Verifiable Credential Core
Core issues and verifies credentials in the formats the world is standardising on. Then Resolve decides over them. Most implementations start with one credential and one question, and grow into a portfolio of both.
Request a DemoCore is one credential engine serving two markets, built on the ISO stack and the W3C stack.
For governments, national PKI operators and national identity services. Mobile driving licences, eID, residence permits, professional registration, issued at population scale. ISO 18013-5 and ISO 18013-7, W3C VC, standards assurance that survives an audit. Self-hosted, and sovereign by definition: the keys and the data stay inside your jurisdiction.
For banks, telcos, insurers and credit bureaus. Take the government-issued ID your customer already holds, verify it once, and derive a credential for your own purposes. Self-hosted on either the ISO or the W3C stack, or run through the managed portal for smaller implementations.
Same engine. Different scale, different implementation architecture, different buyer.
Whichever market you buy into, the same six capabilities come with it.
Eligibility over the top. The differentiator, not a component. Rules are defined once and evaluated deterministically against verified attributes, returning a decision and the reasoning behind it. Verified is not eligible, and the decision is what you are actually buying.
Read more about ResolveCross-border and cross-issuer trust routing. TrustGrid resolves trust lists, registries and certificate chains so a credential issued under one framework is verifiable under another, without you hand-maintaining a pile of root certificates per country.
The customer-facing identity surface over a derived credential. It turns a handle into a routing decision: which account, and what verification to demand at this moment. Resolving a handle grants nothing on its own.
The holder side. Ship the KeyFlux wallet to your users, or embed the SDK in the app they already have. Native OID4VCI and OID4VP, device-bound keys, selective disclosure. Banks and telcos generally take the SDK, because the app is already the relationship.
A function of the wallet, not a separate service. The wallet is the secure file vault for signed documents, so signing and holding sit together on the holder side. The signature is bound to a verified identity presented from the device the signer holds, not to a session someone logged into.
Read more about SignStandards monitoring across the framework corpus, included in both tiers rather than sold separately. Your implementation is tested continuously against ISO 18013-5, ISO 18013-7, OID4VCI, OID4VP, HAIP, SD-JWT and W3C VC, in your pipeline, before a gap reaches production.
The mechanics underneath. Issuance and verification are the table stakes. Resolve is the part you cannot buy anywhere else.
Issuance, lifecycle, revocation and status, with format conversion between stacks. Credentials are minted against your own PKI, and the issuing keys stay where your regulator expects to find them.
Cryptographic signature verification, status checks, issuer trust validation and certificate chain walking. A presentation is accepted because it verifies, not because it looks right.
W3C VC, ISO mdoc and SD-JWT VC through a single integration point. You write to one API and the format argument stops being your problem.
The software runs in your own tenancy or your own data centre, with your own PKI. Suited to government issuance and to regulated institutions with data residency obligations. Foundational issuance runs this way, which is what makes it sovereign: jurisdiction over the keys and the data sits with you.
We run it, through the managed portal. Suited to smaller derived implementations that do not carry national-scale obligations and want to be issuing before they are provisioning infrastructure.
Interoperable credentials, not proprietary lock-in. If you leave, your credentials still work.
Bring one credential and one question. We will show you the decision, and the reasoning behind it.
Request a Demo