(download PDF)Sovereign Data Exchange
Organisations that must share data with one another usually do it one bilateral interface at a time. The result is expensive to build, hard to secure and almost impossible to audit as a whole. This paper sets out an alternative based on X-Road, the open-source exchange layer developed by the Nordic Institute for Interoperability Solutions (NIIS), founded by Estonia and Finland. Data moves directly from member to member through security servers at each organisation's edge, every message is signed and time-stamped, and the operator governs trust without holding member data. We cover architecture, trust and identifiers, API management on WSO2, first services and a phased roadmap that leaves the operator in full ownership.
- Point-to-point integration between organisations grows roughly with the square of the number of parties, and every connection carries its own contract, security review and failure mode.
- The X-Road model replaces that web with a shared exchange in which each organisation is a registered member, runs its own security server at its edge, and exchanges signed, time-stamped messages directly with other members.
- The central operator governs the member registry, trust services and global configuration, but sits outside the data path: it holds routing and evidence records, and zero copies of member data.
- Stable four-part service identifiers, a single catalogue and per-service consent rules let providers publish once and let consumers subscribe once, with access enforced at the provider's own edge.