Built so codes can’t be forged.

Signed codes

Each QR code contains a random 96-bit identifier and an HMAC-SHA256 signature made with a secret key that never leaves our servers. Altered or invented codes fail the signature check instantly.

Clone detection

Copying a genuine code is possible — so single-use batches record who scanned a code first. When a different person scans the same code, the scan is flagged as a likely clone and the brand is alerted with the location.

Server-side verdicts

Apps and browsers only display results. Every authentic, counterfeit, recalled or expired verdict is decided by our servers, so a tampered app can’t fake a result for anyone else.

Accounts and sign-in

• Manufacturer and staff accounts are protected by two-step verification with an authenticator app, with one-time recovery codes as a backup.
• Passwords are hashed with bcrypt; sessions can be revoked from any device.
• Manufacturer API keys are stored as hashes and shown only once.
• Every admin and manufacturer action that changes data is written to an audit log.

Data in transit and at rest

• Every connection uses TLS, and HSTS tells browsers never to connect to us without it.
• Company registration documents are kept in private storage — only the company’s own team and ValidateNow reviewers can open them, through signed, authenticated links.
• Card details are handled by Paystack, Flutterwave and Monnify — we never see your card number.

Integrations

Webhooks to brands’ systems are signed with HMAC-SHA256 and a timestamp, so receivers can reject forged or replayed events. See the developer docs for how to verify them.

Audits

We run regular security reviews and third-party penetration tests, monitor for dependency vulnerabilities, and fix critical issues as a priority.

Report a vulnerability

Email security@validatenow.app. We respond within two business days.