About PQSS
PQSS, the Public QR Security Standard, sets out what an organization that posts QR codes in public places should do to find, remove and report fake codes stuck over its own.
Publisher
PQSS is written and published by EZQR (Canada), a Canadian QR code software company. The standard is tool-neutral: it can be met with a spreadsheet and a clipboard, and any tool or process that meets the requirements is equally valid.
No certification
There is no PQSS certification. No organization, including the publisher, certifies or audits compliance, and nobody may describe themselves as "PQSS certified". Organizations assess themselves with the self-assessment checklist and, if every answer is yes, may state: "We self-assess against PQSS 1.0, the Public QR Security Standard. Last assessed: [date]."
Licence and attribution
The text of PQSS is licensed under CC BY 4.0. You may copy, adapt and republish it, including inside your own procedures, as long as you give credit. A suitable attribution:
Based on PQSS 1.0, the Public QR Security Standard, published by EZQR (Canada), https://pqss.ca/1.0, licensed under CC BY 4.0.
If you adapt the text, say so, and don't present your version as PQSS itself.
Versions
A minor version (1.1) clarifies wording or adds SHOULD-level guidance. A major version (2.0) changes MUST-level requirements. Every version keeps its own permanent page, and a self-assessment always names the version it used.
| Version | Status | Published |
|---|---|---|
| PQSS 1.0 | Published |
Feedback
Send comments, corrections and proposed changes to [email protected]. Feedback from people who run inspections (parking operators, transit agencies, municipalities, restaurant groups) is especially useful for the inspection periods in Requirement 2.
Related guidance
- ITSAP.00.141, Security considerations for QR codes (Canadian Centre for Cyber Security): guidance for people who scan QR codes. PQSS is the counterpart for people who post them.
- PCI DSS: card-payment devices are inspected on a schedule for tampering and substitution. PQSS applies the same approach to printed codes. PQSS isn't affiliated with the PCI Security Standards Council.
- ISO/IEC 18004: the QR code symbology. PQSS doesn't change how codes are encoded or printed.