The End of the PDF: Public Pages for Compliance¶

Q: Why are PDFs bad for compliance documentation?

PDFs create version confusion because they are frozen snapshots that become stale immediately. They cannot be verified cryptographically, offer no audit trail, and cannot be shared efficiently across a supply chain. When a regulation changes, every PDF previously sent becomes outdated — but recipients have no way to know.

Q: What replaces PDF compliance attachments?

Public QR-verifiable compliance pages replace PDF attachments. Instead of emailing static files, you publish a compliance declaration to a permanent URL with a QR code. Anyone scanning that code sees the always-current version, verifiable via SHA-256 cryptographic hashcode — no downloading, no version confusion, no re-sending.

Q: How does QR code verification work for compliance documents?

A QR code printed on a product label, menu, or website links to a permanent public URL containing the compliance declaration. Anyone scanning the code with a phone sees the current version instantly. The page carries a SHA-256 hashcode that proves the document is authentic and untampered — providing cryptographic verification without requiring logins or special software.

Q: What is a public compliance page?

A public compliance page is a live, permanently accessible web page that hosts a company's regulatory declarations — such as REACH, RoHS, CE, ESG reports, or allergen information. It serves three audiences through one URL: consumers see transparency data, auditors see full documentation with hashcode verification, and internal teams manage updates. Update once, and all viewers see the current version.

Q: How much does it cost to publish a public compliance page?

Sustalium charges €10 per document per month. This includes the permanent public URL, QR code, SHA-256 hashcode verification, three-view access (public/audit/internal), and unlimited updates. For a compliance document that costs hours of labor annually to manage as a PDF, the platform cost is typically less than one hour of compliance staff time per month.

If your business still sends compliance documents as PDF attachments, you are operating a workflow that was designed for 1993. The attachment model — create, export, attach, send, receive, save, forget, scramble to find when the auditor asks — is the single largest source of compliance friction in global supply chains. And it is being replaced.

The replacement isn't a better PDF reader. It isn't a document management system. It's a fundamental architectural shift: from sending files to publishing pages. From attachments to permanent URLs. From "here's the certificate we sent you" to "scan this QR code — it's always current."

The PDF Workflow: A Story You Know Too Well¶

Walk through the lifecycle of a single compliance PDF and you'll see why this model is broken beyond repair.

Step 1: Create¶

Your quality or regulatory team spends hours assembling a compliance document. They pull data from spreadsheets, lab reports, supplier declarations, and ERP exports. They format it in Word or PowerPoint. They export it as a PDF. The file gets named something like REACH_Declaration_v3_final_FINAL.pdf. Someone on the team knows which version is actually current. Nobody else does.

Step 2: Email¶

The PDF is attached to an email and sent to a buyer, a distributor, a customs broker, or a procurement officer. That email lands in an inbox alongside 147 other unread messages. If you're lucky, the recipient downloads the attachment. If you're not, the email gets buried under a week of Slack notifications and never opened.

Step 3: File¶

The recipient saves the PDF somewhere — a downloads folder, a SharePoint library, a shared drive called "Compliance Docs 2024," a desktop folder they'll clean up "next week." There is now exactly one copy of your compliance document, sitting in exactly one place, on exactly one person's machine. No version control. No chain of custody. No audit trail.

Step 4: Forget¶

Three months pass. Six months pass. The document is now stale. You've updated your REACH declaration because a new SVHC was added to the Candidate List. You've updated your conflict minerals report because a supplier changed smelters. But the PDF sitting in your buyer's downloads folder hasn't changed. It's a snapshot of a moment that no longer exists.

Step 5: Can't Find¶

The auditor asks for the latest version of your compliance documentation. Your buyer opens their downloads folder. They search for "REACH." Thirty-seven results appear, all named some variation of REACH_Declaration_final_FINAL_v2_UPDATED.pdf. Nobody — not you, not your buyer, not the auditor — knows which one is current. The audit stalls. The shipment gets flagged. The contract gets reviewed.

This isn't a hypothetical. It's the daily reality of compliance teams across every regulated industry. And it's not because people are disorganized — it's because the PDF attachment model makes disorganization inevitable.

The Public Page Workflow: Publish Once, Verify Forever¶

Now run the same scenario through a public compliance page.

Step 1: Publish¶

You create your compliance declaration on a platform like Sustalium. Instead of exporting a PDF and emailing it, you publish it to a permanent, public URL. The page is live. It's accessible. It has a unique address that will never change.

You don't email a file. You share a QR code. That QR code goes on your product label, your packaging, your website footer, your supplier portal, your email signature. Anyone — buyer, auditor, customs officer, consumer — can scan it with their phone and land on your compliance page.

Step 3: Always Current¶

Six months later, you update your REACH declaration because a new substance was added to the SVHC list. You update it once — on the platform. The QR code doesn't change. The URL doesn't change. Every person who scans that QR code, whether they scanned it yesterday or six months ago, sees the current version. No stale PDFs. No version confusion. No "which file is the right one?"

Step 4: Verified by Anyone¶

The public page contains more than text. It carries a SHA-256 cryptographic hashcode — proof that the declaration hasn't been tampered with. An auditor doesn't need to trust you. They don't need to compare PDFs. They verify the hashcode, and they know: this is the genuine declaration, published by this organization, at this moment. Verification takes seconds and requires no login, no account, no special software. Just a phone.

Step 5: Audit-Ready, Always¶

When the auditor asks for documentation, there's no scramble. There's no search through email archives. There's no "let me check with our compliance team." There's a QR code. The auditor scans it. The audit continues. Because the page has always been current, is always accessible, and proves its own authenticity.

Why PDFs Fail Compliance¶

The PDF attachment model fails for five structural reasons that no amount of organizational discipline can fix.

1. Version Confusion¶

A PDF is a frozen snapshot. It captures compliance at a single point in time and becomes stale the moment anything changes. In supply chains where regulations update quarterly (REACH SVHC list), monthly (tariff classifications), or even weekly (sanctions lists), a PDF is out of date before the email is opened. The result is version sprawl: dozens of nearly-identical files circulating across dozens of inboxes, with no way to determine which is authoritative.

2. Stale Data¶

Compliance data doesn't stay still. Supplier certifications expire. Lab reports get updated. Declarations get amended. When your compliance document is a PDF, every change means a new file, a new email, a new round of "please replace the old version." Most recipients won't. The data they rely on for procurement decisions, customs declarations, and regulatory filings is wrong — and they don't know it.

3. No Verification¶

A PDF is trivially easy to forge. Anyone with Adobe Acrobat can edit text, swap logos, change dates, and modify certificate numbers. There is no cryptographic certainty that a PDF you receive by email is genuine. Procurement teams are forced to choose between trusting every attachment blindly (a compliance and legal risk) or manually verifying every certificate with the issuer (a resource drain that doesn't scale).

4. No Audit Trail¶

A PDF sitting in a downloads folder has no history. Who created it? When? Who modified it? Who sent it? Who received it? Who opened it? These questions are unanswerable with a file attachment. For regulations that require demonstrable due diligence — such as the German Supply Chain Act (LkSG), the EU CS3D, or the UFLPA — the absence of an audit trail is not an inconvenience. It's a compliance failure.

5. Can't Be Shared Across a Supply Chain¶

A compliance PDF sent to one buyer serves one buyer. If your product passes through a distributor to a retailer to a consumer, none of those downstream parties have the PDF. They can't access the compliance data without someone upstream forwarding an email. In a world where every link in the chain needs to verify provenance, material composition, and regulatory conformity, the point-to-point PDF is a structural bottleneck.

What a Public Compliance Page Delivers¶

A public compliance page replaces the attachment model with a publish-and-verify architecture. Here's what changes.

One URL, Three Views¶

Every compliance page on Sustalium delivers the same information through three access layers:

Public view: What consumers and anyone with the QR code see — product certifications, material declarations, safety information, environmental claims. Designed for transparency and trust.
Audit view: What regulators, customs authorities, and third-party auditors see — full documentation, hashcode verification, timestamps, revision history. Designed for due diligence.
Internal view: What your team sees — edit capabilities, supplier data management, version control, access logs. Designed for ongoing management.

One URL serves all three audiences. No separate documents. No access management headaches. No "I need to email you the internal version."

SHA-256 Hashcode Verification¶

Every declaration published through Sustalium carries a unique SHA-256 hashcode — a cryptographic fingerprint of the document content. Anyone with the URL can independently verify that the page they're viewing is the authentic, unmodified declaration published by your organization. This is the same technology that secures blockchain transactions and software downloads, applied to compliance documentation. It transforms verification from a trust-based exercise into a mathematical certainty.

Update Once, Everywhere Current¶

When a regulation changes, a certification expires, or a supplier submits new data, you update your compliance declaration once — on Sustalium. The URL stays the same. The QR code stays the same. Every person who scans that code, anywhere in the world, sees the current version. No re-sending. No "please discard the previous PDF." No version sprawl. One source of truth, one point of update, universally current.

Real-World Examples¶

A restaurant chain operating across three EU countries needs to display allergen information for every menu item — required under the EU Food Information to Consumers Regulation (No. 1169/2011). The traditional approach: print allergen matrices on paper menus, update and reprint whenever a recipe changes, and hope the version on the table matches the version in the kitchen.

With a public compliance page: each menu item links to a Sustalium page via QR code. The page lists every allergen in the dish, cross-referenced against the EU's 14 regulated allergens. When the chef changes a recipe — substituting one cooking oil for another, for example — the page is updated once. Every QR code, on every printed menu, at every table, now reflects the current allergen profile. No reprints. No version mismatch. No liability exposure from outdated allergen information.

Product Label QR for CE/REACH Proof¶

An electronics manufacturer exports power supplies to the EU. Each unit must carry CE marking documentation proving conformity with the Low Voltage Directive, EMC Directive, and RoHS Directive. Additionally, importers demand REACH SVHC declarations confirming that the product contains no substances above the 0.1% threshold.

The traditional approach: print a 20-page compliance dossier, ship it with every container, email PDF copies to every distributor, and field individual requests from customs brokers who can't find the file they were sent three months ago.

With a public compliance page: a single QR code printed on the product label links to a Sustalium page containing the CE Declaration of Conformity, the full REACH SVHC declaration, RoHS compliance evidence, and the EMC test report summary. A customs officer in Rotterdam scans the code at the port of entry, verifies the documentation in seconds, and clears the shipment. The distributor in Berlin scans the same code to satisfy their own due diligence requirements. The compliance team updates the REACH declaration when a new SVHC is listed, and both the customs officer and the distributor see the current version automatically.

Company Website QR for ESG Report¶

A mid-sized manufacturer wants to demonstrate ESG credentials to enterprise buyers who are legally obligated to assess supply chain sustainability under CSRD and CS3D. The traditional approach: publish an annual PDF sustainability report on the company website, update it once a year, and hope procurement teams download the right version.

With a public compliance page: a QR code in the website footer links to a live Sustalium trust center — a single page aggregating the company's ESG report, carbon footprint data, modern slavery statement, supplier code of conduct, and relevant certifications. Enterprise procurement teams scan the code during vendor assessment. They see current data, not last year's PDF. They verify authenticity via the hashcode. They complete their due diligence without a single email exchange. The manufacturer updates its carbon footprint quarterly as new emission factors are published, and every buyer evaluating the company sees the latest numbers automatically.

The Economics: €10 per Document per Month¶

The PDF workflow isn't just broken — it's expensive. The time spent creating documents, emailing them, re-sending them when recipients lose them, verifying versions during audits, and managing the inevitable confusion costs businesses thousands in compliance labor per document per year.

Sustalium replaces this entire workflow for €10 per document per month. One price. One URL. Updates included. Verification built in. No PDFs. No attachments. No version sprawl.

A compliance document that costs your team 20 hours per year to manage as a PDF costs €120 per year on Sustalium — less than the cost of one hour of compliance labor in most EU markets.

Get started now →

Last updated: June 3, 2026