What you will find here

• Technology and engineering — how verifiable certificates work, and how we build the platform.
• Luxury and craft — the objects, makers and traditions that provenance protects.
• Provenance, regulation and resale — the forces reshaping how products carry their history.
• Guides — practical walkthroughs for brands, distributors and owners.
• Product updates and news — what is new on Verista, and what is next.

Why we are writing

Provenance sits where several worlds meet: craftsmanship and cryptography, retail and regulation, collectors and compliance teams. Each speaks its own language. We want this journal to be a place where those conversations meet in plain English — useful whether you run a brand, sell its products or own something you care about.

What we believe

A few convictions shape everything we build, and they will shape what we write here too:

• Records should be independently verifiable. A certificate should not depend on a private database, a PDF or institutional memory. Anyone should be able to check it.
• Ownership should have a clear exit path. Collectors and organisations deserve defined ways to keep or move what is theirs, including when they leave a platform.
• The experience should feel simple. Nobody should need to understand wallets, gas or block explorers to receive and keep a certificate. The technology stays available for inspection and out of the way of daily use.

Expect articles that explain the reasoning behind those choices as well as the choices themselves — including the trade-offs we made and the ones we are still weighing.

How to follow along

New articles appear here first. If you use a feed reader, subscribe to the RSS feed. Every article is also searchable and filed under a category, so you can follow just the topics you care about — engineering, say, or regulation.

Start reading

A good first stop is What makes a certificate of authenticity trustworthy?, or our overview of Digital Product Passports. You can browse every article by category or search for a topic.

To learn more about us, read about Verista. And if there is something you would like us to write about, tell us.

Branded vaults

Brands can now offer their customers the Verista owner vault under their own identity: on a custom domain or a Verista subdomain, styled with the brand's own theme. Every theme renders the same features as the standard vault — the brand controls appearance, never what owners can do. See White Label Vault.

Organisation-wide two-factor authentication

Owners of an issuer or distributor organisation can require two-factor authentication for everyone, themselves included, using an authenticator app. Members who have not set it up are guided through setup at their next sign-in. If someone loses their authenticator, the owner can reset their two-factor so they can enrol again.

Collectors can also turn on two-factor authentication for their own vault from the profile menu.

Co-signed shared wallets

Operations through an organisation's shared wallet — issuing, transferring, deploying contracts, changing owners — can now be co-signed: a team member and Verista must both approve, and Verista checks permissions and the operation itself before it does. We wrote about the design in detail in How Verista protects the wallets that issue your certificates.

Issue in the background

Issuing a single certificate no longer ties up the dialog. Start an issue, close the dialog, and carry on: a progress badge follows you around Verista Cert, and several issues can run at once. Select a badge to reopen that issue.

Public brand profiles

Issuers and distributors can publish a brand profile — a tagline, an introduction, a website, social links and a cover image — which appears wherever their name or logo does, including on certificate verification. Organisations choose exactly what to publish.

Also new

• An audit log with readable, filterable event names across every console.
• Clearer handling when a team member leaves, including on-chain removal from the shared wallet.
• The Verista Journal — the blog you are reading.

Questions about any of these? Visit the documentation or contact us.

This is a general overview, not legal advice. Confirm your obligations with qualified counsel.

Where Digital Product Passports come from

The EU's Ecodesign for Sustainable Products Regulation (ESPR), Regulation (EU) 2024/1781, entered into force in July 2024. It replaces the earlier ecodesign framework, which focused on energy-related products, with one that can cover most physical goods. One of its central tools is the Digital Product Passport: a structured digital record about a product, reachable through a data carrier such as a QR code.

What a passport is for

The aim is to make product information available where decisions are made. Depending on the product group, a passport can hold information such as:

• identification of the product and its manufacturer;
• materials and composition, including substances of concern;
• guidance on use, care, repair and end-of-life handling;
• information relevant to durability and recyclability.

Not everything, not all at once

ESPR is a framework. The concrete requirements — which products need a passport, what data it must contain and when — arrive in delegated acts adopted for specific product groups. Textiles and apparel are among the groups the European Commission has prioritised, alongside several industrial and household categories. Each act sets its own timeline, so the right question for a brand is not "does ESPR apply?" but "which acts cover our products, and when?"

Why per-item records matter

Many passports are expected to work at the level of a model or batch. But luxury and collectible goods have always cared about the individual piece — this watch, this bag, this artwork. Item-level records bring benefits regulation alone does not demand:

• Authenticity — a record tied to one serial number, not a product line.
• Provenance — a history of ownership that adds value at resale.
• After-sales — warranty, servicing and repair attached to the specific item.

How Verista relates to this

Verista gives every item a unique, verifiable record anchored on a public blockchain and reachable from a QR code. Each certificate is identified by its contract and token number, carries the brand's own template fields, and keeps a full ownership history. Brands manage it all through Verista Cert, and every capability is available through the same APIs our own apps use, so ERP and point-of-sale systems can integrate directly — see Developers.

A Verista certificate is not, on its own, a regulation-compliant passport: a passport must carry exactly the data its delegated act requires. But the hard parts — a unique identity per item, a data carrier, a record that can be checked independently — are already in place.

What to do next

1. Identify the delegated acts that cover your product groups and track their timelines.
2. Audit what product data you hold today, and at what granularity.
3. Decide whether item-level records serve goals beyond compliance — authenticity, resale, service.

If you would like to talk through how verifiable certificates fit your plans, get in touch.

A certificate earns trust when it holds up to checking, not when it looks official. Five properties make the difference.

1. It can be verified independently

If the only way to confirm a certificate is to ask the company that printed it, you are trusting that company's database, its staff and its continued existence. A trustworthy certificate can be checked against a record that no single party controls.

Verista anchors every certificate to a public blockchain record on Base. The record carries the certificate's serial number, its descriptive data and references to its images, and anyone can inspect it — through Verista's verification or directly on-chain.

2. Its issuer is identifiable

A certificate is a claim made by someone. The question is who. Each Verista certificate is minted from a contract that belongs to a specific issuer's template, and it records which wallet minted it. Verification shows the issuing organisation, so a convincing-looking certificate from an unknown source is immediately visible as exactly that.

3. It cannot be silently altered

Paper can be edited with a scanner and some patience; a row in a database can be changed by anyone with access. A trustworthy certificate makes tampering evident. Because a Verista certificate's data is written on-chain, every update is itself a recorded event rather than a quiet overwrite.

4. It records every change of owner

Provenance is the story of an object's custody, and a story with gaps invites doubt. Each Verista certificate keeps an ownership history on-chain: every transfer, from the issuer to a distributor to a collector and onward, is part of the record.

5. It can be revoked — visibly

Things go wrong: an item is reported stolen, or a certificate was issued in error. A trustworthy system lets the issuer invalidate a certificate and makes that fact impossible to miss. When an issuer voids a Verista certificate, verification reports it as voided, so it cannot quietly keep circulating as if it were good.

Identity is the pair, not the number

One detail matters more than it looks. A token number alone is not unique — every contract starts counting from zero. Verista identifies a certificate by its contract address and token number together, everywhere: in its records, its APIs, its QR codes and its audit logs. That is what stops two different certificates from ever being mistaken for one another.

What this means for you

For a brand, a certificate built on these properties protects the value of what you make long after the first sale. For a collector, it turns "trust me" into "check for yourself". Read how Verista works, or see the kinds of objects it is built for.

Step 1: Open the certificate

Scan the certificate's QR code with your phone's camera, or open the certificate link you were given. Make sure the page that opens is a genuine Verista page — look at the address bar — or go to verify.verista.co yourself.

Step 2: Check the issuer

The result shows which organisation issued the certificate. It should be the brand or institution you expect. An unfamiliar issuer on a famous product is the first thing to question.

Step 3: Match the details to the object

Compare the serial number and the descriptive details — model, materials, dates — with the object in front of you. A certificate describes one specific item, so every detail should agree. Look at the certificate's images too.

Step 4: Read the status

Step 5: Look at the ownership history

The history shows each time the certificate changed hands — typically from the issuer, sometimes through an authorised distributor, and then between owners. If you are buying, the seller should be the current owner, and once the sale completes you should receive the certificate through a transfer into your own vault.

If something looks wrong

• The page is not a Verista page. Go to verify.verista.co directly rather than following the link.
• Details do not match. Pause the purchase and ask the issuer to confirm.
• The certificate is voided. Do not rely on it. Contact the issuer for the reason.

After you buy

Ask the seller to transfer the certificate to you. You will receive a one-time claim link or QR code; claiming it places the certificate in your own Verista vault and adds you to its ownership history. Questions? Visit the help center.

The second sale is the real test

At resale the original seller is no longer in the room. Buyers can't ask the brand's staff, and paperwork can be lost, copied or forged. What they need is a record that survives the change of hands: proof the object is genuine, and a history of where it has been.

A certificate that travels with the object

A Verista certificate is transferable by design. When an owner sells, the certificate moves to the buyer, and the ownership history gains a new entry. Nothing is reissued and nothing is re-keyed by hand: the same certificate, with the same issuer and the same serial number, now names a new owner.

• For the seller, it is evidence that supports the asking price.
• For the buyer, it is something to check before paying, not a promise to take on faith.
• For the brand, it keeps a thread to the product through every owner.

How a transfer works

1. The current owner opens the certificate in their Verista vault and starts a transfer.
2. Verista creates a time-limited, one-use claim, shared as a link or QR code.
3. The buyer claims it into their own vault.
4. The transfer is confirmed on-chain and added to the certificate's ownership history.

Neither party needs to understand wallets or gas fees. The blockchain does its job in the background: it is the source of truth for who owns the certificate now.

Privacy, by default

A public history doesn't have to mean public identities. Ownership is recorded from wallet to wallet; names and email addresses are not part of the on-chain record. When an issuer or distributor sees details about a collector, Verista masks them.

Circularity needs trust to work

Keeping well-made objects in use for longer is good for owners and for the planet, but secondary markets only thrive when buyers feel safe. Verifiable provenance lowers the risk of every resale, which in turn makes it easier for objects to keep circulating. Explore the use cases Verista supports, or read how we approach security.

Members sign, and so does Verista

Verista uses a co-signing model. Each team member has a signing wallet for their organisation, controlled jointly: an operation goes through only when the member and Verista both approve it. Neither can act alone.

That second signature is not a rubber stamp. Before Verista co-signs, it:

• decodes the operation and checks it is a function the platform allows;
• checks the member's permissions in the organisation, read fresh rather than from a session that may be out of date;
• confirms the operation targets one of the organisation's own certificate contracts and sends no funds;
• checks the operation matches what was prepared — for example, that a mint carries exactly the recipient and certificate data that were set up for it.

And some requests are refused unconditionally: Verista will never co-sign an attempt to export a key.

Why Verista can never act alone

Verista holds two keys, a primary and a backup, so that losing one doesn't lock organisations out. But the two are structured as a single approval. Together they still cannot act without a member — so even a compromise of Verista's own systems would not, on its own, let anyone sign for your organisation.

One write at a time

A shared wallet processes operations in sequence. If two colleagues tried to issue certificates at the same instant, their operations could collide. Verista gives each wallet a short lease that one member holds while their operation is submitted and confirmed, so team members never trip over one another.

Two-factor authentication, organisation-wide

Organisation owners can require two-factor authentication for every member — themselves included — using an authenticator app. Once it is required, a member without it cannot sign in until they set it up, and a signed challenge is needed at every sign-in.

When people leave

Removing someone from an app is easy; removing their ability to sign on-chain is the part that matters. Off-boarding a member is restricted to the organisation's owner, and it rotates that member's wallet out of the shared wallet's owners on the blockchain itself.

A trail for everything

Every significant action — issuing, transferring, voiding, membership and role changes, refused signatures — is written to an append-only audit log by Verista's servers, never by client apps, and organisations cannot delete their own trail.

Read more about our approach on the security page, or in the documentation.