At its core, our technology makes any document tamper-proof and instantly verifiable by a third party in a server-less architecture.
Qryptal's solution plugs into existing document production systems and generates a highly secure digital signature with embedded data to be placed on the document as a barcode. After that, anyone can instantly verify the credibility of the information, through an App on their smartphone.
This novel architecture provides many benefits:
The essential workflow for deploying Qryptal is to integrate with the Qryptal Generator API so that the Qryptal Secure QR Code can be generated and seamlessly added to your documents in order to enable easy validation.Sample Document with Qryptal Code
For validation, users can install the Document Validator App. You can try the following steps to install it on your mobile phone:
The code is digitally signed by the organisation’s private key. The keys are generated initially as part of setup. The mobile app uses the organisation’s public key to validate the digital signature. Further, the entire code is compressed specifically to create the smallest possible QR Code size. Contact us to learn more about this.
The Qryptal Generator offers a REST API which can be called from nearly any programming language/system.
Free signup is also available to try the API..
Qryptal Secure QR Codes are of two types:
Both the codes can be revoked or chained with a new code.
The easiest way to understand our technology is by signing up for a free trial account.Schedule Qryptal Discussion
Depending upon customer needs, Qryptal supports the full range of deployment options:
|Product||Cloud Options||On-Premise (in customer data-center or cloud)|
|Qryptal Generator: For generating digitally signed Qryptal Secure QR Codes Code revocation and chaining API is included||Qryptal Cloud||Linux 64-bit1 Windows 64-bit|
|Qryptal Validation Server: For programmatically (API) validating digitally signed Qryptal Secure QR Codes||Qryptal Cloud||Linux 64-bit1|
|ADR Object Store: For EDC, code-chaining & revocation||AWS S3 (customer’s account)||Linux 64-bit1|
|ADR Reverse Proxy: For front-ending ADR Object Store in the DMZ||N.A.||Linux 64-bit1|
1 Most Linux distributions supported with the following:
Please contact us in order to schedule a discussion to determine the best deployment option for your use case.Schedule Qryptal Discussion
We have designed our solutions to provide flexible integration options depending upon customer needs and the configuration of their existing systems.
Primarily there are three kinds of integration options to choose from:
Qryptal Secure QR Code Only: The Qryptal Generator provides the code graphic image file which can be integrated into document by the customer’s document production system. The Qryptal Generator can provide different sizes of the code to enable easier incorporation and avoid error-prone image resizing. This is the most common and preferred integration method which provides maximum level of flexibility to customers.
Finished Document PDF (not available for on-premise): This requires creating a document template and importing it into the Qryptal Generator. After the template has been imported, the Qryptal Generator will not only generate the code but also create the PDF of the finished document with the code and the variable data. This option is useful if the customer does not already have such a system.
Secure Document Generation and Management (not available for on-premise): This option not only generates the finished PDF but also provides an end user UI for your staff to generate secure documents on demand or on a bulk batch mode basis.
There are three validation options available:
Document Validator App: This App is maintained by us and has a mechanism to add customer public key for validation. Validation as well as any decryption for EDC attachments is done on the device with full privacy.
Custom App/Existing App: We provide the Qryptal Mobile Validation SDK to embed validation functionality within an iOS or Android App.
Qryptal Validation Server: This provides an API which accepts file image uploads and returns the Qryptal Secure QR Code details. This is useful for automated processing of inbound documents containing Qryptal codes. An example use case is of insurance policy holders uploading scanned receipts for the processing of claims.Schedule Qryptal Discussion
Security is one of the primary concerns for us as well as our customers. Apart from ensuring security in the core technology, making validation easy is the key for ensuring a holistic system security. There are many secure options which are complicated and hence end up not working for the customers because of the friction that arises in the end-user adoption.
Digital Signature: Each organisation has its own private-public key pair and all codes are signed by the private key of that customer. The signature itself is based on industry standard algorithms equivalent to a RSA 3072 bit key as per the National Institute of Standards and Technology (NIST). Since this signature can only be generated with the organisation's private key, others cannot generate this code.
No Database Required: This is critical in ensuring ongoing document security. Many systems link verification to online databases whose security can get compromised with time. This is particularly important for ensuring security of low verification frequency documents with a long life span like university certificates, birth-death certificates, diamond grading certificates etc. Further not being dependent on a database reduces operational costs significantly.
EDC Attachment Security: EDC attachments (images, PDFs) are stored AES encrypted in the ADR Object Store. The decryption key is embedded inside the QR Code ensuring access to the information via the secure QR Code.
Offline Verification: Since database connectivity is not needed, the verification can be done with the App with just the organisation’s public key. This not only improves performance but also reduces the attack surface area.
No URL - No Phishing: Many verification systems have started incorporating a QR Code on their documents to facilitate validation. This QR Code typically contains a URL, which when scanned displays the information from their server. This is terrible for security because a malicious person can easily generate a QR Code with a URL to their server. QR Phishing is much harder to detect than email phishing and should be avoided in any verification system.
Privacy: Since the Qryptal code is an integral part of the document - user privacy is protected in the most sensible manner. It is all user controlled by deciding with whom to share the document. There are no complicated systems to create & maintain thus preventing any privacy issues.Schedule Qryptal Discussion
A Few queries we come across everyday, let's connect to get into more details.
Qryptal is designed to be placed on documents that may last very long term, i.e more than 50 years, such as university transcripts, degrees, birth certificates etc. Hence we have chosen to use a large key size equivalent to 3072 bit RSA, much higher security than existing internet banking which is typically 1024 bit.
The size of the QR code image increases with the amount of data stored. Qryptal’s multi-pipeline compression is aimed specifically at having a smaller QR code image as for the same amount of data. I.e upto 30% more data can be stored for the same QR code image size. As such upto 2000 characters can be stored. For larger data sets, including attachments such as PDFs and images, Qryptal supports secure attachments associated with the Code.
The Qryptal code can have secure attachments. The attachments are stored, encrypted and signed. They are as secure as the information in the QR code and goes through an equally rigorous process of validation to check for any tampering. By using secure attachments, there is theoretically no limit to the amount of information which can be secured.
With Qryptal’s API , you could be up and running in minutes. We had a enterprise customer who rolled out in 8 systems in just 2 months including integration, staging and testing!
Sure. In addition to the ID textual information, it can also include a photo id as well an expiry date which is checked during validation
- SDK to incorporate in your own App: Qryptal provides an SDK for both iOS and Android platforms so that Validation can be done in your own App
- Validation Server: Simply call an API to post the image of the document containing the Qryptal QR code. This will find the secure code , validate it and return the data in a structured format which can then be ingested into current systems.
Simply post the image of the invoice to the Qryptal Validation Server. It first validates the invoice to ensure it’s authenticity and that it originated from the designated company. Once validated, it returns the invoice data in a structured format that can be read and ingested into most systems for further processing, helping in automation.
Qryptal’s secure code can only be generated by the private key of the issuing organization. The signature generated by the key is 3072 bit in size, which is stronger than most internet banking systems today. This ensures that the validated document originated from the issuing organization.
Yes. In addition to our cloud based offering, we do offer a solution that can run in your own data center.
Yes. It does.
To integrate with existing systems, some knowledge of using web based APIs are needed. The integration is similar to most web based REST API system integration. However it is straightforward. One of our customers got 8 systems online in just two months, this included development and testing.
Yes, just sign up for a trial and our awesome support will be there to assist with any questions you may have.
We have cusomers and users in most parts of the world.