Transportation and transit ticketing
Metros, light rail, buses, BRT, ferries, and the kiosks that recharge them. The industry where security, throughput, and unattended-deployment economics all collide at the same gate.
Why transportation cares
- Latency at the gate is non-negotiable. Riders queue.
- Validators are unattended for years and physically reachable. Tamper resistance is a procurement criterion, not a slide.
- Backhaul is unreliable. Offline-first is the only architecture that ships.
- Settlement is auditor-visible. Every cent passing through a SAM-signed receipt has provenance.
- Operator brand sits on the card the rider hands to a friend. The card is the brand.
Talk to engineers about your transit deployment.
Tell us card volume, validator estate, fleet size. Pilots are 90 days; production deployments 12-18 months.
Frequently asked questions
Why does transit ticketing still authenticate offline?
Because the gate has a few hundred milliseconds to decide, with no guarantee of connectivity. That budget rules out a network round trip, so the trust decision has to happen between the card and the validator.
What is a SAM and why does a validator need one?
A Secure Access Module holds the card keys inside tamper-resistant hardware at the reader. It lets the validator authenticate cards without master keys ever existing in terminal software or memory.
What is the difference between closed-loop and open-loop ticketing?
Closed-loop uses an operator-issued card, typically DESFire, with fares and keys under the operator's control. Open-loop accepts bank cards over EMV contactless. Most large networks now run both on the same validator.
Which DESFire generation should a new deployment use?
EV2 or EV3. Both add transaction MAC, which lets a back office verify independently that a transaction occurred, and proximity checking against relay attacks. EV1 remains supported for existing estates.
What happens when the backend is unreachable?
Nothing visible to the passenger. Validators keep operating on locally held keys and reconcile when connectivity returns — which is the point of designing for offline trust rather than treating it as a failure mode.