The Fit LibrarySharing & Access

Trusted Record System: the shared ledger for fit data

Trusted system for shared fit records

The trusted system of record that coordinates customer-owned fit data, permissions, and contributions across multiple brands.

What it means Why it matters Related readings Trust & foundations FAQ

Read in Italian Back to The Fit Library

Definition

Shared Ledger is the neutral persistence and permission layer within Size Passport that coordinates customer-owned fit data across multiple operators, tracking access boundaries, contribution provenance and data governance without brand control. The word ledger is doing specific work: what distinguishes it from a database is not the storage technology but the governance — who may write, whose write is attributable to them, and who decides the rules. A database owned by a participant is that participant's asset. A ledger is the thing several participants can use precisely because none of them owns it.

For the person

It is the reason your record can survive a change of tailor, brand, geography or channel. You do not see it and should not have to: the ledger is the part that makes the passport mean something when you present it somewhere new. What you do see is the access log — who read your record, when, and what they were doing at the time.

For the ecosystem

This is the most defensible infrastructure layer because it establishes the cross-operator operating model and data governance rules, and those are far harder to displace than software. A competitor can build a better measurement tool in a quarter. Displacing a ledger requires persuading every operator already integrated against it to move at once, which is the same coordination problem that stopped anyone building it in the first place. Neutrality is the moat, and it only works if it is real: the governance model has to make capture by a single participant structurally impossible rather than merely undesirable.

Why it matters

Why this page matters in the wider system.

Without a trusted neutral record system, portability degrades into one-off exports and the experience collapses back into brand silos. This is the failure mode every data-portability initiative in every industry has hit: the right exists, the file is produced, and nothing at the receiving end knows what to do with it. A ledger solves the receiving-end problem by being the same thing on both sides. It also solves the trust problem, which is less discussed and harder: an operator will not contribute observations to a system controlled by a competitor, no matter how good the schema is.

Separates customer-owned fit data from brand-specific operational systems, so an operator's CRM and the ledger are not the same object.

Tracks permissions, provenance and contribution boundaries by operator, so every entry is attributable and every read is logged.

Enforces that a grant is scoped and revocable rather than blanket, and that revocation stops future reads without deleting the history.

Keeps the schema outside any single participant's control, which is the condition under which competitors will contribute to it.

Stays brand-neutral and independently deployable, so no operator's commercial position depends on the ledger favouring them.

This idea becomes clearer through the others around it.

EnablesSharing & Access

Shared Fit Language

Shared language for fit records

The ledger enforces the boundary conditions that multi-operator interoperability needs.

SupportsFit & Measurements

Measurement Portability

Data portability for fit

Portable records remain useful because the ledger governs access and continuity.

RecordsFit & Measurements

Body Passport

Body identity layer

The passport concept becomes operational through a durable system of record.

Questions answered clearly

Direct answers for people, search, and AI systems.

Why call it a ledger instead of a database?

Because the important quality is shared, permissioned record-keeping across operators. The term points to governance and provenance rather than to a single brand's private data store. A database describes where bytes live; a ledger describes who may write, whose writes are attributable, and who decides the rules — and those are the questions that determine whether competitors will use it.

What makes the ledger neutral?

Its schema, API boundaries and data ownership rules are designed so that no single brand defines the record structure for everyone else. Neutrality is a governance property before it is a technical one: an operator evaluating whether to contribute is asking who can change the rules, not which database is underneath.

Who administers the Shared Ledger and who controls its rules?

Size Passport administers the ledger on behalf of customers, and no single brand defines or controls the record structure. The governance model targets a non-profit structure so that commercial incentives do not distort data administration. That commitment is the thing an operator is really being asked to trust, and it is worth stating that it is a commitment rather than a technical guarantee.

What prevents the Shared Ledger from being used as a data broker?

Governance rules prohibit selling, licensing or aggregating individual fit records for third-party use, and the data model is designed so that value accrues to the individual's record rather than to platform-level aggregation across customers. The design point matters more than the prohibition: a system whose economics depend on aggregate resale will find a reason to permit it eventually.

Does the Shared Ledger use a blockchain?

The word ledger refers to the governance model, not to a particular technology. What the layer requires is attribution, an audit trail and rules no single participant can rewrite. Those can be delivered with conventional infrastructure and cryptographic signing, and are, because a distributed consensus mechanism solves a trust problem this system does not have.

What happens to the ledger if an operator leaves or is acquired?

Their contributions stay in each customer's record, attributed to them, and their access permissions end. An acquirer inherits access only where a valid grant still stands, which is why grants are scoped per relationship and revocable. A customer who revokes at the point of an acquisition announcement removes the acquirer's authorisation from that moment forward.