Interactive demo

SHT 04 Module IDW-CM-01 · Credential Management - specification

Cards to mobile. Printed to provisioned.

Credential lifecycle from enrolment through revocation. DESFire, mobile wallet, FIDO2 - one issuer, every form factor.

Watch it run Back to solutions

01 Capabilities

Every credential. One lifecycle.

DESFire

DESFire encoding

MIFARE DESFire EV3 secure element issuance with AES-128 keysets and printer integration. Zebra, Evolis, Magicard - day-one ready workflow.

Mobile

Mobile wallet

Apple Wallet and Google Wallet credentials. Provision, rotate, revoke remotely. No app required.

Lost card

Lost card workflow

Block, replace, audit - in a single self-service flow. Revocation propagates in seconds.

Expiry

Expiry & renewal

Automatic renewal reminders. Contractor credentials that self-destruct on schedule. Nothing lingers.

FIDO2

FIDO2 / passkey

Logical credential issuance for SSO and privileged access. One identity, physical and digital.

Print

Card print & encode

Centralised or branch-office issuance. Photo capture, template engine, batch print queues.

02 Throughput

Built for scale.

Print-encode-issue / per credential < 90 s
Credential form factors / out of the box 12+
Revoke to denial / at the reader < 3 s
Audit lineage / issue to revoke 100%
Certifications ISO 9001
ISO/IEC 27001
TISAX (DEKRA-certified)
GDPR / NIS2 / DORA support
< 90 s
Print startCredential issued

03 Form factors

Every shape, one lifecycle.

MIFARE DESFire HID SEOS LEGIC advant Apple Wallet Google Wallet FIDO2 Passkeys Smart cards QR / barcode BLE tokens NFC tags PIN + biometric
Product names and marks are property of their respective owners - identification only

04 Lifecycle proof

Issue to decommission, drawn to scale.

Scroll one credential through its whole life - enrolled, encoded, provisioned, active, rotated - then revoked the moment a leaver hands the badge back.

  1. Step 01

    Enrolled

    The identity is verified and a compliant photo captured. The credential record is created against the golden identity - one issuer, every form factor from here.

    Photo captureGolden recordTemplate engine
  2. Step 02

    Encoded

    A MIFARE DESFire EV3 secure element is written with AES-128 keysets and the card is printed - bureau or on-site. Print-encode-issue in under 90 seconds.

    DESFire EV3AES-128Zebra · Evolis · Magicard
  3. Step 03

    Provisioned

    Mobile wallet credentials are pushed to Apple Wallet and Google Wallet, and a FIDO2 passkey is registered for SSO. No app required.

    Apple WalletGoogle WalletFIDO2 / passkey
  4. Step 04

    Active

    The credential is live at every reader and every app - one identity, physical and digital. A lost card is blocked and replaced in a single self-service flow.

    Every readerSSO & appsLost-card workflow
  5. Step 05

    Rotated

    Keys and credentials rotate on schedule. Contractor credentials self-destruct on their expiry date, and automatic renewal reminders mean nothing lingers.

    Key rotationAuto-expiryRenewal reminders
  6. Step 06

    Revoked

    A leaver hands the badge back. The wallet pass, the passkey and the QR fallback are killed together - denial at the reader in under 3 seconds, every event signed.

    Wallet passPasskeyQR fallback

05 Related sheets

Continue the drawing set.

SHT 02 PIAM Suite Full identity platform - the broker between HR and the door. SHT 03 Access Management Every door, every policy. Policy in one place, enforcement everywhere. SHT 05 Visitor Management Lobby to exit. Kiosk check-in to credential hand-back. SHT 06 Cards & Credentials The badge is a secret. Stock, personalisation, migration.

See it run.

Watch a credential provisioned, revoked, and replaced - card and mobile - in one scenario.

Launch interactive demo Read the migration playbook