Workforce and access

The problem

Site access runs on things that prove almost nothing. A badge proves someone is holding a badge. A signing-in sheet proves someone wrote a name. A contractor’s certification is a laminated card that expired in March and still looks identical.

The gap that costs money is between credentialled and currently entitled to be here. A subcontractor whose insurance lapsed last week still has the same card. Someone who left the company in April still has the same badge until somebody collects it. And on a multi-employer site nobody knows who is actually on it right now, which is a safety problem before it is a security one.

How VCode is deployed

Codes are issued per person, or per location, or both, depending on which direction you want the proof to run.

• Person-carried. Each worker or contractor carries their own code. Scanning it at a gate proves the individual, not the badge stock.
• Location-carried. A code at the entrance, the plant room or the ward door. The worker scans the place, which is how attendance gets tied to a location rather than to a claim.
• Rules per credential. A validity window that expires with the insurance certificate. A geofence so a code only resolves at the site it belongs to. Named users for restricted areas. Once per day, so a code cannot be passed back through a fence.

What happens when it is scanned

The platform is asked who this is and whether they are entitled, here, now. The answer is decided at that moment, not at the moment the badge was printed.

A lapsed certification is the case worth following. The card in the worker’s pocket is unchanged, and it does not matter, because the record behind the code carries the expiry. From the moment the certification lapses the same card reports it. Nobody has to collect anything, and nobody has to notice.

Every scan is recorded with time and place, including the refusals, which means the attendance register and the access log are the same artefact rather than two systems that disagree after an incident.

Why a QR code or NFC alone is not enough

A printed QR badge is a photograph away from being shared, and a photographed badge admits whoever holds it. That is exactly the failure the badge existed to prevent.

NFC access cards are the incumbent and they are good: hard to clone, fast at a turnstile, and they work with a reader estate you may already own. Where they struggle is everything around the edge of a fixed site. A subcontractor arriving for one day needs a card issued and later collected. A remote location, a temporary compound or a customer site has no reader. And a card proves the card was present, which is not quite the same as proving the person was.

VCode’s contribution is that entitlement is evaluated centrally at the moment of the scan, so a credential can expire, be restricted to a location, or be withdrawn without anyone recovering a physical object.

What it changes commercially

• Leavers stop being a liability. Revocation is immediate and does not depend on collecting anything.
• Contractor compliance becomes enforceable. A credential that expires with the certificate is checked every time it is used.
• You know who is on site. In real time, across employers, which matters most in the hour you least want to be guessing.
• Attendance stops being self-reported. A scan tied to a location beats a signature on a sheet.

Integration

Codes are minted per person or per location through the platform API from your existing HR, contractor management or access system, and rules are attached per credential. Scanning runs through your own application using the SDK, so a supervisor uses your app rather than a separate tool. Scan history provides the register and the audit trail. See the developer documentation.