Attestto is open-source public infrastructure for sovereign digital identity. It provides W3C-compliant Decentralized Identifiers (DIDs), Verifiable Credentials, a peer-to-peer mesh network, and ledger anchoring — all without central servers or vendor lock-in. Licensed under Apache 2.0.

Identity, signature, anchoring, recovery, and verification are free for citizens, forever. Commerce-layer features (professional credential issuance, module marketplace) have fee structures that fund the free tier.

What standards does Attestto use?

Attestto uses only W3C, IETF, and ISO standards: W3C Decentralized Identifiers (DIDs), W3C Verifiable Credentials, and ISO 18013-5 for mobile driving licenses. Two DID methods (did:pki and did:sns) are on the W3C standards track. No proprietary formats.

Can a government fork Attestto?

Yes. Every component is open source under the Apache 2.0 license. Any government can fork the entire stack and deploy it independently, without depending on Attestto. That's by design — public infrastructure should never create vendor dependency.

How does Attestto protect privacy?

Attestto uses selective disclosure by default — you share only what's needed. Your keys stay on your device, your data never leaves without your consent, and the peer-to-peer mesh network verifies credentials without calling a central server. Every credential can be revoked and every key can be deleted.

Your identity. Your proof.

Why we built open infrastructure for sovereign identity — and why it matters that no one owns it.

The world as it is

Identity is something someone else confirms

In most of the world, proving who you are means carrying a physical card, presenting it to an institution, hoping they believe it, and trusting that whoever holds your data won't misuse it.

Your identity exists only when someone else says it does. A government office. A bank. A platform. If they lose your record, revoke your access, or simply close for the day — you stop being provable.

This isn't a technology problem. It's a design choice. And it can be redesigned.

What goes wrong

When identity depends on someone else

🌍

The professional whose credentials don't travel across borders.

✍

The family whose last name was misspelled at the civil registry — half of them exist under different identities.

💰

The small business that can't prove it's real to a foreign partner without paying a $15,000 compliance intermediary.

🔒

The vendor who locks five million citizens into a proprietary identity system with no export, no interoperability, and a renewal clause that doubles the price.

These aren't hypothetical. They're happening now, in the countries where we live and build.

The insight

Identity doesn't have to be a favor

Identity can be a mathematical proof you carry yourself. W3C Decentralized Identifiers and Verifiable Credentials make this technically possible. A cryptographic key pair on your device. A credential signed by an authority you choose to trust. A proof you present without revealing more than you must.

The technology exists. What didn't exist — until now — was open infrastructure to make it deployable. Not a product. Not a platform. Public infrastructure, like roads or the postal service. Anyone can use it, anyone can verify it, anyone can fork it.

See the standards we built → Try the verifier →

What we built

Three layers, zero central servers

Institutional trust

Existing authorities (governments, professional bodies, universities) issue verifiable credentials signed with their own keys. We don't replace them. We give them a standards-based channel to issue digitally what they already issue on paper.

Mesh verification

A peer-to-peer network where every node can verify credentials independently, offline, without calling a central server. The credential holder controls what they share and with whom.

Ledger anchoring

Cryptographic timestamps on a public ledger prove that a credential existed at a specific time. Not the content — just the proof that it was issued. Immutable, auditable, independent of Attestto.

Every component is open source (Apache 2.0). Every standard is W3C or IETF. Any government can fork the entire stack and never depend on us. That's the point.

100+

countries operate sovereign PKI hierarchies

Each one is an island. A certificate issued by Costa Rica is unverifiable in Panama. did:pki bridges them all through a single resolver endpoint.

What we ask of ourselves

Eight commitments, not eight features

Infrastructure earns trust by what it refuses to do, not by what it promises. These aren't marketing principles. They're constraints we enforce in code.

Sovereignty Your keys, your device, your data. No custodian.
Interoperability W3C, IETF, ISO standards only. No proprietary formats.
Privacy Selective disclosure by default. Share only what's needed.
Full portability Fork it, export it, migrate freely. Your data comes with you.
Reversibility Revoke any credential. Delete any key. No permanent traces.
Transparency Open source, open governance, open audit.
Neutrality Chain-agnostic, stack-agnostic. You choose the technology, not us.
Public good Free for citizens, forever. Commerce pays for commerce.

My family's last name is split across the Costa Rican civil registry. A clerical error at birth registration. Half of us exist under one spelling, half under another. Two different legal identities for the same family.

I didn't build Attestto because I read a whitepaper. I built it because I'm a case study.

— Eduardo Chongkan, founder

See what we've built

Explore the standards → Architecture → GitHub →