# Aegis by Protoworks > Aegis is an identity platform by Protoworks: configurable verification, verifiable credentials on open standards, a holder wallet, and privacy built into the data model. Aegis is built and published by Protoworks Group (Pty) Ltd (https://protoworks.dev), registration 2026/556877/07, South Africa. It is offered to partners on request and is not yet a public service; its public API is coming soon. Contact: rpeters@protoworks.dev. Security: security@protoworks.dev. ## What Aegis is An identity platform in parts that share one event history and one privacy model: verification flows over many providers decided by a pure, replayable engine; verifiable credentials issued to the person; a holder wallet; Symbolon, a trust registry deciding claim by claim when one organisation may rely on another's verification; a sealed vault for personal data; and a fraud graph read by pure detectors, where only a person designates fraud. "Built" below means implemented and tested in the platform today. "In progress" means partly built or specified and being built. Conformance runs against published suites are recorded; formal certification follows hosted deployment. ## Pages - [Overview](https://aegis.protoworks.dev/): the platform in one page. - [Verification](https://aegis.protoworks.dev/verification): Configurable flows that orchestrate every check a person must pass, decided by a pure engine. - [Credentials](https://aegis.protoworks.dev/credentials): A verification becomes a credential the person holds, issued on open standards and revocable. - [Wallet](https://aegis.protoworks.dev/wallet): The holder app: keys in hardware, selective disclosure, in person and online. - [Symbolon](https://aegis.protoworks.dev/symbolon): The trust registry that decides, claim by claim, when one verification can serve another party. - [Data protection](https://aegis.protoworks.dev/data-protection): A sealed vault for personal data, rights handled as typed obligations, and an audit trail that cannot be rewritten. - [Fraud](https://aegis.protoworks.dev/fraud): Signals sealed at capture, and a graph that finds what two parties share without revealing either. - [Standards](https://aegis.protoworks.dev/standards): Every protocol and specification the platform implements, and how far each one has come. - [Assurance](https://aegis.protoworks.dev/assurance): The regulatory regimes the platform is built for, and the engineering that holds it to them. - [Developers](https://aegis.protoworks.dev/developers): The API, coming soon: the shape it takes and how to ask for early access. ## Standards ### Issuance and presentation - OpenID for Verifiable Credential Issuance 1.0 (OpenID Foundation) — Built. Issuer, and holder in the wallet core: pre-authorised and authorisation-code flows, pushed requests, proof keys, sender-constrained tokens, wallet attestation. - OpenID for Verifiable Presentations 1.0, with DCQL (OpenID Foundation) — Built. Verifier and holder: cross-device and same-device, signed and encrypted responses, several documents in one request, transaction data. - OpenID4VC High Assurance Interoperability Profile 1.0 (OpenID Foundation) — In progress. The high-assurance profile across issuer, verifier and wallet. - Digital Credentials API (W3C) — In progress. The verification surface asks the browser for a credential; the wallet registers as a credential provider with the phone. - ISO/IEC TS 18013-7 (ISO/IEC) — In progress. Online presentation of mobile documents to the verifier. ### Credential formats - Selective Disclosure for JWTs (RFC 9901) (IETF) — Built. Issue, hold and verify, with key binding. - SD-JWT-based Verifiable Credentials (IETF) — Built. Issue, hold and verify, with type metadata and its integrity. - ISO/IEC 18013-5 mobile documents (mdoc, mDL) (ISO/IEC) — Built. Issue signed documents, verify presentations, hold and present in the wallet, with reader authentication and its PKI. - Verifiable Credentials Data Model 2.0 and Data Integrity 1.0 (W3C) — In progress. Linked-data credentials with ECDSA and EdDSA cryptosuites, held and presented whole. - Securing Verifiable Credentials using JOSE and COSE (W3C) — In progress. JWT-secured credentials, held and verified. - AnonCreds 1.0 (Hyperledger) — In progress. Issuer over DIDComm, with revocation and predicate proofs such as “over 18” without the birth date. Holder in the wallet core. ### Status and revocation - Token Status List (IETF) — Built. The issuer owns a status list for everything it issued; verifiers check it and fail closed. Also revokes wallet attestations. - Bitstring Status List 1.0 (W3C) — Built. Issued and evaluated for linked-data credentials. ### Trust frameworks - Trusted lists (ETSI TS 119 612) (ETSI) — Built. Read and verify national and European trusted lists, the list of lists included. - Lists of trusted entities (ETSI TS 119 602) (ETSI) — Built. Build and sign lists as an operator, from the trust registry. - Relying-party registration certificates (ETSI TS 119 475) (ETSI) — Built. Issue and verify the certificates that say what a relying party may ask a wallet for. - XAdES and JAdES signatures (ETSI) — In progress. Advanced electronic signatures on trusted lists, in XML and JSON. - European Digital Identity Wallet framework (European Commission) — In progress. Relying party for person identification data in both formats; transaction binding; registration certificates. - OpenID Federation 1.1 (OpenID Foundation) — In progress. Entity statements and trust-chain resolution. - Trust Registry Query Protocol 2.0 (Trust over IP) — In progress. Answer whether a party is authorised, from the trust registry. - eIDAS levels of assurance (European Union) — In progress. A typed level on every credential and digital-ID sign-in; below a tenant’s minimum is refused, never downgraded. ### Identifiers and messaging - Decentralized identifiers: did:web, did:key, did:jwk (W3C) — Built. Issuer keys and client identifiers. - did:webvh 1.0 (Decentralized Identity Foundation) — In progress. Verifiable history for web-hosted identifiers, resolved in-house. - DIDComm Messaging v1 (Hyperledger Aries) — Built. Offer, issue, revoke and notify for anonymous credentials, through a standards-conformant agent. ### Authorisation and identity - OAuth 2.0 with PKCE (RFC 7636) and pushed requests (RFC 9126) (IETF) — Built. The issuer’s authorisation server. - Demonstrating Proof of Possession (RFC 9449) (IETF) — Built. Every issuer token is bound to the wallet’s key; a stolen token is useless. - Attestation-based client authentication (IETF) — Built. Wallets prove they are a genuine, unmodified instance before they are issued anything. - Hardware key and app attestation (Platform vendors) — Built. The wallet provider checks the phone’s own evidence before it vouches for a wallet or a key. - OpenID Connect Core 1.0 and Discovery 1.0 (OpenID Foundation) — In progress. Sign-in to the consoles through the identity provider; a relying party for national eID schemes. ### Platform and API - OpenAPI 3.1 (OpenAPI Initiative) — Built. Every service publishes its contract; every client is generated from it. - Problem Details for HTTP APIs (RFC 9457) (IETF) — Built. Every error leaves as a typed problem document. - Standard Webhooks (Standard Webhooks) — Built. Every delivery to a tenant is signed and timestamped. - CloudEvents 1.0 (CNCF) — Built. The envelope of every integration event inside the platform. - Transparency log and trusted timestamps (RFC 9162, RFC 3161) (IETF) — In progress. An append-only audit log per tenant with signed checkpoints and inclusion proofs. ## This site No cookies, no analytics, no tracking. Every demonstration runs in the browser and sends nothing. - [Security policy](https://aegis.protoworks.dev/.well-known/security.txt) - [Protoworks](https://protoworks.dev): the engineering studio that builds Aegis.