QID Secure
Return Back Home

Platform

QID Secure is a self-hosted visitor management platform for sites that mostly see Qatar ID holders, with passports and occasional other documents. One visitor record, one audited journey, on web, Android, iOS and Windows desktop.

Registration & arrival

A visitor scans the site QR at the entrance and starts registration on their own phone. There is no app to install and no shared terminal. The form collects the visitor's name, nationality, ID number, phone, purpose and host, and issues a unique visit reference in the form VIS-YYYY-NNNNNN plus a permanent visitor code V-XXXXXX.

  • Works on the web PWA and the React Native apps against the same API.
  • Camera capture with a file-upload fallback on every device.
  • Required-field validation before a visit can be submitted.

ID capture & extraction

Each visit captures the front and back of the Qatar ID, or the passport photo page. A vision model returns a per-document schema; the API validates passport MRZ check digits and falls back to local Tesseract when the online model is unavailable. Extraction never approves a visit on its own.

  • Fields arrive with a confidence score, and the visitor must confirm or correct them.
  • Document type is auto-detected: Qatar ID, passport, or another licence/permit/ID.
  • Multiple pages are cropped on the device, combined and uploaded together; the original is retained for audit.

Review, approvals & passes

The visit starts in pending. A security supervisor sees the ID images, the extracted values, the confirmed values and the visit context, then approves, rejects or returns the visit with remarks. Approval generates a single-journey QR pass; reprints and reissues are controlled and audited.

  • Status lifecycle: pending → approved → inside → exited, with rejected and cancelled branches.
  • Every transition stores the actor, device and timestamp.
  • QR payloads carry references only — never names, ID numbers or phone numbers.

Entry, exit & reusable cards

Gate operators verify identity in four ways: visit-pass QR, permanent profile QR, Qatar ID re-scan, or manual card/ID lookup. Entry and exit use the same methods, and the platform blocks double-entry, exit without entry and reuse of stale passes.

  • RFID cards C-001… move between available, assigned, lost and disabled.
  • Cards release automatically on exit; long-term employee cards keep their assignment.
  • Live headcount, expected exit time and recent activity on the gate dashboard.

Offline-first operation

The primary deployment is a mini-PC on the site LAN. Tablets and phones talk to the web gateway over local Wi-Fi, so an internet outage does not stop check-in or gate verification. SMS and cloud OCR queue until connectivity returns; local OCR takes over immediately.

  • PWA service worker caches the shell; check-in and check-out queue on the device when the API is unreachable.
  • A visible LOCAL MODE banner shows the pending queue.
  • No external service is required for the core visitor journey.

Roles & permissions

Access is role-based on every route: admin, supervisor, operator, optional host, and read-only auditor. Operators and hosts see masked ID numbers; full identity data is limited to elevated roles. Hosts never get exact-ID search.

Reporting & audit

The dashboard reports who is inside now, pending approvals, approved today, completed visits, and rejected or cancelled visits. Search runs across date, status, user, pass or visitor code, phone and ID number, with CSV export for operations. The audit trail is append-only: there are no edit or delete endpoints for history.

Documentation & API

The REST API is versioned under /api and uses short-lived JWT access tokens with refresh. The shared API client is used by web, mobile and desktop, so every client follows the same contract. Interactive API documentation can be published from the admin area.

Deferred by design

Some capabilities are intentionally out of scope for the first release: NFC chip reading, passport chip reading, automatic Arabic-to-English translation, BI analytics, Keycloak SSO and central multi-site sync. The data model keeps room for multi-site scoping from day one.