QR payloads should carry references, not PII

A visitor pass is a URL or a reference, not a container for personal data. Anyone who photographs a QR code should learn nothing about the person carrying it.

Two kinds of code

A visit pass is single-journey and expires after exit. A permanent profile code resolves to the visitor and their latest active visit. Both carry only a reference that the server resolves.

Revocation is server-side

Because the code carries no identity data, revoking a pass is a database decision. A stale or cancelled pass is rejected at the gate even if its QR image still exists.

SMS follows the same rule

The SMS body contains a link and a reference, never a name or ID number. The link is purpose-separated and grants no permissions beyond opening the profile.