Controlled Credentials from Issuance to Retirement

Keep Credentials Aligned with Identity and Authorisation

Payment cards, employee credentials, digital certificates and verifiable credentials follow different processes, but share a common need: accurate information, controlled issuance and dependable status throughout their use.

Hengbao connects credential operations with the identity, account, role and qualification information that governs them. From the initial dataset to replacement or revocation, each stage can be managed as part of a traceable lifecycle.

Credential Data Preparation

Transform authorised identity, account, qualification and organisational information into the data needed for issuance. Data preparation brings together intake, field mapping, format validation, cleansing, approvals, reconciliation and secure delivery to the next stage.

Applications include banking credential data, employee issuance batches, PKI applications, digital credential generation and re-issuance after information changes. Integration connects registration systems and authoritative data sources with production and issuance processes.

• Match the correct holder, credential type and issuance request
• Validate fields and reconcile batches to reduce duplicate or incomplete records
• Protect data in transit and temporary storage
• Separate operational responsibilities and retain processing records
• Apply defined retention and cleanup processes

Credential Personalisation

Apply approved holder information, identifiers, certificates and permissions to physical cards, smart cards, tokens and digital credentials. Personalisation connects the authorised request with the credential delivered to its holder.

The scope can include payment-card printing and chip personalisation, employee and access cards, certificate loading for PKI tokens, and role or qualification data for digital credentials. Centralised production supports batch operations, while branch or on-site processes support controlled small batches and replacement needs.

Controls include application-to-batch matching, dual review, role separation and restricted access to printers, writers and personalisation systems. Key injection uses protected media on supported devices. Operator, device, batch and delivery records help trace production, with defined handling for failed orders, spoiled cards and duplicate output.

Physical Credential Issuance

Connect personalised cards and security tokens with the people authorised to receive and use them. Physical credential issuance brings together the approved request, holder information, delivery and activation processes to support a controlled transition from production to use.

Centralised issuance can support batch programmes, while branch and on-site processes address immediate replacement and controlled small batches. Applications include payment cards, employee credentials, access cards and PKI security tokens, with the issuance process aligned to each credential type.

Match credentials to authorised holders and issuance records, track delivery status and connect activation with the relevant identity or account. Loss, failed delivery and replacement feed into the credential lifecycle, keeping issuance activity traceable beyond personalisation.

Digital Credential Issuance

Turn verified identity, qualification or authorisation information into a verifiable credential. Issuance brings together rule definition, identity and authorisation checks, attribute selection, credential generation and signing, delivery confirmation and status registration.

Issuers can define credential fields and validity for employee roles, partner service authorisations, customer eligibility, membership attributes and professional qualifications. Credentials are delivered to the holder or a compatible wallet application within the agreed solution.

Issuance policies and approvals restrict who can issue each credential type. Protected signing keys, holder and field checks, status registration and revocation interfaces support controlled delivery and subsequent verification. Issuance, update and revocation actions are retained as part of the audit record.

Credential Lifecycle Management

Maintain credential status after issuance through activation, expiry reminders, renewal, loss reporting, suspension, recovery and revocation. Connect lifecycle actions with authoritative identity and authorisation systems so credentials reflect current relationships and permissions.

• Revoke employee credentials and certificates when employment ends
• Close partner authorisations when a contract or project finishes
• Suspend mobile credentials after device loss
• Renew certificates and credentials before expiry
• Replace outdated credentials and manage acceptance of the new version

Key actions can require authentication, approval and separation of duties. Status queries and revocation workflows connect with relevant verifiers, while records capture the operator, reason, time and impact. Status-update and offline-verification arrangements follow the chosen credential architecture.

Connecting Physical Credentials with Digital Control

Hengbao combines secure physical credential expertise with software and lifecycle processes. Identity sources, production systems, authentication services and verification channels can be connected around the programme's operating model, helping teams maintain control from preparation to retirement.