We secure the critical moment at the doorstep by answering three fundamental questions with mathematical certainty.
For sensitive deliveries like opioids, oxygen, or evidence, knowing "someone" received it isn't enough. VerifiedKnock creates a cryptographic link between the sender, the courier, and the verified recipient.
Pharmacy or Agency initiates delivery. Package ID is cryptographically bound to the specific recipient's profile.
Courier scans badge at door. VerifiedKnock confirms identity and authorizes the specific package release.
Recipient confirms via app. Digital signature proves exactly WHO received the item and WHEN.
"We know WHO is at the door."
"We confirm they are AT THE DOOR."
The VerifiedKnock proximity geofence is registered to the homeowner's address. Every time an authorized professional enters the geofence, the homeowner receives a cryptographic notification through their app — showing the agency, dispatch reference, and verified timestamp. Physical presence within the registered geofence is the only way to trigger a verification. An optional NFC door tag is available for properties that prefer physical tap confirmation.
"We know WHO AUTHORIZED them to be there."
Every credential issued by VerifiedKnock is cryptographically bound to the issuing agency's jurisdiction. A Canadian agency's card cannot verify in the United States — and vice versa.
Jurisdiction validation happens on-card during the NFC tap — no internet connection required. Even in a fully offline environment, a cross-border credential is rejected at the hardware level.
VerifiedKnock supports two deployment modes. The cryptographic verification is always offline. What changes is how the verified result is delivered to the resident.
The officer's FIDO2 credential performs biometric authentication entirely on the hardware chip — no internet needed for the cryptographic verification step. Smart home proximity detection triggers the challenge automatically when the officer arrives. However, delivering the verified result to the resident's phone as a push notification requires a data connection on the officer's device.
The resident's smart doorbell or home hub detects the officer approaching and sends a proximity event to the VerifiedKnock API. A cryptographic challenge is pushed to the officer's smartphone. The officer authenticates with ATKey.Card (NFC), ATKey.Pro (USB-C), or BLE K33 (phone-free) — private key never leaves the card. The VerifiedKnock API then signals any connected smart display in the home — showing VERIFIED in green instantly. No proprietary hardware at the door. No phone required by the resident.
Enter any address and adjust the geofence radius to match your property. Click Dispatch Officer to watch the full automated verification flow — no homeowner action required.
See how VerifiedKnock triggers verification on arrival
Awaiting dispatch
Officer status
Officer Dispatched
Assignment pushed to device
Approaching Property
Backend monitoring active
Geofence Entered
Challenge auto-generated
FIDO2 Key Tapped
Cryptographic signature verified
Resident Notified
Identity confirmed — timer started
The API is a delivery pipe. The trust anchor is hardware. Here is exactly what an attacker can and cannot do — and why the cryptographic core cannot be compromised through the network.
VerifiedKnock separates two things most systems conflate: the notification channel (the API) and the identity proof (the FIDO2 assertion). An attacker who compromises the API gains access to the delivery pipe — not the proof.
Private key never leaves hardware
The FIDO2 private key is generated on the card's secure element (Common Criteria EAL6+) and cannot be extracted — not by software, not by the server, not by the officer themselves.
One-time nonce per event
Every verification uses a fresh cryptographic nonce generated by the backend. A captured or replayed assertion is mathematically invalid — it is bound to a single challenge that expires immediately.
Biometric match on card, not server
The fingerprint is matched entirely inside the card's secure element. No biometric data is transmitted, stored, or accessible to any party outside the hardware device.
Signed audit log is tamper-evident
Every verification event produces a cryptographically signed log entry stored server-side. Retroactive forgery requires breaking the signing key — computationally infeasible.
Replay attack
BlockedStale nonce rejected by backend. Each assertion is cryptographically bound to a single challenge.
API key theft
Insufficient aloneA stolen API key cannot produce a valid FIDO2 assertion. No assertion = no resident notification sent.
Man-in-the-middle
BlockedTLS 1.3 in transit. The assertion itself is bound to the specific challenge — intercepting and replaying against a new session is infeasible.
Denial of Service (flood API)
Notification suppressed onlyAttacker can prevent a notification from reaching the resident. Resident does not open the door without a verified signal — attacker gains nothing.
Compromised resident device
Display only — proof is server-sideThe notification is informational. The cryptographic proof lives in the server-side audit log, not on the device.
Rogue VerifiedAmbient™ integration
BlockedThe API requires a signed JWT scoped to a specific address and event ID. A rogue integration cannot generate a valid JWT without the backend signing key.
VerifiedKnock uses the same cryptographic foundation trusted by US federal employees, financial institutions, and NIST-certified systems. The API is a delivery pipe — the trust anchor is hardware. Compromising the pipe does not compromise the proof.
VerifiedKnock provides the only access control system designed specifically for the high-stakes requirements of law enforcement and critical infrastructure.
Contact Sales