Why it's safe

Two separate records, and they must match.

A voucher works like a gift card: whoever holds it can use it. So the question that matters is whether the one in front of you is real and still unused. We answer it by keeping the record in two places that the same person cannot both change.

bullmark

Keeps the voucher itself: who holds it, what it is worth and whether it has been used.

Sends a fingerprint (hash) never the contents

axowl

Keeps the fingerprint of that record: a short code computed from it. Axowl's own clock notes when it arrived.

Axowl never sees what a voucher says. It receives only the fingerprint and stores it with its own time stamp. That keeps the two sides independent. If a voucher is changed, its fingerprint changes too, and we cannot change the fingerprint stored at Axowl.

What is covered

The fingerprint is computed from these items

The fingerprint does not cover the whole database row. It covers the list below, so you can see exactly what is protected. Change any one item and the fingerprint no longer matches.

The product the brand who holds it its redeem code its serial number the consumer price the price it grants when it expires whether it has been used when it was used the holder's email

The last three were added in August 2026, and they matter most. Before that, someone could set a used voucher back to unused in the database and it still passed every check. Its use was recorded somewhere else, so its fingerprint stayed the same. That no longer works.

Two things are deliberately left out, because including them would cause false alarms. A reservation is a temporary hold and does not change what the voucher is worth. A voucher held for thirty seconds at a checkout has not been changed. The expired status is left out because the expiry date is already in the fingerprint, so anyone can work it out. If the status were included too, a voucher that passed on Monday would fail on Tuesday although nobody touched it. People stop paying attention to a checker that raises false alarms.

How each attack is stopped

Four ways to cheat from the inside, and what stops each one

Edit a voucher in the database

Someone lowers the price, pushes back the expiry date or puts their own name on it. The fingerprint changes and no longer matches the one kept at Axowl. Recomputing the fingerprint on our side does not help, because the one that decides is not in our database.

Spend the same voucher twice

Whether a voucher has been used is now part of the fingerprint, so setting it back to unused changes the fingerprint. Each use is also recorded as its own locked entry, linked to the entry before it. Two records would both have to carry the same lie, and one of them is not ours.

Create one that was never issued

When vouchers are issued, the whole batch is locked as one record: how many, at what price, until what date. If 100 were issued, a 101st voucher contradicts a record that already exists. And each new fingerprint is stamped by Axowl's clock, not ours, so it can be created today but never dated last year.

Quietly move it to someone else

The holder is part of the fingerprint, so a voucher cannot change owner by editing one field. When a voucher is handed over, the giver's copy is closed and the receiver is issued their own with the same serial number. Both steps stay in the record, so a transfer never shows only one side.

Copied codes

What if someone copies my QR?

A QR code (the square barcode you scan) is not the voucher itself. It only points to one numbered voucher in our records. So a photo of a QR is worth exactly what that voucher is worth at the moment someone shows it. Every case below follows from this.

A made-up code

When a voucher is used, the system looks the code up in our records. It does not read a value from the image. A code that was never issued leads to nothing, however real the QR around it looks. Nobody can draw a voucher and make it exist.

A copy of a real one

A copy carries the same code, so it is the same voucher and not a second one. The first use is recorded on that voucher and locked. Every later attempt, from the copy or the original, gets the answer that it has already been used. Ten screenshots are still one voucher.

A screenshot kept before selling it

When a voucher is handed over, as a gift or a resale, the giver's voucher is closed and the receiver is issued a new one with a new code under the same serial number. The code in the old screenshot now leads to a closed voucher. Selling a voucher and then rushing to use it before the buyer does not work.

A code someone else saw first

This risk is real, and we prefer to say so. Whoever has the code can use the voucher, and a brand that accepts a code is not told who is holding the phone. Scanning a QR does not reveal the code. A scan shows that the voucher is genuine and unused; the code itself is shown only to its signed-in holder and to the brand that issued it. But a code you post or read out loud is a code someone else can use. Treat it like a gift-card number. A brand that wants to close this gap can ask us which vouchers its signed-in customer actually holds and let them pick from that list instead of typing a code. Then a copied code has nowhere to be entered.

Whatever happens, it is recorded. Issuing, handing over, reserving and using a voucher each leave a locked entry linked to the one before. A brand can download the full history of any of its own vouchers, contents included, and recompute every fingerprint itself. So the question of who used a voucher and when has an answer that does not depend on our word.

Brand Credit

Can we quietly create more of it?

Brand Credit works much like money: a brand tops it up, issues vouchers with it and cashes out what it earns. So the fair question is whether we could add a line to our own records and hope nobody notices, and not only whether an outsider can break in.

Entries are only ever added

Entries are added, never edited or removed. A correction is a new entry that says what it corrects, so both the mistake and the fix stay visible. No balance exists with an inconvenient line taken out.

Every entry is locked and linked

Each entry carries the fingerprint of the one before it. Changing an old entry breaks every entry after it. So one quiet edit would mean rewriting the whole chain in two places, and one of those places is not ours.

An insider is not exempt

Access to our database is not the same as control over the record. Someone with full rights to our production database can still change a row. They cannot make the fingerprint at Axowl match it afterwards. That is why the second copy is kept somewhere our administrators have no administrator rights.

You can audit it without asking us

A brand can give the ids of its own entries to an accountant. The accountant recomputes the fingerprints from the open chain and checks that the sums add up. The check does not pass through Bullmark, so we have no chance to influence it.

Referral rewards

Can fake sign-ups collect the reward?

A reward for every new user tempts people to create fake users. So the reward is not paid for signing up. It is paid only for a person who stays.

Nothing is paid at sign-up

A first sign-in only creates a pending entry. The reward is paid 7 days later, and only if that same person signed in again on another day. An account that signs up and never returns is closed without payment.

One mailbox, one reward

Different spellings of an address that reach the same inbox, such as a +tag or the dots in a Gmail address, count as one person. Disposable email addresses can sign in but are never rewarded.

Limits per device and on sudden bursts

For each brand, at most three rewarded sign-ups can come from one device. Sign-up emails to new addresses are limited per network and per app, and a bot check that is on by default comes first. A contract that suddenly receives a burst of sign-ups stops paying, and the brand is told.

The most a brand can lose is set in advance

Every contract with a reward has a budget, and pending rewards count against it. The referrer and the brand's own people are never counted. Each reward, paid or refused, is a locked record that both the brand and the referrer can see.

Beyond these, the system includes a range of additional safeguards that cannot be disclosed for security reasons.

What we do not claim

We verify an email address and nothing beyond it.

We do not check passports, we do not operate an identity-check service and we do not claim to know who is behind an address. The fingerprint proves that a record has not been changed. It does not make an unverified claim true. A company that mixes up those two things is selling you a feeling of safety.

So this is exactly what we promise: this voucher, at this price, was issued to this email address, at this time, and has not been changed since. The email is the one the account signed in with, never something typed into a form. Anything beyond that address is outside what we can prove, and we prefer to tell you now than let you find out later.

Check it yourself

You do not have to take our word for it

Every locked entry can be read, and the calculation behind it is public. Give the chain of entries to our JavaScript SDK, or to any tool that can compute SHA-256 (a standard way to make a fingerprint), and recompute the fingerprints yourself. The check runs entirely on your side and asks Bullmark nothing.

GET /integrity/events/VoucherInstance/{id}

It returns fingerprints and pass/fail results, never voucher contents or redeem codes. That is why it can stay open without becoming a way to read other people's vouchers.

Get started

No cash upfront.

List your startup How it works