU Digital Product Passport data requirements.
• Provides structured product, material, and supplier data for compliance-oriented workflows.
• Final regulatory responsibility and data accuracy remain with the company.

Governing Law

These Terms of Trust are governed by and construed in accordance with the laws of France, without regard to conflict of law principles. Exclusive jurisdiction for the resolution of any dispute arising out of or in connection with these principles shall reside in the competent courts of Paris, France.