- Home
- Security
Independent by design. Controlled by the issuer.
Verification only works if everyone can trust it. IVQA separates who issues a credential from who confirms it — and keeps the issuer in control of its status.
Status & revocations
Verification logs
Three roles, kept separate
The organization issues and controls. IVQA registers and publishes. Anyone can check.
What keeps a credential trustworthy
Independent verification
IVQA is not the issuer. The verification page is served by IVQA, so it cannot be edited like a file.
Credential integrity
Each credential has a unique reference and QR code pointing to its record; an edited copy does not change what the page shows.
Public verification
Anyone can check, without an app or an account, on the IVQA verification page.
Issuer-controlled status
Only authorized users of the issuing organization validate, suspend or revoke — the page follows immediately.
Auditability
Verification logs show when each credential was checked; activity is logged for the issuer.
Privacy by design
The public page shows the essential details only. Personal data is handled under GDPR / UK GDPR where applicable and Moroccan Law 09-08.
How we protect the service and your data
As set out in our Privacy Policy and Data Processing Addendum.
- Access control, role-based permissions and least privilege
- Encryption in transit (TLS)
- Logging, monitoring and audit trails
- Secure development and incident-response procedures
- An information-security program aligned with ISO/IEC 27001 principles
- A Data Processing Addendum with breach notification and deletion or return of data
Read the Privacy Policy and the Data Processing Addendum.
What changes for whoever checks
| Question | Manual verification | With IVQA |
|---|---|---|
| Is this document genuine? | Visual inspection, e-mail to the issuer | Scan the QR code — the issuer's record answers |
| Is it still valid? | Usually unknown; revocations do not propagate | Current status shown on every check |
| How long does it take? | Hours to weeks, across time zones | Seconds, from any phone, no account |
| Can I prove I checked? | Rarely | Verification activity is logged for the issuer |
| Who stays in control? | — | The issuing organization, always |
Questions about security or data protection?
Our team can walk you through how IVQA handles your credentials and personal data.