Every scan is a question.
A case, a lot, a single unit — five attested hands, continents apart. visibility.cloud chains every hop into one verifiable record — who asked, who answered, on whose authority.
There is no single version of this problem.
Anonymity is one defect and it sends four different bills. A recall page written for a jeweler is a page about somebody else’s week, so this surface does not write one. Pick the bill that is yours; each read stands on its own evidence and says what that evidence is.
-
Recall
One run went bad and you withdrew everything it could have been in.
Food CPG and QSR — whoever owns the recall desk.
-
Authenticity
A convincing copy carries the same digits as the original.
Jewelry, watches and luxury — brand protection, and whoever answers the client.
-
Shrink
Every unit was scanned, and the investigation still ends at “seen here, then not.”
Apparel and general merchandise — loss prevention, and the fulfillment side that owns the dock it happens on.
-
The discarded scan
The lane reads the serial, the lot and the expiry, and keeps none of them.
Retailers and brands on the Sunrise 2027 timeline.
Nothing in your building is broken.
The barcode scans first time. The register rings it. The warehouse books the receipt and the count reconciles at the end of the period. The drill is on the calendar, the read points are where they should be, the artwork went through every stage it was meant to. Nobody skipped anything, and nobody was sold a bad product.
Every one of those four bills is what doing it correctly produces — given a record that was only ever asked one question.
It names a class. That is all.
It is worth being precise about what the limit actually is, because the imprecise version is easy to dismiss and the precise version is not. The barcode is not unreadable. It is read constantly — more often than any other act in your business. It is not inaccurate; it is one of the most reliable pieces of engineering in commercial history. It is not proprietary, or hidden, or withheld by anybody.
It answers what kind of thing is this with total precision and total reliability, and it has no capacity whatsoever to answer which one.
The gap is always exactly where the dispute is.
Inside your own four walls, you can reconstruct a run. The trouble starts at the door. The carrier's system says one thing. The 3PL's says another. The four hours between pickup and cross-dock exist properly in neither, because each side recorded its own half and nobody recorded the seam. When the auditor asks who had custody of this lot at 14:20, that seam is what you hand them.
And the fix has a way of going quiet. Visibility programs tend to stop the month the capture bill lands — not because anyone decided the evidence was worthless, but because the line item grew with volume and the answers did not.
One problem, not two.
The barcode that could not say which one, and the record that cannot say who, are the same defect at two different grains. Categories all the way down, in a world where the questions are about individuals.
Check this before you believe the rest.
Not an argument, a citation, and it is free: ten minutes with the published specs, no account and no call. The engineer’s version, with pinned digests and exit codes, is at epcis.dev.
EPCIS 2.0 §7.2.2 EPCIS 2.0 §7.3.6.4 CBV 2.0 §7.4.3 CBV 2.0 §8.7.1
EPCIS 2.0 §7.2.2 defines five event dimensions: what, when, where, why, how. No performer is among them. The party fields are organization-grain — EPCIS §7.3.6.4, CBV §7.4.3, CBV §8.7.1 (PGLN). The conformant path to a performer today is a namespaced user-extension field (EPCIS §6.3 / §9.1 / §10.1.3). So the standard can say a company did a process — its Who is the company, a GLN. It cannot say which person or which device observed the event at 06:12: no field names the performer. The specs are public. Don’t take our word for it.
Stamped from outside. Stripped of whatever you sent.
The capture spine underneath visibility.cloud is written, and these are its laws rather than its features. They are the part that cannot be renegotiated later.
-
01
Conforms to EPCIS 2.0 and CBV 2.0.
Implemented against GS1's official OpenAPI description, pinned by digest.
-
02
Validated on every capture.
Each event is machine-checked against the official GS1 EPCIS 2.0 JSON schema before it is accepted. A capture that does not validate is refused, in RFC 7807 problem+json, carrying the standard's own exception types — not a vendor error string.
-
03
Stamped by the gateway, not by the sender.
recordTime, who captured it, and the grade of that attestation are applied at the door. Whatever you sent in those fields is stripped. The scriber is not the part being scribed.
-
04
Identified by the standard's own hash.
The standardized EPCIS event hash from CBV 2.0 §8.9, with GS1 Digital Link normalization, so the same event captured twice is the same event, and a changed event is a different one.
-
05
Append-only, by construction.
No service identity anywhere in the system holds an UPDATE or a DELETE grant. You can add an event. You cannot erase one.
-
06
Minimally scoped on read.
You see your own scope. What is outside it is absent, not grayed out and not redacted — there is no shape left behind to argue about.
-
07
Ten years of vendor XML, translated.
EPCIS 1.1, 1.2 and 2.0 XML in, EPCIS 2.0 JSON-LD out, with a round-trip fidelity report per job so the translation is reviewable rather than trusted.
-
08
A door for agents as well as people.
The same interface, the same key, over MCP — so a partner's logistics agent can capture and query without a human copying values between two systems.
Everyone in this market has built a network that is authoritative because you joined it. This platform makes a record that is verifiable whether or not you joined anything — and it carries, in the record itself, an attested answer to who observed the event, including when the observer was an agent.
Both ledgers are rented. Only one has a meter.
Where atoms generate bits, someone is being paid. Energy and silicon become tokens, and that trade is metered, invoiced, and growing every quarter. A print, a scan and a read are the same trade at the other end of the economy — a physical act, and a record that could come out of it — and your building performs thousands of them a day. Where they do not, something is being lost, and there is no line for it anywhere.
You rent reasoning by the token, and every token is billed to a request, a key and an owner. You rent production by the case, and the case is billed to nobody.
The plant that makes your product is a generating station too — raw material in, finished units out, all day. It counts what comes off the line. It cannot tell one unit from another, because nothing about a case distinguishes it from the case behind it, so what the line reports is a total and never a unit. Owning the plant instead of renting it changes what you can do about that, and nothing about the meter.
A unit that was only ever counted in a total cannot be priced apart, insured apart, financed apart, recalled narrowly, or preferred by a machine.
Capture is free. It stays free.
Not a trial. Not a tier. Not a meter you watch.
Recording an event will never cost you money. That is a policy of the platform, not an introductory price, and it holds because the cost structure underneath capture is object storage and a catalog, which is cheap enough to carry permanently. It will never appear in the interface as a counter.
Revenue attaches to answers, on the business side: traces, custody evidence you can hand to an auditor, exception review, partner grants, seats, retention beyond the free floor. You will pay for what you ask, never for what you record. Prices post here when they are set: as numbers, on a page, without a call.
What you will buy here: answers.
Every answer is a view over the same record the developer surface queries, so there is nothing to audit because there is nothing separate.
-
The trace
Where is it, and who touched it — the full event chain, with the attested observer at every hop.
-
Custody evidence
The record that holds up in the room — hashed, append-only, verifiable without joining.
-
Exception views
The handoffs that went silent — received with no performer, custody never closed.
-
SharingGrants
Share exactly these goods, this window, this grain — and revoke without rewriting history.
-
Recall & audit readiness
FSMA 204 without the war room: the trace-back as a query, exportable.
-
The Sunrise 2027 read
What December 2027 requires of you — deliverable today, because it is documents.
-
Seats & deputization
The mandate your agent works under: scope named, ceiling named.
Your record. Their record. Nobody's merged.
The hard problem in this category has never been the run. It is the handoff — and the reason handoffs are hard is that they are between two companies who will not, and should not, pool their records.
So sharing runs on grants, not on a merge. Your 3PL grants you scope on the events they captured; you grant them scope on yours. Two records stay two records. Neither party is principal, whichever one is larger. A grant is narrow, dated, and withdrawable, and withdrawing it rewrites nothing either side already holds — because nothing in this system rewrites.
Two clocks. Neither of them is ours.
-
Sunrise 2027 is the timing.
It is GS1’s program, not ours: by the end of December 2027, retail point-of-sale is expected to scan and process 2D barcodes as well as the linear ones. That changes who generates supply-chain events. Today it is scanners, on docks, run by staff. After it, the same carton is scannable by a shopper on a sidewalk, by a returns clerk, by a partner’s agent — humans and devices, most of them not yours.
-
FSMA 204 is the return, never the urgency.
The largest public RFID rollout in food service — roughly 3,200 restaurants — is attributed to FSMA 204’s compliance requirements by the deploying software vendor’s own president: a third party carries the causal claim, not us. And the rule’s own record is softening, not hardening — the enforcement floor moved to July 2028, and FDA is actively soliciting further flexibilities. Use FSMA 204 for operational ROI and Sunrise 2027 for timing, never the reverse.
-
For the brand that owns the GTIN, the same square points both ways.
The 2D code on your own carton will make every shopper scan and every returns scan an item-level signal attributable to your GTIN and your lot, in a record the retailer does not own and cannot withhold — which is also what turns a full recall into a lot-level withdrawal. Which barcode you print is your decision as GTIN owner — not your co-manufacturer’s, and not Sunrise’s. Whether shoppers scan at volume is a hypothesis, and we say so.
-
The consent rail.
A public GS1 Digital Link resolved through id.gs1.org answers what the item is; by policy it will not tell you who touched it (see GS1’s own conformant-resolver standard). visibility.cloud is the private, brand-owned counterpart that names the party at every step. Identity-complete does not mean identity-exposed: when the scan came from a shopper on a sidewalk, that who resolves to a person only with a lawful basis to, and to a consented pseudonym otherwise.
Two offers that are not answers.
The answers are things you ask the record. These two are what this platform will do to get a record worth asking.
-
Fork the scan.
The retail lane will read the whole symbol and keep a twelfth of it. The other eleven twelfths are yours for the asking, and asking costs nobody a behavior change.
So the fork is the whole idea, and it is deliberately unambitious: the GTIN goes where it already goes, and the serial, the lot and the expiry go to your record instead of to the floor. Nobody scans differently. Nothing new is bought for the lane. The date is already on somebody’s plan in your company, because the artwork has to change anyway.
-
One place to point your agents.
An agent buying from you has to show whose money it is spending and under what limit. An agent working inside your plant has to show whose authority it holds and which task it was asked to perform. Those are the same question, asked from opposite sides of the same door.
visibility.cloud will onboard those sources as one surface: modern SaaS platforms through their own APIs, Apache Iceberg lakes read and written in both directions, the EDI mailbox that has been running since before anyone there was hired, and the print, scan and read events coming off the floor — landing as one event record with an attested observer on it, at the grain a question is actually asked at.
Built in the open. The engines under this page.
Every answer on this page is a view over one record, and these four doors are where that record is written and read. Each one is public and runs on its own.
-
epcis.dev
The event engine
An EPCIS 2.0 capture gateway: every event validated against GS1’s pinned schema, stamped at the door, hashed by the standard’s own hash, append-only.
-
transactions.dev
The paperwork layer
Purchase orders, ASNs and invoices — X12, EDIFACT or API-native — compiled onto the same event record in the standard’s own vocabulary.
-
barcoding.dev
The barcode layer
Every barcode read, verified and generated, GS1 to VIN to ISBN, with the source and license named on every answer.
-
worklists.dev
The work layer
A task is the causal parent of the events that satisfy it, so the record reads: this was scanned because this task said to.
Give one of them a name.
Your capture workspace is provisioned from the list. We write when your seat is ready, and follow up about it from there.