How to choose a QR code platform for your agency: the buyer's checklist

An agency doesn't pick a QR code platform once a quarter. It picks one, builds a workflow around it, hands client logins to account managers, and then prints thousands of codes onto flyers, packaging and signage that are expensive and slow to replace. Get the platform wrong and you don't find out until months later, when a client asks why last spring's direct mail codes stopped working, or why the scan dashboard can't tell them anything more useful than a total.

This isn't a ranked list of vendors. It's the set of criteria that actually separates a platform built for agencies from a link shortener with a QR code bolted on, plus one question almost nobody asks before signing a contract: what happens to every code you've ever printed if the vendor disappears. If you're still deciding whether QR is the right format at all, our comparison of QR codes against URL shorteners and QR codes against NFC tags covers that groundwork. This post assumes you've made that call and need to pick a tool.

Static or dynamic: settle this before anything else

Every other decision on this list only matters if the platform generates dynamic codes. A static QR code has its destination baked directly into the pattern of modules; once it's printed, that URL is permanent, full stop. A dynamic code instead points to a short redirect URL hosted by the platform, and the platform looks up the real destination at scan time, which is what lets you edit where a code sends people after it's already on a wall, a van or ten thousand postcards.

That distinction is worth its own read if you haven't made the call yet (our dynamic vs static comparison goes through it in detail), but the short version for a platform evaluation is this: any vendor whose "QR code generator" only produces static codes isn't an agency platform, it's a QR image exporter. You want dynamic by default, with the option to fall back to static for the rare case where a client's destination will genuinely never change and no reporting is needed, such as a code on a permanent architectural plaque or an engraved product.

What "analytics" should actually mean

Almost every QR tool on the market claims to offer analytics. Very few agree on what that word means, and the gap between a scan counter and useful reporting is the single biggest quality signal you'll find in an evaluation. A basic generator shows you a running total: this code has been scanned 412 times. That number answers almost nothing a client will ask you.

A platform built for agency reporting breaks a scan down by device type, timestamp and an IP-derived location (typically accurate to city or regional level, not GPS precision, since that would require an explicit permission prompt most scan flows never trigger), and lets you attach UTM parameters so scans flow into the same Google Analytics or ad-platform reporting as every other channel. Our guide to QR UTM parameters covers the naming convention that keeps this consistent across clients.

It's worth checking what practitioners themselves say matters, rather than trusting a vendor's feature list. In Bitly's own 2025 survey of marketers using QR codes, 54 percent named unique users their most valuable metric and 52 percent prioritised post-scan conversion rate over raw scan count, with 69 percent saying they update or redirect a dynamic code at least monthly. If a platform can't show unique versus repeat scans, or can't tell you anything about what happened after the scan, it's missing the two things practitioners actually use. Our own scan metrics guide sets out which numbers are worth reporting to a client and which are vanity metrics.

Custom domain and white-label redirects

A dynamic code has to redirect through somewhere, and by default that "somewhere" is the vendor's own domain. On a client's print materials, a redirect URL like vendorname.io/a1b2c3 sitting next to a logo the client paid a designer to get right looks like an afterthought, and a security-conscious scanner may hesitate to tap it at all. A platform aimed at agencies lets you point redirects at a domain you or the client control instead, via a CNAME record, so the URL a phone shows before opening the link matches the brand on the poster.

You'll typically find this gated behind a mid or higher tier rather than the entry plan, since it requires the vendor to provision and verify a domain per customer. It's worth asking exactly what "white-label" includes: a custom redirect domain and a rebrandable client-facing dashboard are two separate features, and some platforms sell them separately. If you're running codes for multiple clients under one agency account, check whether each client can get their own domain, or whether you're limited to one across the whole account, which matters more the more workspaces you run (see our guide to organising a workspace per client).

How scan data is collected, and whether that's actually compliant

A scan event carries an IP address, a device type and a browser string at minimum, and all three count as personal data under GDPR the moment they're logged against an identifiable code or session. That doesn't mean you need a cookie-style consent banner glued to a physical poster: platforms typically rely on legitimate interest as the legal basis for basic, aggregate analytics (scan counts, device mix, coarse location), provided they can show a documented balancing test and don't use the data for anything beyond campaign reporting.

What separates a platform that's thought this through from one that hasn't is what happens to the raw IP address after the scan. A compliant setup derives a city or region from it and then discards or truncates the original address rather than storing it indefinitely tied to an individual. Ask the vendor directly whether they retain raw IPs, for how long, and whether that retention period is configurable or documented anywhere you can point a client's legal team to. Our explainer on QR codes and GDPR goes through what a tracked scan actually collects and what consent is and isn't required for.

Bulk generation and API access

A single client onboarding rarely needs more than a handful of codes created by hand in a dashboard. An agency running fifteen client workspaces, each generating codes for individual products, locations or direct-mail recipients, needs to create hundreds or thousands of unique, trackable codes without touching each one individually. That means CSV bulk upload at minimum, and for agencies building QR generation into their own tooling, a documented API.

Check the actual limits before you commit, not just whether the feature exists: bulk batch sizes commonly cap out somewhere between 500 and a few thousand codes per upload depending on tier, and API access usually comes with a monthly request quota rather than being unlimited. Our guide to generating QR codes in bulk walks through the workflow and the naming conventions that keep a few thousand codes manageable instead of a mess of code-1847.csv rows nobody can trace back to a client.

Can someone else edit, or hijack, a live code

Because a dynamic code's destination lives on the vendor's server rather than in the printed pattern, whoever has write access to that code in the dashboard can silently change where it points, and every phone that scans the printed code afterwards follows the new destination without any visible difference on the physical material. That's the entire point of dynamic codes, and it's also the risk: the platform's permission model determines who can make that change, and how you'd notice if the wrong person did.

At minimum, look for per-workspace access control so a junior account manager on one client can't edit a different client's live codes, and an audit log showing who changed a destination and when. Ask what happens if a vendor employee's account is compromised, and whether the platform detects an anomalous pattern (a code that's redirected somewhere new outside business hours, say, or a sudden spike from a country the campaign was never targeting). Our guide to QR code security for agencies covers this threat model in more detail, including the more familiar risk of someone printing a fake sticker over your client's real code.

What the pricing model actually buys you

Two pricing shapes dominate the market. Most platforms sell a flat monthly subscription with a cap on the number of active dynamic codes, tiered upward as that cap rises; a smaller group instead caps free or entry accounts by total scans rather than by code count, which functions as a de facto metered model even when it's marketed as free. Either can work, but a scan cap is the one to read carefully: a client's campaign performing better than expected shouldn't mean the tracking silently stops mid-campaign because a free tier's monthly scan allowance ran out.

White-label and API access, as covered above, typically only unlock from the mid tier upward rather than the entry plan, and enterprise pricing for agencies running large multi-client operations is usually a custom quote rather than a published number. Before you commit an agency's whole client roster to one platform, ask what happens if you need to downgrade mid-contract: whether codes above a lower tier's cap keep working (usually yes, but read-only) or stop redirecting entirely (which would mean live printed material breaking because of a billing decision, not a technical one).

If you're setting your own pricing to clients rather than just evaluating what you pay a vendor, our guide to what agencies charge for QR code campaigns has benchmarks for structuring that separately from your platform cost.

The question nobody asks: what happens if the platform disappears

Every criterion above assumes the vendor is still operating. That's not a safe assumption to skip past, because dynamic QR codes have a specific, well-documented failure mode that static codes simply don't: if the company running the redirect server shuts down, every code that ever pointed through it goes dead at once, permanently, with no way to recover it. The printed material doesn't know the company behind it closed; it just stops working, silently, on whatever wall or product it's already on.

This isn't a hypothetical. Microsoft's own QR-based Tag service, launched in 2009, was shut down on 19 August 2015, and every Tag code anyone had printed in the previous six years stopped resolving the moment the servers went dark. There was no migration path for a printed sign or product label; the physical material simply became inert. It's a useful reminder that "QR code company" isn't a category with unusual staying power just because QR codes themselves are a durable, patent-free standard; the standard survives, but any single vendor's redirect infrastructure doesn't have to.

You can't fully insure against this, but you can ask questions that tell you how exposed you'd be. Does the vendor let you export your full code and destination list at any time, not just on request during an offboarding process? If the platform supports custom domains, do you control the DNS, meaning you could in principle point that domain at a replacement redirect service later, or does the vendor control it end to end? Is there any published information about the company's funding, ownership or how long it's been operating, versus a product that appeared with no track record and a suspiciously aggressive free tier? None of these questions guarantee anything, but a vendor who can answer them clearly, and who makes data export a self-serve dashboard feature rather than a support ticket, has clearly thought about this failure mode. One who bristles at being asked probably hasn't.

A checklist to run before you sign

Work through these before committing an agency's client roster to a platform, not after the first print run has already gone out.

• Confirm dynamic codes are genuinely dynamic: create one, scan it, then change its destination in the dashboard and rescan the same printed code to confirm it updates without reprinting.
• Ask what a scan record actually contains (device, timestamp, city-level location) and whether raw IP addresses are retained or discarded after processing.
• Check whether a custom redirect domain is included at your tier, whether you or the vendor controls the DNS, and whether each client workspace can have its own domain.
• Confirm bulk upload and API limits in writing, not just that the features exist, since a 500-code cap matters at agency scale even if it never shows up in a demo.
• Test the permission model: can you scope one team member's access to a single client's workspace, and is there an audit log of who changed a live code's destination?
• Ask directly what happens to your codes if you cancel, downgrade, or if the company is acquired or shuts down, and whether you can export everything yourself right now, today, without opening a support ticket.
• Read the free-tier and lower-tier limits specifically for scan caps, since a client's successful campaign should never silently stop being tracked because of a plan limit nobody flagged in advance.

Frequently asked questions

What's the difference between a static and a dynamic QR code?

A static code has its destination encoded directly into the black-and-white pattern, so it can never be changed once printed. A dynamic code instead encodes a short redirect URL controlled by the platform, which looks up the real destination at scan time, meaning you can change where a printed code sends people at any point after it's gone to print, and get scan analytics that a static code can't provide.

Do QR codes expire?

The QR code standard itself has no built-in expiry. A dynamic code stops working only if something external breaks the chain: the vendor's redirect service shuts down, a free-tier scan or code allowance is exhausted, or a subscription lapses and the account is suspended. A static code effectively never expires, since there's no server dependency to fail, but it also can't be updated or tracked.

What actually happens if a QR code platform shuts down?

Every dynamic code that pointed through that vendor's redirect domain stops resolving at once and permanently, with no recovery path for material that's already printed and in circulation. This has happened before at scale: Microsoft's Tag service shut down in August 2015, breaking every Tag code printed in the preceding six years. It's the strongest argument for checking a vendor's data export options and domain control before committing, not after.

Is QR code scan data covered by GDPR?

Yes. An IP address, device type and browser string logged against a scan count as personal data the moment they're tied to an identifiable code or session. Legitimate interest typically covers basic aggregate analytics such as scan counts and coarse location, provided the platform documents a balancing test and doesn't repurpose the data beyond campaign reporting; anything more granular, such as individual-level profiling, generally needs a clearer legal basis and consent.

How much does a QR code platform cost for an agency?

Pricing splits mainly into flat-subscription tiers that cap the number of active dynamic codes, and entry or free tiers that cap total scans instead. White-label domains and API access typically only appear from the mid tier upward rather than on entry plans, and agency or enterprise pricing for large multi-client operations is usually a custom quote rather than a published rate. The number that matters most when comparing tiers is the scan cap on whichever plan you're actually on, since a client campaign performing well shouldn't run into a tracking cutoff mid-flight.

Can I move my QR codes to a different platform later?

Only if the codes are dynamic and the platform lets you export the full list of codes and their current destinations. Because the code itself only encodes a redirect URL, not the final destination, migrating means either keeping the old redirect domain alive under a new provider (possible if you control that domain's DNS) or reprinting with a new code pointing at the new platform, which isn't possible for material that's already distributed. This is exactly why domain control and export access matter more than almost any single feature on a pricing page.

The short version

Before you commit an agency's client roster to a QR code platform, confirm four things work the way the sales page implies: codes are genuinely dynamic and editable after print, analytics go beyond a raw scan counter to unique visitors and post-scan conversion, scan data handling has a real answer for GDPR rather than a vague assurance, and you can export everything yourself at any time. Then ask the one question the sales page will never raise on its own: what happens to every code you've ever printed if this company isn't here in three years. Any vendor, including us, should be able to answer that clearly. If they can't, that's the answer.