AUTHENTIFIC DVP / ENTERPRISE DOCUMENT VERIFICATION
Authentific DVP gives banks and enterprises a controlled way to register, approve, issue and independently verify important documents - without replacing the systems they already use.
Connect every official document to an authoritative record and its current lifecycle status. Give recipients a clearer answer to a consequential question: can this document still be relied on?
View Deployment & Security Options
Enlarge console
For enterprise evaluation. Core workflows are implemented; production rollout requires deployment acceptance. Advanced integrations are scoped and validated separately.
01 / THE TRUST GAP
A forged bank reference can carry a convincing letterhead. An employment confirmation can be altered after it leaves the issuer. A genuine letter can continue circulating after it has been revoked.
Even a modified PDF can retain a working QR code. A recipient reaching a valid record still needs to establish what that record proves - and whether the presented document is the registered version.
Without a dependable verification route, recipients fall back on phone calls, email chains and manual back-office checks. The issuing team carries the burden, while confidential correspondence may travel beyond its intended audience.
A QR code provides the route to verification.
The issuing organisation provides the authority.
02 / A CONTROLLED DOCUMENT LIFECYCLE
Register the approved document. Separate preparation from authorisation. Give each release a verification identity that remains connected to its current status.
The document registry and approval centre support controlled registration and maker/checker review of externally prepared documents.
Issued, revoked and superseded records make the lifecycle visible. Printable verification references connect the released document to that record.
Recipients can check status without creating an account, within configured disclosure controls. Exact digital-file comparison and audit evidence answer different questions about integrity and accountability.
A matching verification record establishes a registered identity and current status. Exact-file comparison checks whether the digital PDF matches the registered final file. A scan of a printed page, a photograph or a copied QR image alone does not establish that every word is unchanged.
03 / FROM DOCUMENT TO AUTHORITATIVE RECORD
Explore the journey from an approved letter to a verification result. The illustrative workflow explains the business process; it is not a live verification service.
Create the letter in Microsoft Word, your correspondence platform, ERP, CRM or PDF generation system. Prepare the final PDF for registration. DVP does not need to create the underlying document.
DOCUMENT WORKFLOW / 01
Click to enlarge
Associate the approved document with an issuer-controlled record. Its verification identity connects the released document to the issuing organisation.
DOCUMENT WORKFLOW / 02
Click to enlarge
An authorised checker reviews the document independently of its maker. The release workflow places responsibility with the organisation, not with possession of a QR image.
DOCUMENT WORKFLOW / 03
Click to enlarge
Confirm the final digital document and issue it with a printable QR reference. That reference provides a route to verification; it is not proof of the complete contents by itself.
DOCUMENT WORKFLOW / 04
Click to enlarge
Recipients consult the authoritative record. When the original digital PDF is available, exact-file comparison adds an integrity check against the registered version.
DOCUMENT WORKFLOW / 05
Click to enlarge
Manage expiry, revoke a document or supersede it with a replacement. Review the associated history and export audit material for investigation and assurance.
DOCUMENT WORKFLOW / 06
Click to enlarge
Illustrative workflow · Depicted integrations and assurance features remain subject to configuration and validation.
04 / ADVANCED VERIFICATION PATHWAY
An optional integration pathway for organisations seeking added assurance beyond a static or reproduced verification image.
LiveProof is intended to complement registered-document verification with a controlled, server-backed live presentation. The objective is to help a recipient distinguish an authoritative live experience from a copied image, in the context of the document being checked.
Technical activation and validation are required. LiveProof is integration-dependent; it is not represented here as a production-activated or independently certified capability.
A changing graphic, animation or scan counter is not cryptographic evidence of document integrity. LiveProof does not promise perfect detection of a physically copied QR, and it does not replace an exact-file comparison.
A QR routes the recipient to verification.
Advanced assurance, subject to activation.
Integrity comparison remains a distinct check.
Conceptual illustration of an integration pathway. Not a working LiveProof challenge or authenticated result.
05 / INSTITUTIONAL DOCUMENTS
The document changes. The requirement for a dependable issuer, a controlled release and a current answer remains.
Give counterparties a defined route to check bank-issued correspondence without relying entirely on manual confirmation.
Illustrative document category
Counterparty banks, corporate finance teams, customers and authorised reviewers.
Controlled release, current status and traceable verification evidence help teams assess potentially forged correspondence. DVP does not legally validate the financial obligation behind a guarantee.
Connect employment and commercial letters to the organisation that approved them.
Illustrative document category
Employers, lenders, business partners, suppliers and other intended recipients.
Reduce uncertainty about the issuer and current validity. Configure disclosure so sensitive salary or employment details are not needlessly exposed.
Support the controlled registration of selected authority-issued documents and status checks.
Illustrative document category
Residents, regulated businesses, public bodies and authorised professional advisers.
Make expiry, replacement and revocation discoverable. Legal admissibility and government acceptance depend on jurisdiction and deployment requirements.
Give recipients a clearer basis for assessing insurer-issued correspondence.
Illustrative document category
Policyholders, brokers, commercial counterparties and authorised claims reviewers.
Maintain a current document record. A verification result does not itself establish coverage outside the terms of the underlying policy.
Help institutions answer verification enquiries while retaining control of the information they disclose.
Illustrative document category
Employers, admissions teams, professional regulators and authorised credential reviewers.
DVP can register externally produced documents. Authentific CMS is an optional companion for integrated design and issuance; that integration requires agreed scope and validation.
Provide a documented verification route for professional and property-related confirmations.
Illustrative document category
Property managers, counterparties, legal advisers and authorised administrative teams.
Check the issuing record and document status. DVP does not establish legal title, replace an official land registry or determine legal enforceability.
Scope verification around administrative authority while protecting sensitive information.
Illustrative document category
Accreditation bodies, procurement teams, suppliers and permitted external reviewers.
Use privacy-controlled disclosure and access governance. Patient information and other sensitive records require a separate information-classification and privacy assessment.
Enterprise assurance
Document trust depends on who can issue, what recipients can see, how integrity is checked and which evidence survives. DVP brings these questions into one controlled lifecycle. Production acceptance remains an explicit part of each engagement.
Separate preparation from approval. Restrict issuance and privileged administration to authorised roles.
Keep private content behind scoped access. Define what a public verification result may disclose.
Check the authoritative record, current lifecycle status and, separately, the exact registered digital file.
Retain approval, issuance, revocation and verification history for review and investigation.
UI 3.0 / GOVERNANCE VISIBILITY
The document-assurance view distinguishes available file comparison, configured approval and storage controls, and audit evidence awaiting validation.
This real capture retains the audit status Not Verified. Configured controls are not an independent security assessment or certification.
Inspect assurance controls
Role-based permissions, separate maker and checker responsibilities, local authentication, optional multifactor authentication and scoped API access are implemented product controls. Session management and privileged access belong in the customer's security review.
Enterprise federation is an integration workstream. An identity adapter is not evidence of an activated connection to Microsoft Entra ID, Google Workspace or a customer's identity provider. Provider configuration, policy mapping and acceptance testing must be agreed; SAML is not currently implemented; a SAML requirement needs separate implementation and validation.
Authoritative registration connects an issued document to its record. Exact-file comparison checks the final digital PDF against its registered cryptographic fingerprint. Expiry, revocation and supersession determine whether that record remains current.
A matching verification record and an exact-file comparison provide different assurances. A QR match alone does not establish that a PDF's contents are unchanged, or that every word on a printed copy matches the registered document.
Organisation-scoped permissions and logical separation limit access to records and private document content. Public verification should expose only the information agreed for that document class, with restricted storage access and administrative permissions reviewed before release.
Secure transport, tenant isolation, security logging and data-access governance must be validated in the selected deployment. Logical separation does not imply dedicated physical infrastructure for every customer.
Document fingerprints support integrity checks; controlled issuance entitlements are governed through commercial licensing. Neither substitutes for the issuer's approval process or an independently trusted document signature.
Digital signatures, trusted timestamps and approved trust services are integration options. Key custody, separation of responsibilities and any HSM or customer-managed key requirements need solution design and validation. These capabilities are not presented as pre-activated or qualified signature services.
Approval, issuance, revocation, verification and administrative events provide investigative traceability. Exportable audit material and a tamper-evident audit design support review of the decisions behind a document's status.
Audit evidence is not described as impossible to alter. External retention, independent anchoring and security-event integration require suitable configuration, access governance and agreed retention policies.
An assurance engagement can scope independent penetration testing, vulnerability assessment, authentication and authorisation testing, API review, tenant-isolation checks and configuration assessment. Findings should lead to remediation, retesting and evidence handover.
Customer security questionnaires and supplier-risk reviews form part of procurement. Assessment support is not a claim that an independent penetration test has been passed or a certification obtained.
| Assurance area | Product foundation | Enterprise acceptance |
|---|---|---|
| Issuance governance | Roles, maker/checker approval and lifecycle controls. | Map responsibilities, exceptions and administrator access. |
| Document trust | Record lookup, exact-file comparison and live status. | Agree document classes, disclosure and recipient guidance. |
| Enterprise integrations | Controlled interfaces and defined integration pathways. | Activate and test identity, signatures, CMS and any LiveProof scope. |
| Operational assurance | Audit history and evidence export. | Validate monitoring, recovery, retention and support responsibilities. |
| Independent assessment | Controls available for customer evaluation. | Commission agreed tests and review resulting evidence. |
Deployment & ownership
Evaluate the operating model before procurement. Document ownership, processing responsibilities, access, service commitments and exit provisions should be explicit in the engagement - not inferred from a hosting label.
01 / Hosted service
A hosted operating model for organisations whose contractual service, processing and data requirements can be met. Agree administration, support, subprocessors and handling of confidential documents.
02 / Customer ownership
Assess deployment in customer-owned infrastructure accounts, including a customer-controlled Cloudflare environment where appropriate. Define storage control, privileged access and the division of operating responsibilities.
03 / Private environment
A deployment pathway subject to infrastructure assessment, customer environment validation and agreed integration scope. Local runtime validation does not establish production acceptance in every private environment.
Assess regional infrastructure choices against information classification, cross-border access, processing and subprocessors. Agree retention, deletion, contractual ownership and exit arrangements. A regional database setting alone does not guarantee regional processing or complete data sovereignty.
Set availability and recovery objectives alongside backup and restore testing, operational monitoring, incident management, business continuity and support escalation. Scope audit export and security-event integration; review privileged access, change control and vulnerability remediation. Service levels and recovery times require agreement.
DVP's access, lifecycle and evidence controls may support an organisation's security governance and ISO/IEC 27001 control objectives. This is not a claim of ISO/IEC 27001 certification. Regulated-sector acceptance and compliance depend on configuration, implementation, organisational policy, applicable law and assessment evidence.
08 / FIT YOUR OPERATING MODEL
DVP is a standalone platform. Your organisation can keep creating documents in its existing applications, then connect the approved output to a controlled verification lifecycle.
Prepare documents in Microsoft Word, a document management system, an enterprise correspondence platform, ERP, CRM or an existing PDF generator. Export or prepare the approved final document as a PDF, then register it with DVP. CMS is not a prerequisite.
Scope a companion workflow combining CMS document design, templates and certificate issuance with DVP verification. The integration contract has been developed; end-to-end customer integration and production acceptance remain part of implementation.
Explore CMS IntegrationREST APIs and SDK-based pathways provide a basis for application integration. Assess connections to document management, correspondence platforms, ERP and business applications, identity providers, approved signature services, PDF generators and enterprise automation against your actual environment.
Vendor connectors, enterprise identity activation and trust-service signatures require specific scope, configuration and testing. No prebuilt SAP, Oracle, SharePoint or DocuSign connector is implied.
Talk to an Integration Specialist09 / ENTERPRISE ENGAGEMENT
Evaluate the deployment and assurance requirements before procurement. Engagements can be structured around document issuance volumes, selected verification capabilities, hosting model, integration scope and the required implementation and support services.
Configurable commercial licensing and controlled issuance entitlements support an agreed enterprise scope. Pricing, service commitments and acceptance criteria are established through consultation.
Discuss Licensing & Deployment10 / THE ENGINEERING BEHIND THE ENGAGEMENT
HSA.dev brings software engineering, enterprise integration, identity and infrastructure expertise to HSA Security Solutions’ wider technology capability.
That capability supports architecture assessment, customer-specific integration, secure deployment planning, identity and access integration, infrastructure implementation, testing and UAT.
An engagement can also scope operational handover, training, support and continuous product engineering. HSA.dev’s engineering role is not an independent certification of DVP.
Meet HSA.dev Explore the engineering practiceEnterprise procurement FAQ
A clear view of product capabilities, integration scope and the evidence required for your organisation.
Authentific DVP is a Document Verification Platform for controlled registration, approval, issuance and verification of official documents. It connects an externally created document to an authoritative record, exact-file integrity checks and current lifecycle status. It is designed for enterprise evaluation; production deployment requires agreed validation and acceptance.
A QR code provides a route to a verification result. DVP adds the issuer-controlled record, release workflow, status management and evidence behind that result. A QR image alone establishes neither the authority of the issuer nor the integrity of all the content surrounding it.
Yes. The underlying document can originate in Word, a document management system, a banking application or another enterprise platform. The approved final document is exported or prepared as a PDF, then registered through DVP. The specific handoff, file handling and automated integration should be assessed against the organisation's existing workflow.
No. DVP is a standalone platform for documents created in existing systems. Authentific CMS is an optional companion for document design, templates and issuance workflows. An integrated CMS-to-DVP engagement must be scoped, activated and acceptance-tested; a defined integration pathway does not imply completed production acceptance.
The issuing organisation can manage revocation and supersession through the document lifecycle. Verification reflects the current authoritative status rather than relying solely on the originally issued copy. Recipients should follow the verification result and the issuer's guidance when a document is expired, withdrawn or replaced.
A copied QR may still lead to a genuine record. That does not prove that the surrounding document is unchanged. Recipients must distinguish record status from content integrity and use the available exact-file comparison for digital documents. DVP does not describe printed QR images as inherently uncopyable.
Exact-file comparison checks a submitted digital PDF against the fingerprint of the registered final file. A mismatch indicates that the file is not identical. This check is separate from record lookup and does not automatically prove the contents of a paper copy or a photograph of one.
Public verification can be available without a recipient account, subject to the issuer's privacy and disclosure controls. The information shown, access conditions and handling of confidential documents should be agreed for each document class. Public status access does not imply public access to the underlying private document.
Customer-controlled cloud and private or on-premises deployment pathways can be assessed alongside managed hosting. Suitability depends on the customer's infrastructure, operational responsibilities and integration scope. Local runtime validation is a starting point; the selected environment still requires security review, testing and production acceptance.
Ownership and permitted processing should be expressly defined in the customer agreement. The engagement should address document and record access, administrative responsibilities, retention, export and exit arrangements. Hosting location alone does not settle these questions; they should be resolved before procurement approval.
These requirements can be assessed during solution design against the chosen infrastructure, information classification and operating model. Review regional processing, cross-border access, subprocessors, retention and deletion together. Selecting a regional storage or database option alone is not a guarantee of complete data sovereignty.
Approved digital signatures, timestamps and trust services are integration pathways requiring provider selection, configuration and validation. DVP's registered-file integrity comparison is distinct from a trusted digital signature. Qualified signatures, particular vendor connectors and customer-held key services should not be assumed to be activated.
LiveProof is an optional integration intended to strengthen a recipient's ability to distinguish an authoritative live verification experience from a reproduced image. It complements document records and lifecycle controls. Technical activation and validation are required; a moving graphic alone is not cryptographic proof of integrity.
Implemented controls include roles, separated approval responsibilities, local authentication, optional multifactor authentication and scoped API access. Enterprise identity federation needs customer-specific configuration and acceptance testing. Available adapters do not establish an activated connection to a real identity provider; SAML is not currently implemented; a SAML requirement needs separate implementation and validation.
An engagement can scope independent penetration testing, vulnerability assessment, authentication and authorisation checks, API evaluation, tenant-isolation testing and configuration review. Agree remediation, retesting and evidence handover alongside supplier security questionnaires. Support for assessment is not a claim that an independent test has already been passed.
Enterprise licensing can be structured around issuance volume, selected verification capabilities, hosting model, assurance requirements and integration scope. Implementation and support services also form part of the commercial discussion. Controlled issuance entitlements are managed at a business level; pricing and detailed licensing terms are agreed directly.
Yes, this is an integration pathway to assess using the platform's controlled interfaces. Scope the approved-document handoff, release authority, verification reference and lifecycle responsibilities with the existing system owner. Prebuilt connectors for particular correspondence, ERP or document-management products should be confirmed individually, rather than assumed.
Its document, access and evidence controls address needs relevant to those organisations. Suitability must be established through the customer's risk assessment, legal and privacy review, deployment validation and acceptance criteria. DVP does not itself establish a financial obligation, legal title, regulatory approval or guaranteed compliance.
MAKE THE NEXT DOCUMENT VERIFIABLE
Discuss the documents you issue, the people who rely on them, and the security and deployment requirements that matter to your organisation.