ProofPass — data sheet portal with proof of delivery

Under Article 31(9) REACH a new version of a safety data sheet must go free of charge to every recipient of the last twelve months, and Article 36 REACH requires the information to be kept for at least ten years. Many companies handle this with mailing lists and folders, and later it is hard to prove which version reached whom and when.

Technically that means: no document may be overwritten, every delivery needs its own traceable record, and many manufacturers must be kept cleanly apart on one platform although their product pages are public.

ProofPass is a multi-tenant web application: Next.js with the App Router, Payload CMS 3 as data and admin layer, PostgreSQL at Neon in Frankfurt, files in Vercel Blob, hosting on Vercel in the Frankfurt region.

Tenant isolation

Every manufacturer is a tenant. Manufacturer logins write only through server actions that take the tenant from the session and do not bypass access rules. Because products and documents must be publicly readable, every action also checks that the affected row belongs to the own tenant. References to other records are checked before saving.

A version archive instead of overwriting

Every version of a document is a row of its own. A new version marks the old one as superseded; nothing is deleted or overwritten. A SHA-256 hash is stored on upload; the public authenticity check computes the hash of a PDF in the browser and compares it without uploading the file. All data of a manufacturer can be exported as an audit pack: the browser builds the ZIP page by page, so no server response hits a size limit.

Delivery with proof

Every delivery gets a personal link. Opening and download are stored with a timestamp and can be exported as CSV. Confirming and unsubscribing work only through a button, because security scanners in company mailboxes open links automatically. Sending is capped per account and 24 hours, and without a configured mail service a delivery counts as failed, never as sent.

Interfaces

• A QR code per product with a short link that never changes, plus GS1 Digital Link via the GTIN.
• REST API v1, read-only, with bearer keys of which only a hash is stored.
• A public MCP server for AI assistants with four read-only tools. It returns only verified, current versions and names the source in every answer.
• Embedding by iframe, script widget or a plugin for WordPress and WooCommerce.
• Stripe for subscriptions, through Checkout and the customer portal.

How we build such connections for existing systems is described under system integration.

Languages

Manufacturer pages, widget, product passport and recipient mails exist in 15 languages. An automated test fails as soon as a text is missing in one of them. Website and dashboard are available in German, English and Polish.

AI where it helps

A weekly legal monitor queries the EUR-Lex database via SPARQL, the Official Journal feed and the Austrian RIS through their official interfaces and classifies findings with Claude Haiku or by rule. It never edits content itself; it reports to the editors. Checking a safety data sheet for the sections of Annex II, on the other hand, runs in the browser without AI and without an upload.