Certificate Issuance and Verification Policy

1. Purpose

To explain which documents hangel issues and on what conditions, how a document is verified and what happens when a document is wrong.

2. Scope

All documents issued through hangel: event attendance and contribution certificates (participant, speaker, staff), volunteering certificates, the blood donation thank-you certificate, certificates issued to organisations (NGOs, clubs, brands), badges and the Volunteering Experience Document issued by organisations.

3. Principles

1. Documents are based on records. A document is issued only on the basis of a record on the platform (check-in, organisation approval, exam result); no "made-up" certificates are produced by hand.
2. Anyone can verify. Every certificate has a code and can be verified without signing in.
3. Minimal personal data. The verification page shows only the necessary information; e-mail addresses and user IDs are not shown.
4. Accurate titles. A document never presents hangel or the issuing organisation as having an authority or accreditation it does not have.

4. Roles and responsibilities

• Issuing organisation: confirms attendance and volunteering hours ("Complete"), sets the exam condition and fills in the experience document.
• hangel (platform): generates, codes and signs the document and runs the verification service.
• Super-admins: review reports of incorrect documents.

5. How it works at hangel today

• When it is issued: An event certificate is issued on the organiser's "Complete" confirmation and according to the check-in record, once the chosen attendance rule for online events and, if there is an exam, the pass condition are met. A volunteering certificate becomes visible once the organisation's approval and evaluation are complete.
• Code: Every certificate has a code without hyphens that starts with "H" and is at least 11 characters long. The code contains the country code, the document type, the year of issue and the activity and person sequence numbers; the last digit is a check digit (Luhn) that catches typing errors.
• Verification: Certificates are verified at hangel.org/c/<code> or by QR code. There are three outcomes: valid and recorded (the holder, event or organisation and date are shown); code format valid but no record found; invalid code. The verification endpoint is rate-limited against abuse.
• Digitally signed document: Certificates can also be downloaded as a digitally signed document in the Open Badges 3.0 format. The recipient's e-mail address is not written in the document in plain form; it is carried as a salted hash.
• Wallet: Certificates can be added to Apple and Google wallets.
• Experience document: Issued with hours calculated from the organisation's approved records and verified by QR code; it is not an employment contract or a social security service record.
• Company impact certificate: Monthly and annual certificates are generated from companies' employee volunteering data; previews generated with demo data are marked "Sample data".

6. Not yet in place and our goals

• No revocation list. When the record of a wrongly issued certificate is removed, the verification page says "no record found"; however, no revocation (status) list is published yet for signed Open Badges files that were downloaded earlier. Our goal is to add an Open Badges status list.
• There is no user-facing flow for correcting and reissuing certificates; this is done manually through destek@hangel.org.
• The verification page does not distinguish why a well-formed code has no record (deleted or never issued).

7. How to raise a concern

Suspected incorrect or fake certificates: destek@hangel.org (include the certificate code).

8. Review

At least once a year and whenever the document format or signing key changes.

9. Related documents

Training Quality Assurance Policy · Volunteer Management Policy · Personal Data Protection Policy · hangel.org/c