Organisation Wallet Suite Overview
The Organisation Wallet Suite by iGrant.io, recognised as the European Business Wallet, enables organisations to issue, hold, and verify digital credentials for legal persons and organisations. It is available both as an on-premise solution and as a Platform as a Service (PaaS) with multi-tenant capabilities.
The OWS suite is built on the eIDAS 2.0 framework, incorporating Regulation (EU) No 910/2014 together with its amendments in Regulation (EU) 2024/1183 and Regulation (EU) 2024/2977, as well as the latest Implementing Acts under the European Digital Identity (EUDI) Framework.
Supported Attestation Types (EUDI Wallet Ecosystem)
The Organisation Wallet Suite supports the following attestation and identification data types as defined by the EU Architecture Reference Framework (ARF) under eIDAS 2.0:
| Credential | Description |
|---|---|
| PID (Person Identification Data) | Core identity attributes for natural persons (name, date of birth, nationality) |
| LPID (Legal Person Identification Data) | Identity attributes for legal entities (company name, registration number) |
| EAA (Electronic Attestation of Attributes) | Attributes issued by non-qualified trust service providers |
| QEAA (Qualified Electronic Attestation of Attributes) | Attributes issued by QTSPs with the highest legal standing across all EU Member States |
| PuB-EAA (Public Electronic Attestation of Attributes) | Attributes issued by public sector bodies from authentic sources |
| Payment Wallet Attestations | Attestations enabling payment-related use cases within the EUDI Wallet ecosystem |
Formats supported: IETF SD-JWT VC, ISO/IEC 18013-5 mdoc/mDL, and W3C VC (JWT).
Core Capabilities
The Organisation Wallet Suite provides three core functions: Issuer, Holder/Wallet Unit, and Verifier/Relying Party, all accessible within an enterprise tenant via the OpenID4VC protocol suite.
Issuer
The Organisation Wallet Suite acts as a credential issuer using the OpenID for Verifiable Credential Issuance (OpenID4VCI) protocol.
In-time and deferred credential issuance: Pre-Authorised (with PIN) and Authorisation Code Flow with PKCE, supporting automated batch or invitation-based issuance.
Dynamic credential issuance: Request additional proof from the holder before issuing a credential.
Credential definitions: Reusable credential configurations that define the claims, output format, validity and visual branding (name, description, colours, logo). One credential definition can hold several credential configurations, which are then offered to the holder together.
Credential revocation: Supports IETF Token Status List. Revocation is final: credentials are not suspended, and a revoked credential cannot be made valid again.
Key configuration: Configure signing keys via the integrated Key Management Service, and sign with
x509certificate chains that wallets can check against trusted lists. See Key Management.Webhook notifications: Real-time updates at each stage of the issuance lifecycle (for example offer retrieved, token issued, credential issued, credential accepted, revoked and expired).
Holder / Wallet Unit
The Wallet Unit (WU) enables organisations (companies, institutions, or departments) to securely receive, store, and present digital credentials, much like individuals use personal wallets.
Receive and store credentials from trusted issuers (government authorities, regulators, data providers) with secure cloud storage.
Present credentials to relying parties for verification.
Role-based access and delegation for users within the organisation.
The Wallet Unit can also be integrated into a Natural Person Wallet that supports such integrations.
Verifier / Relying Party
The Organisation Wallet Suite functions as a verifier using the OpenID for Verifiable Presentations (OpenID4VP) protocol, enabling secure validation of verifiable credentials held by individuals or organisations.
Receive and present credentials: Holders respond to presentation requests with selective disclosure support.
Send and verify credentials: Define credential requirements, initiate verification, and validate presentations.
Presentation definitions: Reusable verification requests based on a DCQL query (
dcqlQuery), with support for multiple credential queries in a single request.Webhook notifications: Real-time updates throughout the verification process (request retrieved, presentation received, declined and revalidated).
Platform Features
Multi-tenant with self-service: Supports multiple organisations within a single instance with data privacy and segregation, and a self-service interface for credential issuance and verification management.
Interoperability: Integrates with existing systems and supports data portability across platforms using OpenID4VCI/OpenID4VP (JWT/SD-JWT).
Multiple attestation types: Modular architecture supporting various EAAs, QEAAs, and PuB-EAAs, with the ability to incorporate new credential types without system overhauls.
Multiple trust sources: Supports trust anchors (CA certificates that you add), EU trusted lists (ETSI TS 119 612) and lists of trusted entities (ETSI TS 119 602). See Trust in the Wallet Ecosystem.
Webhook support: Real-time notifications throughout issuance and verification workflows for enterprise system integration. See the webhooks documentation.
Security and data privacy: Cryptographic functions complying with SOG-IS/BSI CSP2 security standards, with data protected in transit and at rest. Privacy considerations adhere to eIDAS 2.0 requirements, addressing unobservability and unlinkability.
Governance, security and operations
Role-based access and user management: Access to the administration interface is governed by a role-based policy engine evaluated per route and method, with distinct administrator roles and separately scoped API keys for configuration, audit, service and onboarding operations. Administrator and team management, including creating, listing and removing administrators and assigning their role, is available through the Enterprise Dashboard and the configuration API. Access for external officials is delegated to the organisation's own IAM through OpenID Connect federation.
Audit logging: The platform keeps two separate logs. The Activity Logs record administrator sign-ins, rejected sign-in attempts and locked accounts, every API call that changes data, every webhook the platform sends and the changes made by the platform operator, each with the actor's account, the action and a timestamp. Entries never contain an e-mail address. Administrators can view the Activity Logs in the Enterprise Dashboard or through the API, but no user can delete an entry; the platform removes entries after a retention period set by the operator (30 days by default). In addition, the organisation wallet keeps its own audit log of every change to its audited data and every rejected or failed operation, with the actor, the request and a timestamp. These entries are hash-chained per organisation, and when the operator configures a write-once storage bucket, a signed anchor of the chains is written to that bucket every hour. By default, the operator retains this audit log for 7 years and can verify it and export it for an organisation.
Issuance statistics: The issuer counts its issuance histories in buckets (in progress, expired, denied, issued and revoked), both for the whole organisation and for each credential definition, and the administration interface shows these statistics. A wallet provider also sees how many wallet units it has, and how many of them are active or revoked.
Localisation and internationalisation: The Enterprise Dashboard uses externalised string catalogues for each language, and users can switch language at runtime. Catalogues are provided for English, Swedish, Norwegian and Spanish, and further languages can be added as new catalogues.
Accessibility: Public-facing interfaces are designed to conform to Directive (EU) 2016/2102 and the harmonised standard EN 301 549 at WCAG 2.1 level AA.
Deployment Options
The Organisation Wallet Suite is available in two deployment models: as a service hosted by iGrant.io (PaaS), or on your own infrastructure (on-premise). For an on-premise installation, the Helm chart platform and the Docker Compose files are in the platform-deployment repository, and iGrant.io gives you access to its image registry. For an enterprise installation, for example with your HSM, iGrant.io gives you access to a separate chart repository on request: contact [email protected]. See the on-premise deployment guide for setup instructions.
Both deployment models share the following defaults:
| Feature | Default | Configurable options |
|---|---|---|
| Key Storage | iGrant.io managed key store (OpenBao), HSM-as-a-service, QTSP (CSC API v1.0.4.0 or v2.2.0.0) | Bring your own key store (OpenBao, HashiCorp Vault, Google Cloud KMS, AWS KMS, Azure Key Vault or your HSM), FIDO2, external QTSP |
| Credential and Metadata Storage | PostgreSQL | Not configurable |
| Identity Management | Built-in identity and access management. Customer IDAM integration available as an additional offering. | OpenID Connect |
The key difference between the two models is infrastructure:
| Model | Infrastructure |
|---|---|
| On-Premise | Any Kubernetes cluster (Helm chart), for example RedPill Linpro (Sweden), GCP, AWS or Azure, or one Docker host (Docker Compose) for tests, pilots and small installations |
| PaaS | Kubernetes Cluster with region selection: RedPill Linpro (Sweden), GCP, AWS, or Azure |
Key Management Options
| Option | Description |
|---|---|
| iGrant.io managed key store | Default option where iGrant.io manages key storage (OpenBao) and liability. |
| Your own key store | Bring your own key management system (OpenBao, HashiCorp Vault, Google Cloud KMS, AWS KMS or Azure Key Vault, with or without HSM), offloading key storage liability to your organisation. |
| External QTSP | Third-party QTSP integration via a value-added reseller (VAR) model, transferring key management and signing liabilities to the external provider. |
EUDI Wallet Ecosystem Roles
The following roles are defined by the EU Architecture Reference Framework (ARF) under Regulation (EU) 2024/1183 (eIDAS 2.0):
| Role | Definition |
|---|---|
| Wallet Provider | A natural or legal person who provides Wallet Solutions. Member States either mandate or recognise Wallet Providers to make a Wallet Solution available to Users. |
| PID Provider | A natural or legal person responsible for issuing and revoking Person Identification Data (PID) and ensuring that the PID of a user is cryptographically bound to a Wallet Unit. PID Providers are appointed by Member States. |
| Attestation Provider | A collective term for QEAA Provider, PuB-EAA Provider, or (non-qualified) EAA Provider. |
| QEAA Provider | A Qualified Trust Service Provider (QTSP) that issues QEAAs meeting the requirements laid down in Annex V of the eIDAS Regulation. QEAAs carry the highest legal standing with a presumption of accuracy across all EU Member States. |
| PuB-EAA Provider | A public sector body responsible for an authentic source, or designated by a Member State, that issues electronic attestations of attributes in accordance with Article 45f and Annex VII of the eIDAS Regulation. |
| EAA Provider | A non-qualified Trust Service Provider that issues EAAs, governed by sectoral rules rather than the eIDAS QTSP trust framework. |
| Relying Party | A natural or legal person that relies upon electronic identification, European Digital Identity Wallets or other electronic identification means, or upon a trust service. |
| QTSP | A Qualified Trust Service Provider who provides one or more qualified trust services and is granted qualified status by the supervisory body. |
For the full list of definitions, see ARF Annex 1 - Definitions.
Getting Started
Ready to explore the Organisation Wallet Suite? Here are your next steps:
- Developer documentation: Protocol versions, API references, and supported features.
- On-premise deployment guide: Set up the suite on your own infrastructure using Helm charts.
- Issuance workflow: Issue your first credential using the OpenID4VCI protocol.
- Verification workflow: Verify credentials using the OpenID4VP protocol.
- Webhooks: Integrate real-time event notifications into your enterprise systems.
For access to the hosted platform or to discuss enterprise requirements, contact [email protected].