// INSIGHTS
Automated Guest Verification for a Closed Corporate Townhall
6 min read
A listed company runs a quarterly townhall in a hotel ballroom. Twelve hundred employees, one 45-minute arrival window, and a results announcement that must not leak. The requirement is not speed for its own sake. It is that nobody enters who is not on the roster, that the roster is current as of that morning, and that the queue does not spill into a public hotel lobby. Manual list-checking at six desks does none of these things reliably.
The problem with a printed list
A printed attendee list has three defects at this scale. It is stale the moment it is printed, so the employee who resigned on Friday is still on it. It cannot be revoked, so a leaked page is a permanent liability. And verification against it is a human name-matching task, which in a mixed-script Indian roster with initials, suffixes and transliteration variants takes 20 to 40 seconds per guest and produces errors that the desk staff will resolve in favour of letting people through.
The alternative is a cryptographically signed credential. At registration, each employee receives a QR code carrying a small payload signed with an Ed25519 key. The scanner verifies the signature locally in a few milliseconds, with no network round trip. A forged or edited QR fails the signature check. A revoked credential fails against a revocation list that syncs every few seconds when the network is up and holds its last state when it is not.
Face verification is offered as an optional second lane, not a requirement. Where an employee opts in, verification against their enrolled template completes in under a second with liveness checks that reject a photo held up to the camera. Employees who decline use the QR lane and are not made to wait longer for the choice. That equal-speed rule matters more than any accuracy figure, because a slow fallback lane is a coerced consent mechanism wearing a polite face.
A representative arrival profile
What sits behind each desk
Signed, revocable credentials
Ed25519-signed QR codes verify offline in milliseconds. A single API call revokes a credential and every scanner reflects it within seconds of reconnecting.
Opt-in face lane with liveness
Passive presentation attack detection rejects printed photos and screen replays. Enrolment is explicit, in the employee's own language, and reversible.
Offline-first scanners
Hotel wifi fails. Scanners hold the full credential set and revocation state locally and reconcile on reconnect, so a network drop never stops the door.
Live attendance by business unit
Organisers see who has arrived, by department and location, without walking the floor. Useful for deciding when to start and for post-event follow-up.
Running the day
Roster import and cleanup
We sync from the HRMS rather than a spreadsheet, ideally the morning of the event. Duplicates, exits and name variants are resolved before credentials are issued.
Credential distribution
QR codes go out by email and internal messaging 24 to 48 hours ahead, with a printable version for employees who prefer paper. Face enrolment, if offered, opens at the same time.
Desk briefing and exception protocol
Staff are briefed on exactly one thing: what to do when verification fails. The exception desk has a named approver and every override is logged with a reason.
Reconcile and purge
After the event we produce the attendance record and delete what was only needed for the door. Retention periods are agreed in writing before enrolment opens.
What usually goes wrong
Roster hygiene causes more failures than technology. Contractors are missing from the HR system. Plus-ones were approved over WhatsApp. A senior leader brings two guests who were never registered and will not be turned away. Design for this. A fast, well-staffed exception desk with a written approval rule is not an admission of failure, it is the part of the system that keeps the main lanes moving. Physical conditions cause the rest. Direct sunlight through a hotel entrance destroys both QR scanning and face capture. Tablets on stands get knocked. We specify lane positions and lighting during the site visit for this reason.
On biometrics, be candid with your own staff. Face recognition error rates are not uniform across demographics. Published evaluations consistently show higher false rejection for some groups depending on skin tone, age and gender, and the effect is worse in poor lighting. That is a reason to design the fallback as a first-class path, not a punishment. There is also a consent problem specific to employment. When an employer asks, refusal has a social cost, so consent is never fully free. Our position is that a corporate townhall does not need biometrics at all. A signed QR is sufficient for the actual threat model. If a client wants face verification anyway, we require a written purpose, a retention limit, an explicit DPDP notice in the languages employees actually read, and a fallback that is genuinely no slower.
Common questions
Do you store employees' face images?
By default we store a mathematical template, not a photograph, and the template is not reversible into a usable image. Where a client insists on retaining images we require a documented purpose and a retention date. In most townhall deployments no biometric data needs to be retained after the event at all.
What if someone's phone battery dies at the door?
The exception desk verifies identity against the roster using an employee ID and reissues a credential in under a minute. This is a planned path, not an emergency. We size the exception desk for 3 to 5 percent of expected attendance.
Can this work if the hotel wifi goes down?
Yes. Signature verification is local and requires no network. Scanners hold the credential and revocation state on device and sync when connectivity returns. The only degraded function during an outage is the live arrival dashboard, which catches up on reconnect.
Design the door before you design the deck
Tell us your headcount, arrival window and confidentiality requirement and we will size the lanes and the exception path.
