Security is the foundation of every verification.
When a business depends on proving products are genuine, the platform doing the proving must protect its identities, data and evidence from manipulation.
audit_trailSHA-256 · APPEND ONLY
INTEGRITY CHECKChain verified · No changes detectedPASS
EncryptionAES-256 · TLSIdentity signingHMAC-SHA256Tenant isolationRow-Level SecurityAccessSSO · SAML · RBACAudit integritySHA-256 hash chainOperationsMonitoring · Backups
PRODUCT IDENTITY SECURITY
How Qrynto protects the identity on every product.
The code is only the carrier. Verification happens against protected signing logic and the product record held by Qrynto — every QR code is signed with HMAC-SHA256 and checked server-side on every scan.
Identity issued
A unique identity is created for the unit or batch.
Signature applied
The code receives an HMAC-SHA256 cryptographic signature.
Server verification
The signature and status are checked on every scan — counterfeiters cannot reverse-engineer the signing key.
Evidence recorded
The verdict and surrounding risk signals are retained.
Signing keys remain server-side Timing-safe comparison Key rotation support Invalid signatures default to suspect
DATA PROTECTION
Encrypted, isolated and controlled.
Product, customer and operational evidence is protected at the data, tenant and access layers — not only at the application edge.
Encryption everywhere
AES-256 protects stored data while TLS protects data in transit. API keys, passwords and secrets are hashed and never stored as readable plaintext.
Database-level tenant isolation
Row-Level Security enforces company boundaries in the database itself, across every application endpoint — no company can reach another company’s data.
Identity and access management
SSO, SAML, role-based permissions and least-privilege controls govern access across enterprise teams.
Administrative oversight
Important administrative actions, identity changes and lifecycle events are recorded in immutable audit trails for review.
AUDIT INTEGRITY
Records designed to reveal tampering.
Each audit entry carries the hash of the record before it, sealed at insert by a database trigger. A changed, deleted or reordered event makes the chain fail verification visibly — an on-demand verifier surfaces the exact tampered row.
- Product generation and status changes
- Scan and authentication events
- Dispatch, receipt and decommissioning
- Administrative and access actions
integrity.verifyCOMPLETE
$ verify --tenant qrynto-demoWalking chain: 2,842 entriesChecking order and previous hashes...✓ All entries verified✓ No reordered records✓ No mutation detectedVerification result: PASSLIFECYCLE EVIDENCE
Every unit’s end state, on the record.
An append-only ledger tracks every QR transition into a terminal state — dispensed, destroyed, returned, recalled — capturing the actor, geo, IP and reason behind it.
Per-unit decommissioning ledger Actor, geo, IP and reason captured Append-only, no destructive edits
INFRASTRUCTURE & OPERATIONS
Security that continues after deployment.
Controls for monitoring, recovery, change management and incident response support the verification layer in production.
Production-grade cloud infrastructure
AWS Mumbai (ap-south-1) deployment with encrypted storage and architecture designed to grow with enterprise volume.
Continuous operational visibility
Application and infrastructure monitoring with defined alerting and escalation procedures, 24/7.
Backups that are tested
Encrypted daily backups supported by scheduled restoration verification.
Controlled production changes
Automated delivery workflows with dependency checks, security scanning and staged deployment.
COMPLIANCE STATUS
Clear about what is implemented — and what is still in progress.
Qrynto maps technical controls to relevant requirements without presenting roadmap items as completed certifications.
Technical and data controls
- Encryption and tenant isolation
- SSO, SAML and role-based access
- Hash-chained audit integrity
- Backup and recovery controls
Regulated-record requirements
- 21 CFR Part 11 control mapping
- ALCOA+ data-integrity principles
- GDPR and DPDP-aligned processes
- GS1 and EPCIS event structures
Independent certifications
- SOC 2 programme
- ISO 27001 programme
- Current status available on request
- No certification claimed before completion
SECURITY REVIEW
Give your InfoSec team what it needs.
Request the current security questionnaire, architecture overview, Data Processing Agreement, sub-processor list and assurance status.
Request the security package