Skip to main content

UbID Wallet

UbID Wallet is the holder-facing product for protected credential custody, consent, presentation, and device continuity. It gives a person or organization a controlled place to receive credentials, understand what they represent, and decide when to present them.

The wallet is not a copy of an issuer's database. It holds portable signed artifacts and the protected material required to use them, while issuers remain responsible for the claims they issue and verifiers remain responsible for acceptance decisions.

Holder control​

Holder control means the wallet supports meaningful decisions by the person or organization using it:

  • whether to accept an offered credential;
  • which credentials are stored;
  • what information a verifier is requesting;
  • which claims will be disclosed;
  • which relying party will receive them;
  • whether a presentation should proceed;
  • which devices remain authorized;
  • when a device or credential should be removed from active use.

Control does not mean the holder can alter an issuer's signed claims. Any modification would invalidate the cryptographic protection or require a new credential from the issuer.

Protected custody​

The wallet protects credentials and private material through layered controls. Publicly, the design principles are:

  • sensitive material is encrypted before persistent storage;
  • cryptographic secrets are not published with public identity data;
  • access is bound to approved user authentication and device state;
  • temporary keys and decrypted material are kept only as long as required;
  • credential data is separated from operational and analytics data;
  • backup and recovery do not create an unrestricted institutional master secret.

The exact storage formats, key derivation parameters, device secrets, and recovery packages are not part of public documentation.

Before a presentation, the wallet should help the holder understand:

  • who is requesting information;
  • what purpose is declared;
  • which credential types or claims are requested;
  • whether the request is bound to a specific transaction;
  • what data will be disclosed;
  • whether additional information can be withheld.

Where supported by the credential format, selective disclosure allows the wallet to present only the claims required for the transaction rather than the complete credential.

Credential and document custody​

A wallet may hold different kinds of protected content:

  • verifiable credentials issued by trusted institutions;
  • identity credentials;
  • educational and professional credentials;
  • document-derived credentials;
  • protected documents or evidence artifacts;
  • status and metadata required to understand lifecycle state.

A stored document is not automatically a verifiable credential. The wallet should clearly distinguish original files, extracted information, issuer-signed credentials, and verification outcomes.

Multi-device continuity​

UbID supports controlled multi-device use rather than unrestricted synchronization. New devices may require approval, and lost or compromised devices can be revoked without necessarily invalidating the holder's entire identity.

Continuity controls should address:

  • authorized-device registration;
  • secure transfer or re-provisioning;
  • visibility of active devices;
  • revocation and replacement;
  • re-evaluation after recovery;
  • prevention of silent credential duplication.

Relationship with other products​

  • UbID Credential Cloud issues credentials to the wallet.
  • UbID Proof supports identity and document assurance.
  • UbID Access authenticates access to wallet functions.
  • UbID Recover restores continuity under guarded authorization.
  • UbID Connect supports trusted exchange with issuers and verifiers.

What this product does not decide​

The wallet does not decide that a credential is legally sufficient for a transaction. It presents evidence and holder authorization; the verifier applies trust and business policy.

Holder control also does not remove institutional responsibilities. Issuers still manage accuracy and status, and platform operators must protect services, data, and support processes.

Public documentation boundary​

Public documentation explains holder control, consent, custody, presentations, device lifecycle, and recovery relationships. Private keys, encryption envelopes, device secrets, internal storage schemas, synchronization protocols, and recovery material remain restricted.

See also Selective Disclosure, Credential Lifecycle, and UbID Recover.