Route 117 of 176
Private QR Identity Data
QRCompliance.us · Validation Layer · Source of truth: QRCodex.us
Summary
Every registered QR identity carries more information than a scan ever shows. A public scan returns a narrow, deliberately limited answer — valid or not, certified or not — while a much larger body of data sits behind it: who submitted evidence, what internal notes an evaluator recorded, which contact details belong to the responsible company, and what history led to the identity's current condition. This route defines that private layer, the line that separates it from what a scan discloses, and the rule that access to it depends on who is asking, not on the act of scanning itself.
A scan is not a request for the file behind the code. Private QR identity data stays private by default, and QRCompliance.us confirms whether a stated condition is satisfied without exposing the underlying record that produced that answer.
A QR code, on its face, discloses almost nothing. Scan one attached to a registered identity and, depending on the route, you get a status word, a certification badge, or a routed destination — never the internal record that sits behind that answer. That gap between what a scan shows and what actually exists in the identity's record is not an oversight; it is the deliberate boundary this route defines.
Private QR identity data is the set of fields that make up a registered identity's full record but are never returned to a general scan: the evidence submitted to support a determination, the internal notes an evaluator attached while reaching it, the direct contact and ownership details of the responsible company, and the history of prior conditions the identity has held. None of it is secret in the sense of being unreviewable — it is reviewable by the parties entitled to review it. It is private in the narrower and more precise sense that a scan does not unlock it.
The reason this distinction matters is that a QR code is, by design, something almost anyone can scan. A retail customer, a competitor, a curious stranger and a regulator can all point a camera at the same code and trigger the same lookup. If that lookup returned the full record every time, the system would have no way to keep sensitive operational, contractual and evaluative detail out of hands that have no legitimate claim to see it. Private data classification is what keeps a universally scannable code from becoming a universally readable file.
01Plain-English Definition
Private QR identity data is the portion of a registered identity's record — evidence, internal notes, ownership and contact detail, and condition history — that exists within the system but is withheld from a general scan and disclosed only to a viewer holding a recognized authorization to see it.
The classification applies at the field level, not the identity level. A single registered identity has some fields that are public by design — a status, a category, sometimes a destination — sitting alongside private fields that are never part of a scan response regardless of who performs the scan.
This route defines what falls into the private category and the principle that governs disclosure. It does not define the specific roles permitted to view private data — that is addressed by the routes governing role-based access and operator permissions — nor does it define what a scan is permitted to show, which is the mirror question addressed elsewhere.
02What Counts As Private
Not every field attached to a registered identity carries the same sensitivity, and the classification reflects that difference rather than treating the whole record as one undifferentiated block.
- Evidence submitted to support a determination — inspection reports, certificates, corrective action documentation — which was provided for evaluation, not for public disclosure.
- Internal evaluator notes recorded during a review, including reasoning that has not been converted into a published status.
- Direct contact detail for the responsible company or operator — names, addresses, phone numbers and internal reference codes that are not needed to answer a scan.
- The identity's condition history, including prior revocations, lockouts or corrective states that have since been resolved.
- Any commercial or contractual detail referenced during registration that has no bearing on the current public status.
A field's classification is not permanent by accident of where it happens to sit in the record; it is assigned deliberately, and a field only moves from private to public if a defined rule says it should — never because a scan simply asked for more than the minimum.
03Why It Stays Private
The practical value of this boundary is that it lets the same publicly scannable code serve two audiences at once without compromising either.
Protects the responsible company
Contact detail, internal notes and commercial context stay out of reach of competitors, opportunistic actors and anyone else who scans without a legitimate need to see them.
Protects the integrity of evaluation
Evidence and internal reasoning stay shielded from parties who might otherwise attempt to reverse-engineer or contest an evaluation using detail never meant to be public.
Preserves scan simplicity
A general scanner gets a clear, minimal answer instead of a record they cannot interpret and were never meant to receive.
Enables narrower disclosure later
Because private fields are already classified, releasing a specific piece of evidence to a specific party — a regulator during an inquiry, for instance — is a defined action rather than an improvised one.
04Operational Flow
The classification is applied at the point a record is assembled and enforced at the point a request for data arrives, whether that request is a public scan or an authorized lookup.
- 1Record is assembledAs an identity is registered and evaluated, fields accumulate — some destined for public disclosure, most not.
- 2Fields are classifiedEach field is marked public or private according to defined rules, not left to the judgment of whoever happens to enter it.
- 3A scan arrivesA general scan of the identity's code triggers a lookup that returns only the fields classified public.
- 4An authorized request arrives separatelyA viewer with recognized authorization requests the fuller record through a distinct access path, not through the scan itself.
- 5Access is granted according to roleWhat that viewer actually receives depends on their specific role and permission level, and the request is logged regardless of outcome.
A scan and an authorized data request are two different actions with two different outcomes, even when they concern the exact same identity.
05Public Versus Private In Practice
The distinction is easiest to see side by side, comparing what a general scan actually returns against what sits in the private layer beneath it.
| Aspect | Returned To A General Scan | Held As Private Data |
|---|---|---|
| Current status | Valid, revoked, locked-out or under-review as a public flag | The specific evidence and internal reasoning behind that flag |
| Certification | Whether a certification is currently active | Certificate correspondence, audit notes and renewal history |
| Ownership | Little or nothing about the responsible company beyond what is required | Direct contact detail, internal codes and commercial context |
| History | Generally nothing about prior states | The full sequence of prior conditions the identity has held |
| Routing | A destination or routing outcome where applicable | The rules and criteria that produced that routing decision |
This table describes the general pattern; specific fields vary by identity type and by the route governing what a particular scan is designed to show. The pattern itself does not vary: a scan answers a narrow question, and everything that produced that answer stays behind it by default.
06Handling Disclosure Requests
Occasionally a party with no standing role still has a legitimate reason to see private data — a legal inquiry, an incident investigation, a dispute over a determination. These situations are handled as exceptions, not as a redefinition of what counts as private.
| State | Entered When | Left When |
|---|---|---|
| Routine Access | An already-authorized role requests data within the scope its permissions already cover. | Access is granted per standard permission rules and logged; no exception process is needed. |
| Exceptional Disclosure Request | A party without a standing role submits a specific request for private data tied to a defined need, such as a legal or regulatory inquiry. | The request is evaluated on its own terms and either granted with a scoped, logged disclosure or declined. |
| Denied Or Unscoped Request | A request is made without a recognized authorization basis or asks for more than the stated need justifies. | The request is declined, or narrowed to only the data the stated need actually supports. |
07System Relationship
System Chain — Six Locked Entities
- 1QuickResponseCode.usRoot / System EntryPublic entry point to the QR infrastructure.
- 2QRProtocol.usGovernance (Rules)Writes and governs the applicable rules.
- 3QRCompliance.usValidationValidates compliance readiness against applicable rules and conditions.
- 4QRCertified.usCertification AuthorityAuthorizes the QR for certification.
- 5QRRegistered.usRegistration ResultMandatorily registers the authorized QR.
- 6QRCodex.usOperations / RecordsRecords, operates, logs and preserves canonical operational truth.
No registration → no certified QR output.
Private QR identity data sits underneath every layer's public-facing output, and each layer treats the boundary between what it discloses and what it withholds as a fixed constraint rather than a discretionary choice.
| Layer | Relationship To Private QR Identity Data |
|---|---|
| ROOT — QuickResponseCode.us | Establishes the identity that private data attaches to, without itself holding or classifying that data. |
| GOVERNANCE — QRProtocol.us | Defines the rules for which categories of field are treated as private across the whole system. |
| VALIDATION — QRCompliance.us | Uses private evidence and notes internally to reach a determination, and returns only the public conclusion to a general scan. |
| AUTHORIZATION — QRCertified.us | Keeps certification correspondence and audit detail private while publishing only the current certification state. |
| REGISTRATION — QRRegistered.us | Holds the registered identity's private record — ownership, contact and history — as the primary custodian of that data. |
| OPERATIONS — QRCodex.us | Retains the full private record permanently, including every prior classification and disclosure, as the canonical source Codex governs. |
Where a public-facing summary and the private record held by Codex appear to disagree, Codex's record governs, and the discrepancy is treated as an error to correct rather than a choice between two valid answers.
What This Does — And Does Not — Do
Does
- ✓Classify each field of a registered identity's record as public or private at the point the record is assembled
- ✓Return only publicly classified fields in response to a general scan, regardless of who performs it
- ✓Permit access to private fields only through a distinct, authorized access path separate from the scan itself
- ✓Log every request for private data, whether granted, scoped, or declined
- ✓Handle exceptional disclosure requests on their own defined terms rather than by redefining what counts as private
- ✓Preserve the private classification of resolved history, evidence and internal notes indefinitely unless a specific rule changes it
Does Not
- ✕Return evidence, internal notes, contact detail or condition history to a general scan under any circumstances
- ✕Treat a successful scan as evidence of authorization to view private data
- ✕Allow a field's classification to shift informally because a requester asked persistently or scanned repeatedly
- ✕Grant an unscoped disclosure request simply because the requester states a plausible reason
- ✕Leave private data unlogged when it is accessed through an exception process
- ✕Allow a public-facing summary to override the private record Codex holds when the two disagree
Related Routes
Common Questions
Does scanning a QR code more than once ever unlock additional data?
No. The number of times a code is scanned has no bearing on classification. Private fields remain private regardless of scan frequency or scanner identity.
Who decides whether a field is public or private?
Classification follows rules defined at the governance level and applied consistently as a record is assembled — it is not left to the discretion of whoever enters the data.
Can a company see its own private data through a scan of its own code?
A scan returns the same public fields to anyone who performs it. A company viewing its own private record does so through an authorized access path tied to its role, not through scanning.
What happens to private data after an identity is revoked?
It remains classified as private and is retained as part of the identity's condition history, available to authorized viewers but never surfaced through a general scan.
Is private QR identity data the same thing as encrypted data?
No. This route concerns disclosure rules — what is shown to whom — not the technical means of storage or transmission, which are separate matters entirely.