Verify the record behind a letter.

The correspondence workflow in practice.

The code may confirm that an Epistles-issued record exists and has not been revoked. Stronger file-integrity verification requires comparing the actual digital file against a stored fingerprint or validating a digital signature. A printed photograph of a QR code alone does not establish that the surrounding paper was not altered.

Privacy is fundamental. A stranger who scans a QR code should not see a private claim, a recipient address or an unredacted attachment. The interface should show only information that is explicitly approved for public verification.

Imagine receiving a document with a credible logo and a QR code. The sensible next step is not to assume authenticity because the code opens a page with a green tick. A meaningful verification result must show the official host and explain whether it found an issued record, matched an uploaded digital file, or validated a cryptographic signature. Those checks have different strengths. If the document contains a claim about money, legal rights or identity, the recipient should still assess the sender and the circumstances rather than treating a printed code as a universal guarantee.

Epistles should handle invalid and revoked tokens with equally careful language. An expired link, a copied code and a record deliberately withdrawn are not identical events. The public interface can say that a record could not be verified without announcing confidential information about a customer. Automated requests should be rate-limited, and public URLs should avoid exposing sequential identifiers. The verification service will also need accessible instructions for people using screen readers or devices that cannot scan a QR code.