Mobile edge

A phone, a fingerprint reader, and a signed record.

The Android edge app is designed for real training rooms: intermittent connectivity, shared devices, USB scanners and learners who cannot afford a failed check-in.

Request the mobile brief API documentation

Architecture

Where the biometric data actually goes

The scanner talks to the phone over USB OTG. The phone talks to the platform over a signed, device-bound API. The matcher receives templates, not images, and returns a decision that is written to the audit ledger.

1

USB fingerprint scanner

ISO 19794-2 template capture and quality score
2

Android app

Hardware-backed Ed25519 key, offline queue, device flags
3

Signed mobile API

Device signature, Play Integrity, tenant scope
4

Template hash registry

Tenant-scoped SHA-256 hash and quality metrics; no raw images
5

Matcher service

Configured risk engine; simulator mode is labelled, never presented as certified
6

Audit ledger

Match decision, device, geofence and verifier outcome

Request path

POST /api/v1/mobile/match
Authorization: Bearer rr_dt_...
X-RR-Device-Id: dev_mob_...
X-RR-Timestamp: 2026-10-24T05:58:12.000Z
X-RR-Nonce: 8f2c...
X-RR-Content-SHA256: 9d1e...
X-RR-Device-Signature: ed25519:...

{
  "mode": "ONE_TO_MANY",
  "scope": { "cohortId": "coh_...", "venueId": "ven_..." },
  "probes": [
    {
      "position": "RIGHT_THUMB",
      "templateFormat": "ISO_19794_2_2005",
      "templateBase64": "...",
      "nfiq2Score": 72,
      "minutiaeCount": 44
    }
  ],
  "fusion": false
}

Signature Verified against the registered Ed25519 public key

Replay window ±120 s timestamp, five-minute nonce cache

Decision matched true/false with score and threshold

Stored Score, threshold, device, geofence, ledger hash

Not stored Fingerprint image or raw probe template

Six steps

From pairing code to verifier decision

Pair

A trainer issues a short-lived pairing code to the device. The app exchanges it for an activation challenge bound to the tenant and user.

Register

The app generates an Ed25519 key pair in hardware-backed storage. Only the public key is registered; the private key never leaves the device.

Enrol

The USB scanner captures an ISO/IEC 19794-2 template. The app submits it over the signed channel; the server stores a SHA-256 hash, NFIQ2 score, minutiae count and consent reference — never the raw template or an image.

Capture

Each check-in is signed, geofenced and flagged for clock drift or mock location. Offline batches carry a device cursor and idempotency key.

Sync

Batches sync when connectivity returns. The server records a receipt and appends the evidence to the audit chain; retries are safe.

Verify

A verifier sees the match score, threshold, device attestation and geofence outcome side by side — not a photograph.

Security controls

Designed for a shared device in a rural venue

Device identity

Ed25519 request signatures, registered public keys and single-use challenges with a five-minute TTL.

Platform integrity

Play Integrity verdict recorded against the device session; weak or failed verdicts are visible to the verifier and in live mode are rejected.

Biometric minimisation

ISO/IEC 19794-2 minutiae only. The server stores a SHA-256 template hash and quality metrics; raw fingerprint images and raw templates are never retained server-side.

Event integrity

Mock-location, rooted-device, USB-replug and clock-drift flags are recorded with the attendance event rather than silently corrected.

Offline safety

Device cursors, monotonic batch numbers and idempotency keys prevent duplicate or replayed attendance.

Remote containment

Device revoke invalidates all tokens; a wipe instruction clears the local roster, templates and cached evidence.

Contract

Mobile API surface

These routes are the v1 mobile contract, implemented under /api/v1/mobile and published in the OpenAPI document under the Mobile Device API tag.

Method	Path	Purpose
POST	/api/v1/mobile/activation/start	Redeem a single-use pairing code and register the device public key
POST	/api/v1/mobile/activation/complete	Prove possession of the Ed25519 key and receive device tokens
POST	/api/v1/mobile/auth/refresh	Rotate the refresh token and renew the device lease
GET	/api/v1/mobile/config	Thresholds, scanner allowlist, offline policy and retention
GET	/api/v1/mobile/roster	Assigned learners with consent and biometric enrolment state
POST	/api/v1/mobile/enrolments	Submit ISO 19794-2 templates; only a hash and quality metrics are stored
POST	/api/v1/mobile/match	Bounded 1:1 or scoped 1:N match with no candidate list on failure
POST	/api/v1/mobile/attendance/events	Signed, idempotent online attendance event
POST	/api/v1/mobile/sync/batches	Upload signed, hash-chained offline batches
GET	/api/v1/mobile/sync/state	Device cursor and last accepted batch receipt
POST	/api/v1/mobile/heartbeat	Device health, scanner status and queue depth
POST	/api/v1/mobile/wipe/ack	Confirm local template and roster destruction

Contract source of truth: /api/v1/openapi.json, tag Mobile Device API. Matcher mode is returned in every match response and in the audit entry; simulator results are never described as certified.

Privacy by design

Biometrics are special personal information

POPIA sections 26 and 27 restrict biometric processing. RemoteRegister is designed to collect the minimum needed for verification, record the legal basis, and make deletion technically possible.

No raw images

The scanner SDK returns a template and quality metrics. The app does not persist an image.

Purpose-bound consent

Enrolment records the privacy notice version, purpose and withdrawal state.

Tenant isolation

Template hashes and quality metrics are tenant-scoped; cross-tenant access is denied at the API layer.

Revocation and wipe

Revoking a device invalidates its tokens and queues a wipe; the local roster and templates are then destroyed on acknowledgement.

Plan the device rollout with us.

Scanner models, Android versions, offline behaviour and consent wording all matter. We will map them before a pilot starts.

Book a demo Trust Centre