What Happens to Your Product Data If Your QR Vendor Shuts Down?
Key Takeaways
- You own your data. BrandedMark is built to operate as a GDPR data processor, not owner, so your product data stays yours.
- Built for export, not lock-in. The platform is designed for full data portability in JSON, CSV, and GS1 XML, with no exit fees.
- Open standards protect you. FIDO2 passkeys and GS1 Digital Links mean your product identity is built on standards that outlast any single vendor.
The Vendor Risk Nobody Talks About
QR code and product registration platforms fail. Not in theory, but in practice.
How Platform Disruption Happens
Connected-product platforms are mostly venture-funded technology companies, and they follow the normal lifecycle of venture-funded technology companies. They get acquired. They pivot. They run out of runway. They let an SSL certificate lapse. Any of these events can break the link between a physical product and the digital experience a manufacturer built around it.
The mechanics are always similar. When a platform is acquired, product URLs and APIs often change, and the team that built the original integrations is absorbed into a different company with different priorities. A brand that encoded a vendor's URLs into physical packaging can suddenly find those URLs resolving to a different platform, or not resolving at all. When a certificate expires, every QR code pointing to a hosted product experience shows a browser security warning instead of the product page, and customers scanning codes on products they just bought see a "your connection is not private" message. When a platform shuts down, the original API and dashboard disappear, forcing an integration migration that requires engineering resources and creates a gap in service continuity.
These are not edge cases. They are the ordinary risks of building product identity on someone else's infrastructure.
The Five-Year Failure Scenario
Consider a hypothetical manufacturer to see how this plays out.
Year 1: You launch a product line with QR codes linking to your vendor's platform. Customers scan, register, and access manuals.
Year 3: The vendor pivots, gets acquired, or loses funding. Your account manager leaves. API documentation goes stale.
Year 5: The platform shuts down or merges. Your QR codes, physically printed on products still in customers' homes, now link to dead pages. Years of warranty registrations, customer data, and service history sit in a database you can't access.
The product is still alive. Your customer still owns it. But the digital experience you built around it is gone.
Commitment 1: You Own Your Data
Under GDPR and modern data privacy law, there's a crucial distinction between the data controller (you, the manufacturer) and the data processor (the platform handling your data).
Many QR vendors blur this line. They hold your product data, your customer relationships, and your service history. You're renting access. If they go under, your data goes with them.
The BrandedMark Data Model
BrandedMark inverts this:
- You are the controller. Your product data, including serial numbers, ownership records, warranty states, and service history, belongs to you.
- We are the processor. We store, index, and deliver access to your data on your behalf.
- This is contractual, not aspirational. Our Data Processing Agreement (DPA), provided at onboarding, names you as controller and BrandedMark as processor, with the legal recourse that GDPR's Article 28 processor obligations provide if we fail to comply.
What does this mean in practice? If BrandedMark is acquired tomorrow, the acquirer inherits the processor obligation. They can't repurpose your data, sell it, or deny you access. Your legal rights survive any corporate event.
For a deeper dive into structuring your data ownership, see our product data strategy guide and why your product data is your most undervalued asset. Understanding connected product customer lifetime value shows why controlling this data is a revenue question, not just a compliance one.
Commitment 2: Export Anytime, No Exit Fees
Data portability is a principle we build around, not an afterthought. Your right to export your own product data is set out contractually in our DPA, and open formats make that right practical rather than just promised. (This is distinct from the data-portability rights that GDPR Article 20 and the CCPA give individual consumers over their own personal data; those are end-user rights, not the basis for a manufacturer's export of its product records.)
BrandedMark is being built to provide full export in three standard formats:
What the Export Contains
JSON export. Every product record, every ownership event, every warranty state, and every service log entry. Fully structured with relationships preserved. Typical fields include product_id, serial_number, owner_id, warranty_start, warranty_end, service_events[], ownership_transfers[], registered_at, and last_scan. Machine-readable, ready for import into any modern system.
CSV export. Flat tabular export for spreadsheets, legacy systems, and manual review. One row per product, with columns for all core fields. Usable in Excel, Google Sheets, or any database import tool.
GS1 XML export. Industry-standard format for interoperability with supply chain platforms, DPP registries, and regulatory reporting systems. If you're subject to EU Digital Product Passport requirements, this export is structured to ease registry submission, though the final DPP interchange formats are still being set per product category under ESPR delegated acts, so confirm the current spec for your category.
What Migration Actually Looks Like
A migration from BrandedMark to another platform is designed to be a straightforward, self-service process:
- Export: Export your complete dataset from the dashboard or via the API.
- Map: Match BrandedMark fields to your new platform's schema. Most fields are GS1-standard and map directly.
- Import: Load into the new system.
- Redirect: Update your QR code base URLs. BrandedMark is designed to support URL forwarding during transition.
No fees. No waiting periods. No "exit tax." You can read the full migration guide. This portability also matters for certified pre-owned resale programs, where product history travels with the product across owners.
Commitment 3: Open Standards Protect Your Product Identity
BrandedMark is built on open standards, not proprietary protocols. This is a deliberate architectural decision that protects you from vendor lock-in at every layer.
FIDO2 Passkeys
When a customer registers a product with BrandedMark, they can create a FIDO2 passkey that cryptographically proves ownership. The private key lives on the customer's device, not on our servers. This phishing-resistant approach to product ownership identity is essential for manufacturers managing high-value or frequently resold products.
Important nuance: FIDO2 credentials are domain-scoped, meaning a passkey created on brandedmark.com won't automatically authenticate on a different domain. However, BrandedMark is designed to store the public key and credential metadata as part of your exportable data. If you migrate to a new platform, you can export these records and prompt customers for a lightweight re-enrolment, typically a single biometric confirmation, rather than starting from scratch. The ownership chain, product history, and entitlements transfer completely. Only the authentication binding needs a one-time refresh.
GS1 Digital Links
Every QR code BrandedMark generates is designed to follow the GS1 Digital Link standard. This means your product identifiers (GTINs, serial numbers) are encoded in a format that any GS1-compliant system can read. You're not locked into BrandedMark's URL structure. The underlying product identity is portable by design.
What This Means in Practice
If you leave BrandedMark, you take with you:
- Every product record and its full history
- Every ownership chain and transfer event
- Every warranty state and service log
- FIDO2 credential records for re-enrolment
- GS1-formatted identifiers that work with any compliant platform
Your product identity is yours. We host it, but we don't own it.
What "Data Durability" Actually Means
The term gets used loosely. Here's what we specifically commit to:
Four Pillars
Retention: Your data stays available as long as you're a customer. No auto-deletion, no data decay. The platform is designed with multi-region redundancy and automated backups.
Portability: Full export in standard formats at any time. No approval gates, no fees, no artificial delays.
Sovereignty: You remain the legal controller. We process on your behalf. Your DPA makes this enforceable.
Survivability: Even if BrandedMark ceases to exist, the open standards we build on (FIDO2, GS1, GDPR) give your data a path forward. No proprietary format traps you. This matters especially as digital product passport requirements become mandatory across more sectors, making the ownership records you capture harder to replace.
Frequently Asked Questions
What if BrandedMark gets acquired?
Your data ownership and portability commitments are contractual. They survive any corporate event. An acquirer inherits processor obligations. If they want to change terms, you receive notice and retain the right to export and leave.
How long does a data export take?
The dashboard export is designed to complete quickly for most manufacturers. For larger datasets, API-based exports are intended to run asynchronously and deliver a download link.
What format should I use for my export?
JSON if you're migrating to another product platform. CSV if you need to review data in a spreadsheet or import into a CRM. GS1 XML if you're feeding into a DPP registry or supply chain system.
Can you sell or repurpose my customer data?
No. You own it; we process it. We cannot repurpose, monetise, or share it without your explicit written permission. This is both a GDPR obligation and a core contractual commitment.
What about product QR codes already printed on packaging?
BrandedMark is designed to support URL forwarding during migration. Your existing QR codes can be redirected to a new platform's URLs without reprinting any packaging, at no additional cost.
Built to Outlast Us
The best infrastructure is invisible. It works when things go right, and it protects you when things go wrong. That's what data durability means: not a marketing promise, but a contractual, architectural, and legal commitment built to keep your product data yours whatever happens to any single platform.
Your product data should outlive any single platform. It should be yours, portable, and built on standards that don't depend on any one company staying in business.
Review our Data Processing Agreement or book a walkthrough to see exactly how your data is structured, exported, and protected.