Data and trust
What Odal Node can and cannot see.
Odal Node is built on a proof-bound architecture: the manufacturer's raw production data is validated and signed locally, on infrastructure the manufacturer controls, then discarded. Only the signed proof is stored and served. This is a property of the software, not a policy promise — it holds regardless of who operates the node.
Scan telemetry
What a scan count is, and what it is not.
When a passport is resolved, the node can record that it happened — an aggregate count, per passport, per day. That is the whole of it. A scan count records nothing about the person who scanned: no IP address, no device, no location, no identity, no session. The software has no field in which to store any of it, so there is nothing to leak and nothing that could quietly become tracking. Producing a QR-code image is counted separately — it measures label production, not people.
By deployment
The guarantee differs, and stating that plainly is part of the design.
| Property | Self-hosted | Managed |
|---|---|---|
| Node discards raw inputs; stores only the signed proof | Yes — architectural invariant | Yes — architectural invariant |
| Odal can access stored data | No — not present in the deployment | Constrained by access controls, audit logging, and contract |
| Odal can sign on the operator's behalf | No | No — the operator holds the signing keys |
How it works
The mechanism, not the promise.
- Import. Product data arrives at your node — CSV, Excel, or an ERP export. This happens on infrastructure you control.
- Validate. The node validates locally against versioned sector schemas. Validation is a pure function — no network calls, no third-party API.
- Sign. Your private signing key — generated and held in-process on your infrastructure — signs the validated passport. The result is a signature cryptographically bound to your published
did:webidentity. - Publish. Only the signed passport becomes publicly resolvable via QR and GS1 Digital Link. The raw input is discarded.
- Verify. Any consumer, authority, or recycler verifies the signature against your public DID Document. Verification does not require Odal to be online or to exist.