No central database: why your data isn't in one place

Tamga Wallet has no central database of people's documents. Your documents are stored on your phone, encrypted; the institution that issued a document keeps its own record in its own system, as it already did; and Tamga Network keeps only a signed list of which institutions are trusted, with no personal data in it. The wallet provider that recognises your copy of the app keeps a technical record of the installation, not your documents.

Where are my documents actually stored?

On your phone. When an institution gives you a document, it is written to the wallet on your device and encrypted there (AES-256-GCM, with a key that exists only on that phone). Each document is bound to a key created in the phone's key store, the Secure Enclave on iPhone or the Keystore on Android, and that key never leaves the device. Neither Tamga Wallet nor Tamga Network keeps a copy of the document.

The same goes for your history. What you showed, to whom and which fields went with it is recorded only on your phone. The network's wallet rules say this record never goes to a server or into a server backup; it leaves the phone only if you export it yourself as a password-protected file.

Then who keeps what?

A system without a central store still has records. They are spread out, and each party keeps only what its own job needs.

The institution that issued the document

Your university keeps your student record, as it did before any wallet existed. The network's design leaves that record where it is: the institution remains the authoritative source, and when a document is renewed, the institution reads the information again from its own system. For revocable documents the institution also knows which status-list positions belong to which document, and the rules say that mapping never leaves the institution.

Tamga Network

The network keeps a trust list: a signed, versioned list of which institutions may issue which document types, which verifiers are registered and which wallet providers are recognised. The network's trust list rules state that no list, anchor log or change log contains personal data, documents or document hashes. A list holds institution names, certificate fingerprints, statuses, dates and addresses.

Tamga Network also runs the identity service, used when you verify your identity remotely to get an identity credential. Its rules are strict about what stays afterwards: once the credential is issued, only an opaque reference, a hash of the document number, the validity period and the status positions remain. Images of your ID and face are never stored at Tamga. The verification provider that handles those images may, by contract, keep them for up to 30 days; if you ask for deletion, the record is deleted, the credentials are revoked and the images are deleted at the provider.

The wallet provider

The wallet provider is the service that confirms to institutions that your app is a genuine Tamga Wallet on a phone with a secure key store, and that lets you close your wallet if you lose your phone. According to Tamga Wallet's privacy policy, it keeps the fingerprint of the wallet's key, the app version, the registration time, the revocation status, the result of the device check (only the level: secure chip or software) and, if you set one, a one-way fingerprint of your revocation code. It holds no name, no documents and no device identifier, and the servers do not log IP addresses.

The places you show documents to

A website or a desk that receives a document keeps what it received under its own rules. Tamga cannot delete that for it. What the wallet can do is limit what goes there in the first place, and help you ask for deletion afterwards: open the sharing in History and use "Ask them to delete my data": Ask for deletion or report.

Why not just keep everything in one secure place?

Because a single place that holds everyone's documents is a single target. However well it is protected, one successful attack, one insider or one misconfigured backup exposes everyone at once. When documents are spread across people's phones, an attacker who wants a million documents needs a million phones, each locked with its owner's PIN and phone lock.

There is a quieter risk too. A central service that every check passes through can also see every check: which document was shown, where and when. Over time that becomes a record of people's lives that nobody set out to build. The EU's digital identity regulation addresses this directly: Article 5a(16) of Regulation (EU) 2024/1183 says the wallet framework must not let issuers or any other party obtain data that allows users' transactions or behaviour to be tracked or correlated after a document is issued.

Tamga's design avoids the problem at its source. A verifier checks a document against the trust list and the institution's status list, which it downloads in bulk at intervals (how status checks stay private); nobody is asked at the moment of checking. So there is no central log of where you showed what.

Does no central database mean no risk?

No. It moves the risks, and some of them land on you.

• Your phone matters more. If you lose it, your documents go with it. They stay encrypted and locked, and you can close the wallet from any browser with the revocation code shown once at setup: I lost my phone. But there is no cloud copy to restore; you get your documents again from the institutions (what happens if you lose your phone).
• Institutions still hold databases. The wallet does not make your university's records disappear. It avoids creating a new, extra place where everything from every institution is pooled.
• What you share is out of your hands. Once a verifier has received a field, it is in that verifier's system. That is why the wallet asks before every share, shows a warning when a site asks for more than its registered purpose, and lets you share only part of a document (selective disclosure).
• Services still keep records. The network's identity service and the wallet provider keep the small records described above. Their rules, retention and deletion are written down so that you can check them, and the wallet's privacy policy says openly that it is pending legal review.

How is this different from a national ID database?

A national population register exists for the state's own purposes and will keep existing; a wallet does not replace it. The difference is in how a document is shown. With a register-based check, the person checking often queries the register, which can see the query. With a wallet, the document carries the issuer's signature, so it can be checked offline against public lists, and the issuer does not learn about the check. The document came from an authoritative source once; showing it does not go back to that source.

Frequently asked questions

Does Tamga keep a backup of my documents?

No. Neither Tamga Wallet nor Tamga Network keeps a copy. When you move to a new phone, a password-protected move file carries your document list and history, and you get the documents themselves again from the institutions.

Can Tamga see which sites I show documents to?

No. Presentations go from your phone to the verifier, encrypted. Verifiers check revocation from lists downloaded earlier, and your history stays on your phone.

What does the trust list contain?

Institutions, verifiers and wallet providers: their names, certificate fingerprints, permitted document types, statuses and addresses. It contains no personal data and no documents.

If I reset the wallet, what is deleted?

Everything on the phone: documents, keys, pseudonyms, history and the PIN. Your records at the identity service and your wallet record at the wallet provider are deleted too. Data that institutions hold in their own systems stays with them; you can ask them from History.