Attestto · Costa Rica
Sovereign digital identity for Costa Rica
Open infrastructure that implements the principles of technological neutrality, data protection, and open standards that Costa Rica's legal framework already mandates.
What the law already requires
Costa Rica has one of the most developed frameworks in Latin America for technological neutrality. These instruments are not aspirational — they are current, binding law. Attestto implements them by architecture.
Law 8642 · Art. 3(h)
Technological neutrality. Common, guaranteed standards. No technology favored over another. Operators choose their stack — the State does not impose.
W3C Verifiable Credentials + Decentralized Identifiers. International standards, chain-agnostic, auditable by any party.
Law 8454 · Art. 2(d)
Equal treatment for technologies of generation, processing, or storage. Digital signatures have the same validity as handwritten ones, regardless of the technology used.
Ed25519 electronic signature + PKCS#11 compatibility. The citizen chooses the mechanism — smartcard, biometrics, or on-device cryptographic key.
Law 9986 · Art. 19
Open formats and neutrality in the public procurement system. Information is stored in formats accessible at no cost. No conditions favoring one technology over another.
JSON-LD, W3C VC Data Model, open source Apache 2.0. Any vendor can read, verify, and issue compatible credentials.
Law 8968 · Data protection
Consent, minimization, purpose limitation. Citizens' personal data requires informed consent. Only what is strictly necessary may be collected.
Cryptographic selective disclosure. The citizen reveals only what the verifier needs. No central server stores data. Privacy by architecture, not by policy.
CNTD · D.E. 44507-MICITT
National Code of Digital Technologies (2024). Seven chapters of mandatory application for the entire public sector. Chapter 6 is dedicated entirely to technological neutrality.
Complies with all 7 chapters: accessibility (PWA), identification (DID + WebAuthn), security (local-first, post-Conti), interoperability (W3C), neutrality (chain-agnostic), AI (on-device, explainable).
Art. 24 · Political Constitution
Right to privacy and informational self-determination. No system may compel a citizen to surrender personal data beyond what is strictly necessary.
The citizen carries their own credentials. No one else stores their information. Verification is cryptographic — no third-party database lookups required.
Why Costa Rica needs this now
In April 2022, the Conti group exfiltrated 672 GB of government data. The Ministry of Finance, the CCSS (social security), and multiple institutions were paralyzed for months. Health records for 5 million citizens were inaccessible for 5 months. The estimated cost exceeded $125 million.
The problem
Centralized data without cryptographic integrity. One compromised server = everything lost. No way to verify if a document was altered after the attack.
The lesson
The next attack is inevitable. The question is not whether it will happen, but whether citizen data survives intact. Cryptographic integrity turns a catastrophic attack into a recoverable service interruption.
The architectural solution
Cryptographically signed verifiable credentials anchored in immutable public records. If the server falls, signatures survive. The citizen carries their own verifiable proof.
Credential types for Costa Rica
Open schemas based on W3C Verifiable Credentials and aligned with ISO 18013-5 (mobile driving license). Each schema defines the fields, validation rules, and trust chain.
National ID (Cedula)
Verifiable credential linked to the national ID number. Facial verification with liveness proof. Issued by authorized professionals as Registration Authorities.
Driving license (mDL)
Digital license conforming to ISO 18013-5. Includes categories, restrictions, and validity. Verifiable offline by any authority with a compatible reader.
Medical certificate
Credential issued by a licensed medical professional. Includes exam type, validity, and issuer signature. Automatic validity check before the driving exam.
Professional title
Credential issued by the corresponding Professional College. Verifies the professional is licensed, active, and current with their obligations.
Competency certificate
Cryptographically verifiable exam results. Includes hash chain of the exam session, signatures from the examinee and the station, and public record anchoring.
Vehicle registration
Vehicle title as a verifiable credential. Immutable brand history (clean, salvage, rebuilt). Eliminates title washing across jurisdictions.
Sovereign namespaces by sector
Each sector operates its own namespace as a sovereign domain. These names are governance anchors — the infrastructure is neutral and allows each institution to manage its own space.
fi-cr.sol
Finance
Banks, insurers, cooperatives, SUGEF. Financial credentials, verifiable KYC, AML compliance.
go-cr.sol
Government
Ministries, municipalities, autonomous institutions. Verifiable official documents, digital services.
sa-cr.sol
Health
Hospitals, clinics, laboratories. Verifiable clinical records, medical certificates, prescriptions.
ed-cr.sol
Education
Universities, technical colleges, INA. Degrees, certifications, verifiable assessments.
or-cr.sol
Organizations
Professional colleges, chambers, associations. Professional licenses, active memberships.
Professionals as Registration Authorities
Notaries, lawyers, and other professionals with public faith already have the legal authority to attest to a citizen's identity. Attestto turns that in-person act into a cryptographically verifiable digital credential.
The professional verifies
The notary or lawyer verifies the citizen's identity in person — document, biometrics, signature. Exactly what they already do under public faith.
Attestto signs and anchors
The verification is packaged as a Verifiable Credential signed with the professional's key and anchored in a public record. Public faith becomes cryptographic proof.
The professional earns
Each verification generates a commission for the professional who issued it. A lifetime income tied to the active credential — as long as the citizen uses it, the professional earns.
Tools available today
Document verifier
Verify any PDF signed with Costa Rica's Firma Digital. Native cryptographic validation, no Adobe dependency.
verify.attestto.com →PKI trust mirror
Independent public mirror of national PKI roots. Check the status of Costa Rica's Certificate Authorities.
trust.attestto.com →Procurement reviewer
Free tool for public officials. Upload a procurement specification and receive an analysis of technological neutrality, privacy, and open standards compliance.
Coming soonLet's build Costa Rica's infrastructure together
We're looking for institutions, professionals, and developers who want to implement sovereign digital identity in Costa Rica. The infrastructure is open. The code is public. The conversation starts here.
Contact the team