Start a project
Live in production

Digital product passports for safety-critical gear.

Every product gets an un-guessable QR code and an optional NFC tag. Anyone can scan it — no app required — to see whether it’s verified, along with its test certificates, standards and care details. Manufacturers get reviews, complaints, recalls and scan analytics long after the sale.

Visit defconverify.co.za Build something like this
Client
Defcon Protec, a SANAS-accredited verification company
Our role
Product design, engineering, launch and ongoing releases
Platforms
Web — manufacturer back-office and public passports
Status
Live in production
Hands holding a phone showing a DefconVerify passport for a Level IIIA ballistic vest, marked DefconVerified, with product specs and care instructions. A DefconVerify passport screen for a Level IIIA ballistic vest, showing product specs, care instructions and the linked test report. Verified · Standard Scan · no app
from scan to a verified result
< 5 s
apps to install — any phone camera works
0
production releases in nine weeks
7
event types on signed outbound webhooks
30

The challenge

Counterfeit and non-compliant safety gear — ballistic PPE, workwear, technical textiles — puts lives at risk, and buyers have no easy way to check what they’re holding. Defcon Protec needed its accredited verification to become something anyone can confirm with a phone camera.

What we built

We designed and built DefconVerify end to end: a manufacturer back-office, public passport pages that load in under a second even on mobile data, and a chain-of-custody record from fibre to consumer — standards-ready for GS1 Digital Link and EPCIS 2.0.

  1. 01

    Tag

    Every product, batch or unit gets an un-guessable QR code and an optional NFC tag.

  2. 02

    Scan

    Any phone camera opens the passport — no app, and fast even on mobile data.

  3. 03

    Verify

    Instant status with certificates, standards and care details, plus ownership registration and reviews.

  4. 04

    Trace

    Each custody handoff is on the record, from fibre to consumer — ready for GS1 and EPCIS 2.0.

Capabilities

What makes DefconVerify different.

  • Un-guessable QR + NFC

    One identity per product, batch or unit. Passport URLs can’t be guessed or enumerated.

  • Scan to verify, no app

    Server-rendered passports with instant green, amber or red status — verified, expired or recalled.

  • Two verification levels

    Standard is earned through a SANAS-accredited business audit; Pro adds independent product testing by Defcon Protec.

  • Chain of custody

    Every handoff recorded with quantity, owner, location and timestamp — from fibre to consumer.

  • Engagement & recalls

    Ownership registration, reviews, complaints with photos and automatic escalation of safety concerns.

  • Product intelligence

    Scan trends, geographic heatmaps and product popularity — insight that continues after the sale.

  • AI assistant, safely scoped

    Answers questions from the customer’s own data, navigates the app and fills in forms. It never saves, never pays and never deletes.

  • Standards-ready

    GS1 Digital Link and EPCIS 2.0 export, positioned ahead of the EU Digital Product Passport.

Inside the product

Vignettes of three features from the live platform, shown with sample data.

Batch HV-2409 Hi-Vis Safety Jacket
Verified
  1. Fibre supplier 1,200 kg polyester fibre Durban 02 Sep · 09:14
  2. Weaving mill 4,800 m hi-vis fabric Pinetown 09 Sep · 15:40
  3. Garment factory 2,400 jackets Johannesburg 17 Sep · 11:02
  4. Distributor 2,400 jackets Midrand 21 Sep · 08:25
  5. Retailer 600 jackets Cape Town In transit
5 handoffs · GPS-stampedExport EPCIS 2.0 ↓
Chain of custody — every handoff recorded with quantity, owner, location and time.
Scans · last 12 weeks 18,420 +24%
Sample data
  • Gauteng 42%
  • Western Cape 23%
  • KwaZulu-Natal 17%
  • Eastern Cape 8%
Product intelligence — scan trends, and where products are being verified.
Assistant Ask about your products
Read-only

Which products have open complaints this month?

Two: the Hi-Vis Safety Jacket (3, all sizing) and the H2 Hard Hat (1, strap wear). Shall I open the complaints view, filtered to these?

Never saves · never pays · never deletes
AI assistant — answers from your own data, and can navigate or fill in forms for you.

Engineering

Under the hood.

  • TypeScript
  • React
  • TanStack Start
  • Cloudflare Workers
  • Neon Postgres
  • Drizzle
  • Better Auth
  • MCP

Delivered AI-first and continuously: seven production releases in nine weeks, each one specced, built across parallel agent workstreams, reviewed by senior engineers and shipped through CI.

  • TanStack Start (React server rendering) on Cloudflare Workers, backed by Neon Postgres and Drizzle ORM.

  • Marketing site and application deployed as separate Workers for fault isolation; the marketing site is prerendered.

  • Self-hosted Better Auth with two-factor login, Cloudflare Turnstile and R2 object storage.

  • Public EPCIS 2.0 capture API, signed webhooks and an MCP server so AI agents can work with an organisation’s data.

  • AI assistant with read-only tools, server-owned conversations and dedicated CSRF protection.

  • CI/CD on GitHub Actions, secrets in Infisical, error tracking in Sentry.

Have a product like this in mind?

We’ll bring the same AI-first process and senior engineering to your idea.

Start a project Explore our work