Operator privacy

OnlyTons is not a directory. You come here to find products, availability and territory — not to find companies. The businesses behind an offer are not searchable, not browsable, and not contactable through the platform.

This is the deliberate centre of the product, not a side effect. Everything a buyer and a seller need to agree on runs through the portal, and the portal is what keeps both sides' commercial identity out of the other's hands.

How another operator appears to you

Instead of a company name you see an operator handle — a stable code such as OP-7K3QMD — with the area it works in and the badges that matter:

OP-7K3QMD · Puglia · Verified · EU Organic

The handle is stable, so if you liked what an operator supplied last September you can ask the broker for them again by code. It just never resolves to a name.

You always see your own organization in full, wherever it appears.

And to a visitor with no account: nothing at all

The public pages at / and /explore are coarser still. A visitor sees no seller — not a name, not a handle, not even a pseudonym — and no price. Only aggregated availability: how many sellers as a range, which month, a broad area, and a quantity band totalled across everybody.

Two things follow that are worth being explicit about:

• Signing up does not unmask anyone. An account moves you from aggregates to individual listings with operator handles; it never moves you to company names. Nobody on the platform ever sees those except the broker.
• A month with fewer than three sellers in an area publishes no area and no quantity, because an aggregate over one or two operators is those operators. Public browsing has the full table.

What you can and cannot see

The document fingerprint is there so you can confirm the file OnlyTons audited is the file OnlyTons still holds, without receiving a PDF that carries the operator's letterhead.

A revoked certification is not shown to you at all, rather than shown as revoked: "this operator had a certification revoked" is a statement about one specific operator, and publishing it would invite exactly the guessing game this page exists to prevent. The broker sees it and acts on it.

Location is shown by area, never by address

An area is a region — and every operator in that region is shown at the same point on a map, not near it. That matters: nudging each operator to a slightly different spot would let anyone track them individually, while putting them all on the same point makes them indistinguishable.

If an area currently holds very few operators, OnlyTons automatically widens it (from a region to "Southern Italy", say). In a thin market, "one producer in this region" is the same statement as naming them.

Why certificate numbers are hidden

A certificate number is a lookup key. National organic registers are searchable by it, so publishing one to a counterparty is equivalent to publishing the farm. The certifier's name narrows it almost as far.

You still get what the number is for: which scheme, whether it is active, and whether its validity covers the whole availability window you care about — which is the thing that actually decides a purchase. Expiry is shown as a band ("expires within 30 days") rather than a date, because a scheme plus an area plus an exact date is close to unique.

Where OnlyTons has checked the certificate against the issuing register, the badge is marked ✓.

Inside a deal

Being in a deal together does not open the door either.

• Each party gets a per-deal alias: "Buyer", "Supplier A", "Supplier B". The alias means nothing outside that deal, and it never changes hands — if a supplier leaves, the others keep their letters.
• A supplier sees its own lines and the buyer. On a deal filled by several producers, a supplier does not see who the co-suppliers are.
• The coordinator is shown as OnlyTons — portal. Coordination happens on the deal timeline; there is no personal contact address to route around it.
• Internal broker notes are never visible to any organization.
• Messages do not reach the other party directly. You write to OnlyTons; OnlyTons reads what you wrote and passes it on, sometimes edited. There is no chat window between operators, and no message reaches a counterparty before a person has read it. See Messaging and the relay.
• Logistics: you see your own half of the journey — incoterms, transport mode, the area you collect from or deliver to, and a OnlyTons-issued transport reference instead of a carrier's name. You do not see the other party's area: an area plus a quantity plus a delivery window is enough to work out who somebody is, even with every name removed.

Provenance

The provenance chain tells you what happened, not who did it: origin, grower, harvest, processing, packaging, transport, each with its date. A step carried out by a party to your deal is labelled with their alias; anyone else in the chain is shown by role ("Grower", "Certified processor").

Specific locations — a named mill or press — are not shown, because naming the processor usually names the grower to anyone who knows the district. What you get instead is the area (widened when too few operators work there), how hard OnlyTons checked the step — self-declared, portal verified, or document backed — and how many documents sit behind it.

You are trading "I can go and audit the grower myself" for "the portal audited them and put its name to it". The verification state is how you tell which steps that promise actually covers, rather than taking the whole chain on trust.

The honest limit

OnlyTons guarantees this within the platform. Once goods physically move, packaging, lot codes and the carrier can reveal who shipped what. Keeping a transaction anonymous end to end is partly an operational and contractual matter — neutral packaging, portal-issued references — and the broker will tell you when that applies to your deal.

There is also a legal question the platform does not decide on its own: food law requires traceability one step back and one step forward, and organic audits require the operator chain. Where a buyer is legally required to know its supplier, that release is handled explicitly and recorded, never by accident.

---

Under the hood: a single server-side rule decides whether a viewer may identify an organization; every response that carries organization data is projected through it and validated against a schema before it leaves the server. An automated test drives every API endpoint as every kind of viewer and fails the build if an identifying value appears in a payload it shouldn't — and a second check fails the build when a new endpoint is added without deciding which of the two it is.

---

Next: Commodities · Back to index

Your company details (registration)

Signing up asks for a VAT number, a company registry number, a contact email and phone, and optionally a website. These go to the broker so your business can be verified, and to nobody else.

They are handled exactly like certificate numbers, and for the same reason: a VAT number is a lookup key into a public business register, so handing one to a counterparty is equivalent to handing over your company name. There is no "blurred" version of a key, so there is no coarsened form of these — they are simply never published.

The same applies to the free-text description you write about yourself, and to the products-and-interests declaration you make during setup. A counterparty never sees any of it.

If the broker declines or suspends your organization, the reason is shown to you and to the broker. It is not visible to any other operator.

Search cannot be used to find you

Search is the one place where privacy would be easiest to lose, because finding something is itself a disclosure: a search that returned exactly one result would have told the searcher something about that operator even if the result showed no name at all.

So the rule is absolute. Company names, VAT numbers, addresses, websites and contact details are not searchable by anyone except the broker, at any tier. Searching for a company name returns nothing.

The same applies to what your listings can be found by. Your private notes, your traceability notes and your exact region are not indexed, so no words from them can be used to find you. Areas in search are one step broader than on the listing itself — Southern Italy rather than a region — precisely so that nobody can type a thin region into a search box and find its only grower by elimination.

When your organization is suspended or not yet approved, every listing you have ever published drops out of search immediately, not just the ones you post afterwards.

Your reliability band is private too

OnlyTons gives every organization a reliability band, and it is never shown to another operator — not a bad one, and not a good one either.

The second half of that matters more than it looks. Publishing "Preferred" feels harmless, but it is still a statement about a specific, named company, and in a market with three growers of one crop in one area, "the only Preferred one" is an identity. There is no screen, no badge and no API field anywhere in OnlyTons that shows one organization another organization's band.

What the band does affect is invisible to you: the order in which the broker's matching workspace lists candidates, and whether a small number of consequential actions go through, get held for a person, or are refused. The broker sees your band because the broker is a party to every deal; nobody else does.