From roll to scan

Getting started

1. Order labels from us. Tell us how many units and for which product. You can file the order yourself from the panel: it reaches us, we generate the codes and send them to print.
2. Add your product and your batch. While printing runs. Name, presentation, batch number and expiry date if it applies.
3. Receive the roll and confirm it. Marking it as received is what puts it under your custody, and records when.
4. Apply and activate. You apply the labels during packaging and activate the range in the panel. Until then, none of those units authenticate.
5. Watch the scans. They show up live, with country, state and time. Alerts raise themselves.

The order of step 4 matters: activating before applying means a roll lost in transit carries units that do authenticate. Activate once the label is already on the product.

What the buyer sees

They scan the QR with the phone camera and a page opens in the browser. There is no app to install and no data is asked of them. The page weighs under 30 KB so it loads on a shop floor with one bar of signal.

Rolls and labels

We generate the codes and they travel encrypted to the printer. You never have to handle a file with millions of codes, and whoever prints them never sees which customer they belong to: the code does not carry the brand inside.

Every roll carries a serial range and a state. The state is what gets audited when something does not add up.

If a roll is stolen, flag it as stolen in the panel. All of its units stop authenticating immediately, including the ones already activated, and every attempt to verify them is recorded with country and time — which is how you trace where they came out.

Products, batches and activation

A product is what you sell; a batch is a production run of that product; a unit is one container with its label. Alerts, recalls and reports all work on the batch, so it pays to keep the batch in the panel identical to the one in your production system.

Activation works in three ways, all from the panel:

• By range — from serial X to Y. The normal case when a whole roll is consumed.
• By roll — the full range of a received roll, in one click.
• By unit — for replacements and samples.

Every activation lands in the audit log with who did it and when. That log is hash-chained: it cannot be edited afterwards without it showing, which is exactly what an auditor asks for.

Batch recall

You flag the batch as recalled and the next scan of any of its units shows the safety notice instead of "verified product". It propagates worldwide in seconds and requires no reprinting and no collection.

It is reversible: if the recall was precautionary and gets lifted, the batch verifies normally again. Both operations are audited.

Anomalies and cases

Eleven rules watch the scan stream. The ones that fire most in practice:

• Rescan — the same unit verified many times, especially from different places.
• Geographic impossibility — two scans so far apart that nobody could have travelled between them.
• Territory diversion — product assigned to one market showing up in another. That is channel leakage, not counterfeiting, and the two are told apart.
• Batch burst — a spike of scans concentrated in one batch and one area.
• Stolen roll — any attempt on a reported range.

Every alert arrives with its evidence —which units, where, when— and can be turned into a case: assign an owner, add notes and attachments, close it with a resolution. The case is what you later show a lawyer, a customs office or a distributor.

Users and roles

Each brand’s data is isolated in the database, not in the application: even if a programming error asked for another company’s data, the database would not return it.

API

Public verification. The same one the QR page uses. It carries no authentication —it has to work from any buyer’s phone— and it does not reveal which brand a code belongs to.

GET https://xyvona.com/api/v/K7M2QX9J4TB8WNPC5RDA

{
  "result": "genuine",
  "message": "Producto verificado.",
  "product_id": 412,
  "batch_id": 88
}

When the unit was seen before, the response adds first_seen and first_country. When it does not verify, the body is only result and message: it never leaks whether the code does not exist, is not activated, or belongs to a stolen roll, because that difference is exactly what a counterfeiter needs to calibrate.

Panel API. Everything the panel does has an endpoint. It authenticates with a key you generate, with its own scope, shown only once.

curl https://xyvona.com/capi/api/v1/batches \
  -H "X-API-Key: $XYVONA_API_KEY"

Save the key as soon as it is generated: we do not show it again and cannot recover it. If it is lost, it gets revoked and a new one issued — which is what should happen when a credential goes missing.

Webhooks

You register a URL and we notify you when an alert is raised, filtered by minimum severity and by type. Retries use growing backoff and every delivery is logged, so you can check it when your team says "nothing reached us".

POST https://tu-sistema.com/hooks/xyvona
X-Xyvona-Signature: t=1755820800,v1=9f86d081...

{
  "version": 1,
  "type": "alert.created",
  "tenant_id": 7,
  "alert": {
    "alert_type": "geo_impossible",
    "severity": "high",
    "severity_level": 4,
    "status": "open",
    "unit_id": 90210,
    "batch_id": 88,
    "created_at": "2026-08-21T14:03:11+00:00",
    "evidence": { "km": 8410, "hours": 1.5 }
  }
}

Verify the signature before trusting the body: it is HMAC-SHA256 over «timestamp.body» with the secret we give you when you register the URL. Reject anything older than five minutes and compare the signature in constant time.

Data, exports and retention

• The data is yours. Scans, units, batches, alerts and cases export to CSV whenever you want, without asking by email.
• Geolocation, IP and device fingerprint are deleted after 90 days. It is not configurable: it is a legal requirement.
• The IP is never stored in the clear. It is used to resolve the country and replaced by a hash with a rotating salt before anything is written.
• The full code never appears in a log. Not in ours, not in the one you export.
• Everything travels and is stored encrypted, on infrastructure with international information-security certification, with keys owned by XYVONA and backups.
• In pharma the buyer portal ships off and cannot be switched on: linking an identified person to the medicines they scanned is health data.

Something missing here?

Write to us and we will add it. If you asked the question, someone else is asking it too.