Skip to main content
Every code carries a signed serial: 16 characters that encode the batch, the item’s place in it and a signature made with your workspace’s key. The key is kept encrypted by Satyakod, or with the AWS KMS add-on in AWS Key Management Service, where it never leaves (Key protection); either way nobody else can make a serial that passes. See Serial numbers for the exact format.

The checks

Each scan checked by Satyakod goes through four checks, in order:

Verdicts

Suspicious and counterfeit scans open alerts by your alert rules and can be sent to your systems as scan.flagged webhooks.

Where the checks run

Online checks run on Satyakod’s servers when a code is scanned: that is what makes clone and region checks possible, since they compare a scan with the scans before it. Codes can also be checked offline by your own systems, which can confirm the signature and the serial range without internet; clone and region checks then happen when those scans are uploaded.