How a mark carries its own proof.
A Gamutlock mark is a JABCode, a 2D symbology standardised as ISO/IEC 23634. The issuer’s claim and its signature are encoded in the symbol itself, so the check needs the mark and a Reader, and nothing else.
JABCode encodes in 4 to 256 colours. More colours fit more data into the same printed area; fewer colours read more reliably in poor light.
Seven real renders, one per colour mode — the same ladder the composer offers. ISO/IEC 23634 makes 4 and 8 colours normative; 16 through 256 are reserved for closed applications, where issuer and reader are both yours. The white margin is the quiet zone; it is part of the symbol.
Every module is payload. Design lives at the edge.
Colour modules
Each square cell carries 2 to 8 bits depending on the colour mode — 4-colour through 256-colour. More bits per cell means a signed payload fits at a printable size.
Docked symbols
A payload too big for one symbol cascades into neighbours that share an edge — a primary plus secondaries, read as one code. Shape follows the label, not the other way round.
Error correction
Ten LDPC levels trade capacity for survivability, set per symbol. A scuffed or half-lit code still reads; the composer shows the trade as you move the slider.
Sizes come in steps. A code is a square grid of cells, and the grid comes in fixed sizes — the smallest is 21 cells across, the largest 145. When codes sit side by side they share a full edge, which means everything in a column is the same width and everything in a row the same height. The composer only lets you build shapes the encoder will actually accept, so nothing you design there can be refused when you go to print it.
How close the phone has to be. A camera needs to see each cell clearly enough to tell its colour apart from its neighbours. Print the cells bigger and the code reads from further away; ask for more colours and you leave less room for error. The composer scores this for you while you design, not after the label is printed.
Two reading modes. The Reader has an everyday setting and a rough-conditions setting. The everyday one uses the full colour range. The rough one drops to four colours and spends more of the code on error correction, for glare, curved packaging and bad light. The composer offers the same two choices when you issue, so what you print matches the conditions your product actually sits in.
One rule you cannot bend. Never restyle the cells — no rounded corners, no tinting, no logo dropped in the middle. Every cell is part of the message, so editing one is editing the data. Branding goes around the code: the frame, the caption, the label it sits on.
Built in a security lab, standardised in the open.
JABCode — “Just Another Bar Code” — was developed at the Fraunhofer Institute for Secure Information Technology (Fraunhofer SIT) in Darmstadt, Germany. It came out of security research, not marketing: the goal was a printable symbol dense enough to carry cryptographic material, published as an open specification with an open-source reference codec.
Fraunhofer SIT designed the symbology around colour: more bits per module, enough headroom for signed payloads. The codec is released as open source, with a public generator at jabcode.org.
The symbology is standardised as ISO/IEC 23634. Anyone can implement an encoder or decoder from the spec — no licence gate, no proprietary reader.
Gamutlock builds on that foundation: the open codec carries the bytes; our layer defines what the bytes prove — signatures, sealed layers, holder binding, revocation, and the verdict the Reader shows at the glass.
Signed. Sealed. Bound.
Three things a mark can carry. Each works on its own, and they stack. The same three words are the pricing ladder.
Signed
The mark says who issued it, and it can’t be made to say anything else.
At issue, the payload is signed with the tenant’s issuer key. The Reader checks that signature against a trust list it already holds, so a verdict needs no network. Each tenant’s signing keys are their own, non-extractable, held in AWS KMS. Signing needs provisioning, and the product says so by name.
Sealed
Parts of the mark open only for the people you choose. Everyone else can see that a sealed part is there, and nothing inside it.
A sealed layer is encrypted under a rule written as attributes, using ciphertext-policy attribute-based encryption (CP-ABE). A holder key opens the layer only if its attributes satisfy the rule, and the check needs no server. One mark can carry several sealed layers, each under its own rule, so different readers open different parts. Opening a layer is separate from verifying the mark and never changes the verdict. Seal from the first minute, with no provisioning.
Bound
The mark belongs to one holder, and the Reader checks it’s in their hands.
A bound mark names a holder key kept in a phone’s hardware keystore. The Reader asks that device to prove it holds the key. If it can’t, the verdict is Unproven: the issuer’s signature is good, and what is not proven is that this mark is with the holder it was issued to. Unproven is never a pass.
A QR code can only say go here.
That’s why “don’t scan” is the only defence a QR code leaves you. The trust decision happens after you arrive, on a page you had no way to check. A mark that carries its own claim moves the check to before you go anywhere. QR is superb at what it does; it carries reach, not trust.
| A QR code | A Gamutlock mark |
|---|
They profile the person. We prove the thing.
Two surfaces, one discipline.
Gamutlock Studio is where issuers compose, issue and see what their marks did. Gamutlock Reader is where the proof is read — and where a holder’s key opens what it’s entitled to. Between them, only marks and signatures move.
Studio — the issuer’s side
Compose. Three independent axes — payload (what it says), trust (sign, seal, bind), carrier (how it renders). The projected verdict shows what the Reader will say before anything is issued.
Issue. The payload is signed and encoded. Once issued it is fixed — a self-proving code cannot be edited, only revoked.
See what happened. Verification events and their verdicts — which code, which outcome, when. Never who.
Decide who gets a key. Enrolments wait for your decision. Nothing is minted until you vet it, and you name what each key opens.
Reader — the holder’s side
Verify, offline. The camera decodes the mark and checks its signature against a trust list the phone already holds. A verdict at the glass, with no network.
Fail closed. Absence of proof is never a pass. A stale trust list says so; an unknown issuer reads untrusted; a broken frame reads tampered.
Open what your key allows. Sealed layers open for a key whose attributes satisfy their rule. The rest stay locked, and say why.
Events, not people. No location, no device identifier and no contact detail leaves the phone. The issuer sees events, not people.
Keys cross an air gap, and that is the point.
A holder key is issued to one device, after the issuer decides. No server holds the secret. The exchange needs no shared network — the two sides can show each other barcodes.
Nothing secret ever crosses the gap — the request is public, the delivery only works on the device that asked.
Either direction can travel as text or as a symbol. Same checks either way.