Architecture
Three layers. One passport.
SBX ID keeps the marker of trust on-chain, the sensitive data encrypted off-chain, and the rules in enforceable contracts. Each layer does one job, and none of them ever exposes a document.
How a request moves through the stack.
A platform reads the on-chain credential, the vault releases only what consent allows, and the enforcement layer returns an allow or deny. The data itself never climbs out of the vault.
Credential: the soulbound token
A non-transferable ERC-5192 token minted to the user's wallet. It is the public, verifiable marker that a wallet has been verified. It holds no personal data: only a validity flag, credential class, issuing authority and expiry.
- ERC-5192 soulbound standard
- Revocable and re-issuable
- Any contract can read it
- Zero PII on-chain
Vault: encrypted data on SBX GRID
The documents behind the credential are client-side encrypted and stored on SBX GRID, SUPERBLOCK's decentralised storage. Keys are split with multi-party computation, so no single party, SUPERBLOCK included, can decrypt a record alone.
- Client-side encryption
- MPC-split key custody
- Geo-fenced replication
- GDPR erasure via smart contract
Enforcement: contracts and ZK proofs
A smart-contract layer sits in front of partner platforms. On each transaction it reads the token, verifies a zero-knowledge proof of eligibility, and returns a deterministic allow or deny with an auditable reason code.
- ZK eligibility proofs
- Jurisdiction and class gating
- Reason-coded decisions
- Continuous sanctions re-screen
The principles underneath.
Every design decision follows from four rules: platforms stay responsible, users stay in control, data stays private, and deletion is real.
Reliance, not replacement
Relying platforms keep regulatory responsibility under FATF R.17 and EU AMLD reliance provisions. SBX ID supplies verified data plus a signed consent trail.
Consent is a signature
Nothing leaves the vault without a wallet signature scoped to exactly what was requested. Every release is logged and revocable.
Privacy by proof
Where a platform only needs a yes or no (over 18, accredited, not sanctioned), a ZK proof answers it without revealing the underlying data.
Erasure by design
For GDPR jurisdictions, a smart contract can trigger cryptographic erasure of vault records, making the right to be forgotten enforceable, not just promised.