> ## Documentation Index
> Fetch the complete documentation index at: https://docs.satyakod.com/llms.txt
> Use this file to discover all available pages before exploring further.

# How verification works

> Signed serials, the four checks every scan goes through, and what each verdict means.

Every code carries a **signed serial**: 16 characters that encode the batch, the item's place in
it and a signature made with your workspace's key. The key is kept encrypted by Satyakod, or with
the AWS KMS add-on in AWS Key Management Service, where it never leaves
([Key protection](https://docs.satyakod.com/guides/security-and-sso.md#key-protection)); either way nobody else can make a
serial that passes. See [Serial numbers](https://docs.satyakod.com/concepts/serial-numbers.md) for the exact format.

## The checks

Each scan checked by Satyakod goes through four checks, in order:

| Check | Passes when |
| - | - |
| **Signature** | The serial decodes and its signature matches your key |
| **Serial status** | The batch exists, the serial is inside it, and it hasn't been revoked |
| **Clone pattern** | The same serial hasn't been scanned far away within a few hours (by default more than 50 km within 6 hours, set in the [Clone pattern rule](https://docs.satyakod.com/guides/alerts.md#how-alerts-open)) |
| **Region** | The scan is inside the batch's authorised sale regions, when they are set |

## Verdicts

| Verdict | Means |
| - | - |
| **Genuine** | All checks passed |
| **Suspicious** | Genuine, but scanned outside its authorised region: a grey-market sign |
| **Counterfeit** | The signature, serial status or clone check failed |

Suspicious and counterfeit scans open [alerts](https://docs.satyakod.com/guides/alert-outcomes.md) by your alert rules and
can be sent to your systems as `scan.flagged` [webhooks](https://docs.satyakod.com/integrations/webhooks.md).

## Where the checks run

Online checks run on Satyakod's servers when a code is scanned: that is what makes clone and
region checks possible, since they compare a scan with the scans before it. Codes can also be
[checked offline](https://docs.satyakod.com/concepts/verification-modes.md) by your own systems, which can confirm the
signature and the serial range without internet; clone and region checks then happen when those
scans are [uploaded](https://docs.satyakod.com/api-reference/verify-offline.md).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.