/* global React, AX */ /* ---- NAV ---- */ function SecurityNav() { return (
Back
See venue features
); } /* ---- HERO ---- */ function SecurityHero() { return (
); } /* ---- HOW IT WORKS ---- */ function SecurityHow() { const steps = [ { num:"01", title:"Ticket is purchased", body:"When a guest buys a ticket, the Axxess backend generates a unique JSON Web Token signed with the event's private key. The token encodes ticket type, event ID, guest name, and a unique nonce.", }, { num:"02", title:"QR code is delivered", body:"The signed JWT is embedded in a QR code delivered to the guest's Axxess wallet. The private key never leaves the server — the QR is the signed payload only.", }, { num:"03", title:"Scanner verifies the signature", body:"At the door, Axxess Ops verifies the signature using the event's public key — which is pre-loaded on each scanner device at door-open time. No network call required.", }, { num:"04", title:"Ticket is permanently marked", body:"Once valid, the scan is committed to the local device log and synced to the server when connectivity returns. Any re-scan of the same token triggers an instant duplicate alert.", }, ]; return (
How it works

From purchase to door scan.

A cryptographically signed ticket is tamper-proof by design. Here's the full chain.

{steps.map((s,i) => (
{s.num}

{s.title}

{s.body}

))}
); } /* ---- PILLARS ---- */ function SecurityPillars() { const pillars = [ { title:"Offline validation", body:"The event's public key is pushed to every scanner at door-open. Signatures verify locally — no API call, no network dependency. Your door works even if the internet goes down mid-event.", detail:"JWT RS256 · Public key pre-loaded at event start · Works indefinitely offline", icon:( ), }, { title:"Duplicate blocking", body:"Each token has a unique nonce. Once scanned, it's marked in the local scan log and synced when connectivity returns. Any second attempt — same device or different — triggers an immediate rejection.", detail:"Per-token nonce · Local log + cloud sync · Cross-device dedup", icon:( ), }, { title:"Full audit trail", body:"Every scan is logged with: timestamp, scanner device ID, staff account, event ID, and outcome. The log is immutable once written. Your venue has a complete record of every door event.", detail:"Immutable event log · Per-staff attribution · Exportable report", icon:( ), }, ]; return (
Three guarantees

A ticket is valid, used, or fake. Nothing in between.

{pillars.map(({ title, body, detail, icon },i) => (
{icon}

{title}

{body}

{detail}

))}
); } /* ---- THREAT TABLE ---- */ function SecurityThreats() { const threats = [ { threat:"Screenshot re-entry", how:"Duplicate detection catches re-scan of identical token" }, { threat:"Printed PDF fake", how:"Signature verification fails — payload doesn't match known event key" }, { threat:"Edited QR code", how:"Any payload modification invalidates the cryptographic signature" }, { threat:"Resold ticket (used)", how:"Already-scanned tokens are rejected immediately at door" }, { threat:"Wrong-event ticket", how:"Event ID in token is verified against current event context" }, { threat:"Offline attack", how:"Public key cannot forge new valid tokens — only server's private key can sign" }, ]; return (
Attack surface

Common fraud vectors, and why they fail.

{threats.map(({ threat, how },i) => (
{how}
))}
); } /* ---- CTA ---- */ function SecurityCTA() { return (
); } window.AX = Object.assign(window.AX||{}, { SecurityNav, SecurityHero, SecurityHow, SecurityPillars, SecurityThreats, SecurityCTA, });