Security
A guest pass is a key to your community. These are the rules QR Check-In follows to keep it that way.
Entry and exit are separate, explicit actions. Each scan locks the pass inside one database transaction, decides with the database clock and records the result before the guard sees a verdict. Unique constraints make a second entry for the same pass impossible, even if two guards scan at the same moment.
Only a confirmed answer from the server can show a green verdict. Lost connections, time-outs and server errors show “Unable to verify — access not granted”. There are no offline allow-lists and no admissions queued for later.
Each QR code carries 32 random bytes and nothing else: no names, no unit, no dates. The server stores only a keyed hash of the token, so the database alone cannot recreate a QR code. Account set-up links work the same way and expire.
There is no public sign-up: administrators invite people. Passwords are hashed with Argon2id. Sessions are kept on the server, so signing out, disabling a member or revoking a lost phone takes effect on the next request.
Every record belongs to one community, and the server decides which community, role and gates a request may use. A pass from one community is denied in another without revealing anything about it.
Requests that change data must come from a trusted origin or the native app. Pages use a strict Content Security Policy, request bodies are size-limited, every input is validated and sign-in and scanning are rate limited.
A guest is a display name with an optional category, vehicle plate and short note. No ID documents, photos or phone numbers are collected, and logs never contain QR payloads, passwords or session cookies.
Tell us about your community and its gates. We reply by email to arrange a demo, or with a quote and the next steps.