Identity for your product, without the PII in your database
Integrate TrustNet once over standard OpenID Connect. Your users authenticate with TrustNet; your service receives a pairwise subject and only the claims the user approved. No PII to store, no cross-service correlation, and a verifiable consent audit trail you can export.
https://id.trustnet.app/.well-known/openid-configuration
Add one provider to your existing NextAuth, Passport, or Spring Security client. Users arrive with a stable subject and approved claims.
Smaller compliance scope, stronger data protection
Three properties do the heavy lifting for your security review and your DPO: you hold no PII, the data TrustNet does hold is encrypted, and every consent decision is provably logged.
Reduced GDPR scope
Store only a pairwise subject ID, your permissions, and your own business data. No names, no emails, no birth dates — the identity data stays with TrustNet, so your breach blast radius shrinks to your own records.
Encrypted PII
The identity data TrustNet holds is envelope-encrypted before it is stored, and looked up only through blind indexes — never in plaintext columns. The pairwise salt lives in a vault and never in code or config.
Verifiable consent audit
Every consent, access, and revocation is written to an append-only, tamper-evident log that records claim names, never values. Export the history for your DPO — CSV or JSON-LD, with timestamps and versions.
You cannot leak what you never stored
TrustNet separates authentication from identity representation, so your database holds a stable pseudonymous key instead of personal data. Better still, you can require the verified fact — “this account has a verified phone” — without ever receiving the phone itself. TrustNet brokers the PII; you receive the assertion.
verified_* claim is not PII in your system — and because
your service holds only a pairwise subject, an erasure or revocation
propagates as a signed event and your copy becomes unlinkable.
New claims later? Escalation is built in.
Requirements change. When your service needs a claim the user has not shared yet, TrustNet runs the escalation consent flow: the user sees exactly the new claim and its reason, and approves or declines it. No re-integration, and no re-asking for what was already granted.
Additive, not all-or-nothing
Already-granted claims stay granted; only the new claim is put
to the user. Derived verified_* facts can be
requested without revealing the source value, including claims
the account verified but never shared.
Decline is a first-class outcome
If the user declines, you receive the claim as absent — never a partial leak. Consent is per-claim, per-service, and recorded in the audit trail.
Encrypted at rest, isolated by construction
TrustNet's own blast radius is engineered down: identity data is encrypted before storage, lookups never touch plaintext, and the one secret that could correlate personas lives in a vault.
Envelope encryption
Attribute values are encrypted with per-key envelope encryption before they reach the personas database. A database dump yields ciphertext, not identities.
Blind-index lookups
Searching by a value (find the account for this email) goes through an HMAC blind index — never a plaintext column. Equality lookups work; the value stays hidden.
Pairwise isolation
Each service sees a distinct subject derived per persona and client. Two services cannot join records for the same human, and the salt never leaves the vault.
A consent trail you can prove, not just assert
Consent and access events are append-only and tamper-evident. The log records which claim names were approved or revoked — never the values — and exports as a signed history for compliance.
Everything your platform stops having to build
From the first integration to identity recovery, TrustNet takes over the parts of identity that are expensive, compliance-heavy, and undifferentiated.
OIDC login
Integrate once; TrustNet becomes your IdP. Standard discovery, no SDK, no custom auth code.
Reduced GDPR scope
Store only a subject ID and your own business data. No PII means a smaller breach surface.
Standardized consent
TrustNet runs the consent flow instead of your team building and maintaining it per product.
Dynamic claims
Ask for exactly what you need; receive only the claims the user approved for this service.
Compliance reports
Exportable consent history and audit logs with timestamps and versions for your DPO.
Identity recovery
Users change email or phone; your stable subject keeps working. No re-provisioning.
Cross-service identity
Two services recognize the same user through different, uncorrelatable personas.
Delegated lifecycle
MFA, password reset, recovery, and email verification are TrustNet's job, not yours.
One provider. Standard OIDC. No identity lifecycle to build.
Point an OpenID Connect client at TrustNet and request the claims your product needs. TrustNet authenticates the account, runs consent, projects the approved claims, and owns recovery and MFA.
Bring identity in without bringing the liability
Read the integration spec against your local stack, or take the data-protection model to your DPO and security review.