1. Why Portes
1.1. Status vs Identity
Portes is a “Proof-of-Status” platform that allows you to share your status, but not your identity, to a third party to access it. Portes makes a distinction between who you are and what you are, by using the latter to grant access. This separation allows Portes to preserve your privacy by eliminating the need for Portes itself or third party services to request or require your personal details, just to prove something as simple as your age.
Portes enables secure and anonymous access to platforms:
When an account is not required, only verifications of status such as “I am”: a Human and not a bot, an Adult, a Student, the owner of exclusive access, etc.
When an account is required, to perform 2FA verifications without using email, phone numbers, SMS, or passwords.
Respectively, it also prevents access to unauthorised users, e.g., minors to access adult content or bypass controls for account creation. This is done by installing and then disabling the Portes App on their device or deactivating the verifications they might attempt to use.
1.2. What does Portes know about me?
Nothing. Portes operates without the use of usernames, passwords, emails, phone numbers, SMS, IP addresses, cookies, trackers, or any other piece of personal information. We don’t collect it, so we can’t use it.
2. How it works
2.1. Without Accounts
The Portes App performs the function of obtaining Proof-of-Status in a format we call a DIID and storing it on your device. Proof-of-Status can be obtained via a PortesCard voucher format from a local shop (PayPoint or ePay outlet in the UK) or a code provided by a trusted third party like your phone carrier, bank, employer, etc., without ever sharing any personal data to Portes. Just status. Your Proof-of Status is validated by our DIID server and deposited on your device. The Portes App has no accounts, so you don’t run security risk of passwords or personal data being compromised. We never collect any personal information nor do we store any device identifiers.
Securing the Portes App and PortesCard
You can secure the Portes App with a PIN or by using biometrics. In addition, you can also secure each individual DIID with a PIN or biometrics. You can then ensure that trusted parties can access some DIID’s on your device, while restricting access to others. For example, you can allow your kids to use the I Am Human DIID or an exclusivity DIID, but lock out the Age Verification DIID. For more information on this, see Parental Controls.
Using the Portes App with sites and apps
When you visit a site requiring Portes authentication, you’ll see a dialogue requesting you to verify your status. On a mobile device, you simply tap on this box. On a desktop device, it will present you with a code, and you simply scan the code with the Portes app.
2.1.2. Specific - Component architecture
Description of all components
The Portes platform consists of three components.
- The Portes App - converts your Proof of Status in a format we call a DIID and shares this status with third parties.
- The DIID Server - authenticates and supplies the Portes App with DIIDs.
- The Onoro Server - runs solely on third party websites or apps and validates DIIDs it receives from the Portes App. It never communicates with the DIID server.
This process collects no identifiable user data, nor stores any device specific data. The Portes App obtains and stores all the different types of status you acquire as DIIDs, while Onoro verifies these DIIDs. Each DIID is unique to you and is always in your possession on your device. DIID’s are verified and supplied to the Portes App from our DIID server and we do not have a copy of these DIIDs. They belong to you.
Description of each individual component
What is the Portes App?
The Portes App provides status without accounts, usernames, passwords, emails, SMS, IP addresses, cookies, or other personal identifiers. It will never request or capture any of your personal information, so it cannot expose your personal details. If a site or app requests your Proof-of-Status, the Portes App will check that you have this status, and then provide an anonymized random DIID to the party requesting it. The entire process takes just 2-5 seconds. Sites and platforms that talk to the Portes App cannot get your personal details.
As an added security bonus, Portes will be able to tell you if the party using Onoro is in fact the licensed party requesting your Proof-of-Status.
What is the DIID Server?
The DIID server initially verifies and authenticates your status, without requesting or collecting any personal information, nor storing any device specific identifiers. After verification, the DIID server supplies your device with your Proof-of-Status DIIDs. This is the DIID server’s only function, and it never communicates with third-party services. All Proof-of-Status requests from third-parties are done between your Portes App and the website/service requesting Proof-of-Status.
Since the DIID server never requests your personal data, your device data, your IP address, or your location data, nor does it talk to third-party servers, it cannot therefore be used to track or profile you or the platforms you visit.
What is Onoro?
Onoro is our DIID authentication technology for third-parties to verify any type of status. Third parties must install Onoro on their platforms to verify you have a specific Proof-of-Status. These platforms request your Proof-of-Status from the Portes App, which will return that proof without collecting or providing any personal details. Onoro doesn’t talk to the DIID server to verify your status. It only verifies the DIID that the Portes App randomly provides.
The benefit to using Onoro for third-parties is that our different types of status verification are built into the same module, beginning with I Am Human, which is free of cost. For example, with Onoro, you could verify a visitor is Human, 18+ years of age, and even add a layer of exclusive access to restricted areas, bypassing the risks associated with usernames, emails, and passwords.
Sites running Onoro will never request personal details for status verification.
Unlike other verification technologies, Onoro does not charge on a per-verification basis, as this would add additional performance, security, and privacy risks. Instead, Onoro will be provided as a stand alone licence for both small and enterprise platforms, with a straightforward pricing model. The platform licence is free for I Am Human. For small sites, Age Verification is free for the first year, and expected to cost just £99 each year after that.
The Portes SDK
Expected in late 2019, the Portes SDK will allow other third parties to build Portes DIID creation and storage in their own applications.
2.2. With accounts
This is a simpler version of the verifications done with Portes, as no third party verification is needed in order for the user to create an account, so, the DIID server isn’t required to provide the Portes App with DIIDs. The Portes App generates the DIIDs it needs.
A user could visit a website and instead of receiving an email to verify it was you who wants to have this account, the user can scan a QR code generated by the site and send it a DIID. The next time the user attempts to access the site they can scan a new QR code to identify them by their DIID.
In the Portes App, an end user can have a different DIID for each website associated to a different textual account name. If they have more than one account on a site, they may have more than one textual account name associated to each DIID.
When a user visits a website that uses Onoro to login, the end user adds a textual account name in the field provided and scans the QR code presented. The site remembers their device because it send it a DIID. If the end-user logs out, they can just scan the QR code presented by the site which will access the end-users account, as the site recognises their DIID.
3. Privacy and Security
How can I trust you don’t collect or store any of my private data?
The Portes solution is undergoing a voluntarily external audit to confirm we do not collect nor store any personal or device identification.
In addition to that, the Portes App uses no accounts, usernames, passwords, email addresses, or phone numbers. We cannot collect what we do not request. Onoro-enabled sites never require any personal details to provide status verification. If any site does request anything other than Proof-of-Status, do not provide it and report them to us immediately.
The Portes App can talk to the DIID server or Onoro independently. However, the DIID server and Onoro do not and can not talk to each other. Our DIID server only talks to the Portes App and does not allow any requests from third party sites, including Onoro enabled ones. All Proof-of-Status requests are performed directly between the Portes App and Onoro-enabled sites. Onoro-enabled sites and the DIID server never communicate to provide any status verification, and all Proof-of-Status is anonymized and randomized.
Onoro enabled sites are expressly forbidden to function on behalf of another party, or pass any data to a third party outside of this network. If you suspect this is being done, simply notify us. This type of abuse can result in a termination of the Onoro licence.
What is the “I Am Human” DIID?
When your first launch the Portes App, we generate your first free DIID, called I Am Human. I Am Human is designed as a Captcha/Recaptcha replacement allowing you to prove you are in fact a human and not a bot. Unlike Captcha systems, which are inherently end-user hostile, and Recaptcha systems which essentially collect your data and track you, I Am Human proves your Human status without collecting or sharing any personal or behavioral data.
There are no cookies, trackers, profiling, or picking out photos of cars and crosswalks.
Portes I Am Human DIID provides human Proof-of-Status with a single tap.
5. Age Verification
What is the Age Verification DIID?
There are many legal and compliance instances requiring Age Verification of end-users in online environments, including gaming/gambling, alcohol, tobacco, vaping, advertising, social media, and visual media. The PortesCard Age Verification voucher can be obtained from a local shop in order to obtain proof-of-age in the Portes App.
How do I know there’s no connection between my PortesCard Age Verification voucher and my use of the Portes App?
The PortesCard voucher contains a randomized code that we pre-generate or generate on demand that simply represents that a voucher is valid and has not been activated. When you scan or manually enter the code into the Portes App, we verify this code is valid, and then invalidate the voucher code so it cannot be used again. We then write a new Proof-of-Status DIID to your device which has a completely different identifier. If your voucher has been redeemed and the activated DIID is working, you may dispose of the voucher.
The vendor where you purchase the PortesCard voucher will only ever ask to verify the age on your ID. There are no records kept of who buys which vouchers or what their Proof-of-Status is for. Remember, you will not need to buy a new PortesCard voucher to be able to verify your age to any site or service that requests Proof of Age in the future (alcohol, gaming, gambling, vaping, tobacco, etc).
5.2. How it works
Some of the requirements for Age Verification have a sensitive nature, and most Age Verification solutions require you to enter your personal details online to prove your age. This carries with it very real privacy and security risks, and does not actually prove you are the person submitting the data, as you could share your credentials or have them stolen by anyone.
This is why we created the PortesCard solution:
- Download the Portes App from the iOS or Android App stores
- Obtain the PortesCard Age Verification voucher from your local shop
- Scan the voucher or manually enter the code into the Portes App within 24 hours of purchase
- Portes will instantly verify the voucher is valid and then convert the voucher into an Age Verification DIID on your device.
- You can now provide age-based Proof of Status to any third-party running Onoro. It is important to note that there are no identifiable records kept by the vendor or shop where you perform this task, and there is no way to connect the voucher you purchase to the Age Verification (AV) DIID on your device, as they are not connected.
We recommend making the Primary Device the one you carry with you most often.
My PortesCard Age Verification Voucher says it was activated, but the DIID isn’t working
First open the Portes App on your device. Tap on the Age Verification DIID that isn’t working. You’ll notice inside the DIID is a “Test DIID” button. Tap here. This will call out to our Onoro test server to see if the problem is with your DIID or with the third-party provider you are visiting. If the DIID returns a successful verification, you need to contact the site where your verification isn’t working, as they are having an issue.
I would like a refund for my PortesCard Age Verification voucher
Once purchased, all sales are final and vendors cannot issue a refund on any vouchers. If the voucher is not working, you can be issued a new one (see voucher activated but DIID not working).
Voucher Time Limits
The Age Verification PortesCard must be verified on a device within 24 hours from purchase. Once a voucher has expired, it can no longer be verified by the Portes App and DIID server. This is to aid in preventing secondary voucher markets from existing. We also have other protections in place to reduce this type of fraud (See Parental controls).
Why are PortesCard Age Verification Vouchers only valid for 24 hours from purchase?
In order to prevent the fraudulent abuse of vouchers being purchased by adults and sold on a secondary market, one of the controls in place is a time constraint.
My voucher won’t activate in the Portes App
If your voucher isn’t scannable (doen’t have a QR code), please attempt to enter the number manually. If you still have difficulty activating the voucher, please double check your manual entry of the code to ensure it is entered correctly. Note that our codes have none of the following characters: 0, O, L, i.
If you have entered the code correctly, check the timestamp on the voucher. If you waited beyond the expiration time of the voucher to activate it, it will not work and will not activate.
I activated my PortesCard Age Verification voucher on my device, but it says it has expired.
Take the voucher to the vendor where you purchased it, along with the device you attempted to activate. You’ll notice there is an expired adult DIID on your device with a number on it which should match the number on your voucher. Show both of these to the vendor and request a new voucher. These numbers must match to obtain your new voucher.
How long is my PortesCard DIID good for?
Your PortesCard DIID is good for one year from the date of activation.
Why does the PortesCard Age Verification DIID expire after one year?
We expire Age Verification DIID’s after one year for security and fraud protective measures.
After one year, do I have to go back to the same shop and pay for a new voucher?
After the first year you can re-activate your DIID with an in-app purchase of just £2.99 for a single device. There will be no personal or payment data connected between your purchase and your new Age Verification DIID. You can also buy a renewal voucher at any shop that sells PortesCards.
5.2.3. Parental Controls
The Portes App has a number of Parental Controls baked in to allow parents to restrict access to either the entire Portes App, or just specific DIIDs.
As a parent simply download the Portes App on your child’s smartphone and secure it with a 4 or 6 digit PIN. Once the App is locked, it cannot be used for any form of status verification, nor can it obtain DIIDs.
Age Verification Lockout
PortesCard has an additional protection measure in place to prevent secondary market voucher use. After downloading the Portes App on your child’s device, open the Apps Settings and select the Parental Controls tab. Here you can lock Age Verification. If you enable the Age Verification lock, any attempt to authenticate a PortesCard voucher will immediately invalidate the voucher, meaning it can never be used on any device.
Any purchased voucher with an attempted verification with a Portes App that has Age Verification locked, will be considered fraudulent, and will forfeit the £4.99 or £8.99 voucher fee. This PortesCard cannot be exchanged for a replacement. Additionally, the attempted verification will be denoted for the parent to see in the Portes App and we will be notified about this voucher.
For added security, we recommend you secure age verification with a six digit PIN instead of biometrics.
*It should be noted that purchasing an 18+ PortesCard with the intention of giving it to a minor could be considered illegal.
Additional Parental Protections
Not only can you lock Portes to prevent specific DIID use, you can also rest assured there are protections in place so that your children can’t simply delete and reinstall the Portes App to wipe out your lock settings. As an added layer of protection, you can also turn on iOS and Android Parental settings to prevent Portes from being installed or deleted on your child’s device.
In the near future, we’ll be adding an entire suite of Parental Controls designed to give you more control over your children can see, as well as what types of services they can access, and who can have access to them.
What if I discover an 18+ DIID on my child’s device?
If your child has an 18+ voucher on their device that isn’t secured with a PIN, you can open the DIID and deactivate it. It is gone forever and can never be recovered. Then simply enable the Portes Age Verification lock in the App settings.
If your child has an 18+ voucher protected by a PIN and they refuse to supply it, simply delete the Portes App, reinstall it, and enable the Age Verification lock. This will delete the Age Verification DIID and prevent future activations.
What is the Student DIID?
You can verify that you are a student by using Portes. This way, you don’t have to use your personal data on a site, as sites using Onoro can verify that you are a student.
What is the Exclusive DIID?
You can verify that you have the right to access exclusive material by using Portes.