Straight answers.

Yes — and this is the part most vendors oversell, so we won't. A QR code is just data; copying one is trivial. That isn't where the security lives.

The forgery resistance comes from where the QR points: a scan hits our server, which the forger doesn't control. The code's job is to surface the official record — the live photo, name, and status straight from the issuer's database. A copied QR shows you the real record of the person it was copied from, and the photo on screen won't be the face in front of you. A QR invented from scratch points nowhere and produces a dead link.

So the check is: scan, then compare the photo on the screen to the face. The system surfaces the truth; the human makes the call.

No — and this is deliberate. The QR contains an ordinary web address, so any phone's built-in camera opens it. No app, no account, no SDK, nothing for a gate officer to be trained on.

The verification page is server-rendered HTML with no JavaScript bundle, so it lands fast even on a weak 3G signal. It works the same on a ₦20,000 Android phone, an Android POS terminal in kiosk mode, or a scan gun that types the URL — because it's just a web page.

You flip their status in the console and it's live everywhere, immediately. The next person to scan that card gets a red page reading "No longer in service — this card is not valid" (your wording is configurable).

This is the whole point. A printed card can't know its holder resigned — but the page behind it does. Revocation is instant and costs nothing; you never chase anyone to hand a card back, and a kept card is worthless the moment you say so.

Then the page can't load — an honest limitation of live verification. Verification needs connectivity at scan time, because the whole value is reading the record now rather than trusting what was printed months ago.

In practice the page is a few kilobytes and loads on very weak signal, and the scanning phone uses its own data — you don't need to provide network at the gate. For genuinely offline gates we have a signed-QR mode on the roadmap, where the code carries a cryptographic proof verifiable with no network. The trade-off: an offline code can't show a photo and can't be revoked. Talk to us if that's your situation.

You choose, field by field, and the default is deliberately minimal: photo, name, staff number, designation, department, duty station, status, and expiry.

Fields you mark internal are structurally never sent to the public page — the server builds its response from your whitelist, so an internal field isn't hidden by styling, it simply isn't in the data that leaves the database. Things like payroll identifiers, date of birth, and home address stay internal unless you deliberately publish them, and we'll push back if you ask to publish something we think is unwise.

More detail on the security & privacy page.

No. Each credential's address ends in a 128-bit random token — not a staff number, not sequential, and not derived from anything about the person. There's no pattern to walk, no "card 41 → card 42", and the database itself has zero public access: the verification endpoint is the only public surface, and it answers for exactly one token at a time.

When you reissue a card, the token rotates — the old page reports that the card was replaced.

Never. Scanning is the product working — metering it would mean charging you more the better your gates enforce, which is backwards. Verification is unlimited and free on every tier, including via the API.

You're billed on active credentials — see the published tiers. We put the prices on the page precisely so you don't have to book a call to find out.

Your card vendor does — we're not a print shop, and you shouldn't have to change suppliers to adopt this. You export the batch from the console and hand it over: a vector SVG and high-resolution PNG per person named by staff number, plus a manifest CSV for their mail-merge and a one-page spec note.

The spec matters: minimum ~16–18 mm printed, a 4-module quiet zone, and a physical proof scan before the full run. Codes are generated at high error correction, so a centre logo is safe.

No. Your data is yours and you can export it — members, scan logs, reports, audit trail — as CSV at any time, without asking us. That's a standing commitment, not a retention tactic.

What you don't get is the source code or the database: this is a hosted service, and that's what keeps it maintained, patched, and identical for every tenant.

Yes, and we'd encourage it — a card that verifies on verify.your-agency.gov.ng is part of the trust story, because the domain itself is something a forger can't obtain. You point one DNS record at us and the certificate is automatic.

Included on Scale; an add-on for Starter and Growth. Already live in production for a federal agency.

Soon. Those are documents rather than people: frozen at the moment of issue, verified forever, and typically minted in bulk by your own system through our API at generation time.

They're metered differently — prepaid credit blocks rather than a subscription, because a receipt has no lifecycle to manage. Tell us your volume and we'll bring you in as it lands.

A spreadsheet and photos. The import wizard maps your columns to fields (it copes with the real state of nominal rolls — mixed date formats, stray whitespace, duplicate staff numbers, department typos — and flags anything ambiguous for a human instead of guessing). Photos upload in bulk, matched by staff-number filename.

Then you export the QR batch to your card vendor. Most of the work is data cleanup, and the wizard is built to make that the easy part. Book a demo and we'll run your real file through it.