What we know and what we do not.
This page is not sales copy. Coverage is the most misunderstood part of a validation tool; know exactly what you are getting before you decide.
What we know
All of it comes from public standards and works for every number.
Format
GTIN-8, GTIN-12 (UPC-A), GTIN-13 (EAN-13) and GTIN-14 (ITF-14). Spaces and dashes are cleaned out and the GTIN-14 equivalent is produced.
Check digit
The GS1 mod-10 rule. If it is wrong we tell you the digit it should be — we do not stop at “invalid”.
Source verification
Product matches come only from your catalogue or a provider whose redistribution rights are verified. When no source is available, the status says so explicitly.
What we do not know
No price, units sold, stock or market share. None of it is held in the system.
We cannot prove that the product really exists. The check digit shows the number is consistent; a made-up but mathematically correct number also looks valid.
Why we do not sell a product database
The honest answer when asked: we tried it, we measured it, it does not work.
From five categories, 120 real numbers each were looked up in an open product database. The control group (known products) returned results including images — so the method is right, the coverage is not there. That is why we read product information from your own catalogue.
We looked into collecting product names and images from open sources. From five categories we looked up 120 real numbers each in an open product database. The result: 5.8% in the food category, and in every other category %0 matches. For comparison, the same query with known products (the control group) returned results including images — so the method is right, the coverage is not there.
What that means: you cannot promise “millions of products” on free sources. You can with licensed providers, but the cost moves the price of the product somewhere else entirely. That is why we read product information from your own catalogue — the data stays with you, we only resolve the number.
Where your data sits
Isolation
Every organisation’s data is separated at database level (row-level security). One customer cannot query another’s records.
Retention
Query history for 90 days, batch job results for 60 minutes. You can delete your catalogue and your history whenever you want.
Passwords
are stored with scrypt. The session token is never handed to the page (httpOnly cookie); only the SHA-256 digest of an API key is kept.
Audit
Sign-ins, key creation, catalogue uploads and admin actions are recorded — who, when, from which address.