EUDR Passport: facts for vendor assessment
This page answers the questions a procurement, compliance, supply chain or legal team asks before choosing EUDR software. Plain facts, no marketing, maintained by Trusty AG. Last reviewed: 9 November 2026.
Product page: EUDR Passport. Prices: Pricing. Your role: Check your EUDR obligations (free). Questions not answered here: book a walkthrough.
Product at a glance
| Item | Fact |
|---|---|
| Product | EUDR Passport: EUDR software to collect supplier and plot data, assess risks, resolve flagged risks and file due diligence statements |
| Provider | Trusty AG, Hünenberg (canton of Zug), Switzerland |
| Type | Online software in the browser, nothing to install; suppliers answer in their own free account |
| Built for | Operators that place or export the seven commodities and their derived products (cattle, cocoa, coffee, oil palm, rubber, soy, wood), downstream operators and traders |
| Regulation | Regulation (EU) 2023/1115 (EUDR). Applies from 30 December 2026; qualifying micro and small operators from 30 June 2027 |
| Customers | More than 1,000 companies use Trusty software |
| Hosting | EU |
| Filing | Due diligence statements submitted to the EU Information System (TRACES) with your own credentials, or through our authorised representative, an EU law firm |
Pricing
| Item | Fact |
|---|---|
| Account, product profiles, supplier invitations, data collection | Free |
| Operators | €90 per product profile per year: risk assessment, 12 months of monitoring, unlimited due diligence statements while the profile is unchanged, no fees per shipment or statement |
| Product profile | One supplier, one product and the plots where it is harvested. A new supplier, a new product or changed plots means a new risk assessment |
| Downstream operators and traders | €75 per year for the first commodity from each supplier, €25 for each additional commodity from the same supplier |
| Filing through our authorised representative | €10 per due diligence statement |
| Optional | Resolve Essential (plot-level risks) and Resolve Complete (adds country risk and supply chain complexity) |
| Large plot areas | Priced by area |
| Suppliers | Free account to answer your requests; they pay only if they use EUDR Passport for their own compliance |
| Billing | Per product profile per year, by invoice or card. Prices exclude VAT |
Legal requirements covered
Regulation (EU) 2023/1115. Trusty is a software provider, not a law firm: your company remains responsible for the final assessment and compliance decision. The table shows which feature supports which obligation.
| Step | What the law requires | How EUDR Passport covers it |
|---|---|---|
| Collect | Gather product, supplier and geolocation data for every plot before placing goods on the EU market (Art. 9). | Product profiles hold all Art. 9 data. Supplier onboarding is free, and suppliers answer online without paying for an account. |
| Assess | Assess the risk of non-compliance across all four risk chapters. Simplified due diligence can apply where all commodities come from low-risk countries and the risk of circumvention or mixing is negligible (Art. 13). | Automated risk assessment for each product profile, a clear answer on whether simplified due diligence applies, and 12 months of monitoring included. |
| Resolve | Where risk is not negligible, take mitigation measures until it is, such as extra documents, supplier checks or audits (Art. 11). | Flagged risks are resolved in the product profile, by you or with the optional Resolve modules. Evidence, reasoning and the risk level you set are recorded as your documented mitigation. |
| File | Submit a due diligence statement to the EU Information System before placing products on the market, and keep the reference number (Art. 4). | Unlimited due diligence statements filed with your own credentials at no extra cost, or through our authorised representative. Reference numbers are stored automatically. |
| Keep records | Keep due diligence statements and supporting evidence for five years and show them to authorities on request (Arts. 4(3), 9(1), 12(5)). | Statements, evidence and the full audit trail stay in EUDR Passport and export in one click for inspections. |
| Downstream and traders | Collect the reference numbers of the statements of suppliers that are operators, and keep them (Arts. 5(3)(a), 5(4)). | Monitoring of your suppliers’ products, including reference number checks, adverse media and screening against EU infringement judgments, with guided responses when something changes. |
Risk assessment and monitoring
| Item | Fact |
|---|---|
| Risk areas | Deforestation, indigenous and community rights, supply chain complexity, country risk, adverse media and the EU list of infringement judgments |
| Geolocation checks | Points or polygons, entered, drawn or imported, checked against JRC Global Forest Types 2020, Global Forest Watch deforestation alerts and indigenous and community land layers |
| Simplified due diligence | The assessment states for each product profile whether it applies |
| Monitoring | 12 months per assessed product profile against country, media and geolocation sources and the EU infringement list; changes are flagged |
| Supplier requests | Full product profile, one section, a confirmation that nothing changed, or a free question; each request has its own thread and due date |
| Audit trail and records | Every assessment, document, decision and supplier request is logged with time and user; records kept for five years and exported in one click |
Contract terms
| Item | Fact |
|---|---|
| Contract | Online Terms of Service and Price Document; Swiss law, courts of Zug |
| Price changes | Annual indexation to the EU consumer price index (Eurostat); other price increases apply from the next renewal only |
| Term and renewal | Runs until cancelled; cancel at any time from within the app, effective at the end of the paid term, full access until then |
| What happens at the end | Account locked for 30 days with export available, then permanently deleted from production; deletion from backups follows the regular backup rotation |
| Liability | Capped at EUR 30,000 under the Terms of Service |
Security and data protection
| Item | Fact |
|---|---|
| Hosting location | EU |
| Architecture | Multi-tenant SaaS, one account per organisation, data logically isolated |
| Encryption | TLS 1.2 / 1.3 on all connections; files encrypted at rest with AES-256; passwords hashed with bcrypt |
| Application protection | Web application firewall (ModSecurity, OWASP Core Rule Set) and firewall; development along OWASP principles; four-eyes code review before every release |
| Vulnerability management | Continuous automated scanning with tiered fix deadlines (critical: 1 day); annual external penetration test with retest, results available under NDA |
| Access control | Single sign-on via Microsoft Entra ID or SAML 2.0; role-based permissions; server administration by SSH keys only, no password and no root login |
| Backups and recovery | Daily encrypted backups at two independent EU providers (France); recovery point objective 24 hours, recovery time objective 4 hours |
| Availability | 99% per calendar month, commercially reasonable efforts |
| GDPR | Processing in the EU/EEA only; Data Processing Agreement under Art. 28 GDPR; data breach notice to the client within 24 hours |
| Certifications | The hosting data centres are ISO 27001 certified. Trusty AG itself does not hold an ISO 27001 certificate; its information security framework is aligned with ISO/IEC 27001 |
Full security detail, sub-processors and policies: Trusty Whistleblowing facts (same platform terms).
Company
| Item | Fact |
|---|---|
| Legal entity | Trusty AG, Bösch 82, 6331 Hünenberg, Switzerland (canton of Zug) |
| Products | EUDR Passport, Whistleblowing, Compliance App, QuickScreen360 |
| Customers | More than 1,000 companies use Trusty software |
| Website | trusty.report |
This page is maintained by Trusty AG and reviewed with every product, price or contract change.