Self-sovereign identity: can you really own your identity?

Self-sovereign identity (SSI) is the idea that a person, not an institution or a platform, should be in control of their digital identity: holding their own credentials, deciding what to share and with whom, and not depending on one company's account to exist online. Some of this is real today. A wallet like Tamga Wallet keeps documents on your phone, shares only what you approve and never asks a central server for permission. Other parts are not. The documents still come from institutions, and a trust list still decides whose signature counts. "You control how your documents are used" is accurate; "you issue your own identity" is not.

Where does the term "self-sovereign identity" come from?

The phrase was used before, but the version most people quote comes from an essay by Christopher Allen, "The Path to Self-Sovereign Identity", published on 26 April 2016. Allen described online identity moving through stages. First came centralised identity, where one authority issues and controls your account. Then came federated and user-centric identity, where you could sign in to many sites with one provider and had some say over what was shared. He called that "an important step toward true user control of identity, but just a step". Self-sovereign identity, in his words, "requires that users be the rulers of their own identity".

He then proposed ten principles. They are still the reference point when people argue about what SSI should mean.

What are the ten principles, and where does Tamga Wallet stand?

The table below sets each principle next to what Tamga Wallet does today. The right-hand column is meant to be read critically: some rows are met, some only partly.

Allen also wrote that identity "can be a double-edged sword", and that a system "must balance transparency, fairness, and support of the commons with protection for the individual". That sentence matters for the rest of this post. The principles were never a promise that a person could do without institutions.

Why is "self-sovereign" a debated term?

There are three common criticisms, and each has a point.

"Sovereign" overstates it. Most of what makes a document useful is that someone else vouches for it. A diploma matters because a university issued it; an identity credential matters because someone checked your ID. You can hold and control the document, but its value comes from the issuer. Calling that "sovereignty" can mislead people into thinking they can declare facts about themselves and have them accepted.

It became tied to particular technologies. For a while SSI was often presented together with blockchains and new kinds of decentralised identifiers. Many of the ideas do not need either. Tamga Wallet uses the same document formats and protocols as the EU's wallet framework, and Tamga Network is not a new blockchain.

The movement itself argues about what was lost. In October 2024 Allen published an essay asking whether the SSI ecosystem had become "morally bankrupt". He argued that, in pursuit of adoption, the community had compromised on decentralisation and was in danger of becoming "indistinguishable from the very systems we set out to disrupt". You don't have to agree with him to see that the term is contested even among the people who shaped it.

What part is real today?

Several things Allen asked for in 2016 are now written into law and standards. The EU's digital identity regulation, Regulation (EU) 2024/1183, requires that wallets let users request, store, select and present their data under their own control (Article 5a(4)), that users have full control of the use of and of the data in their wallet (Article 5a(14)), and that issuers cannot track how a document is used after it is issued (Article 5a(16)). The regulation keeps institutions firmly in the picture; what it limits is what they can see afterwards.

In Tamga Wallet that turns into concrete behaviour:

• The documents are on your phone, not in an account. There is no Tamga account and no password; nobody else holds a copy.
• You approve every share. The approval screen shows who is asking, which fields and for what purpose. A site asking for more than its registered purpose triggers a separate warning.
• You share only what is needed. A cinema can see "is a student" without your name or department: Selective disclosure.
• Places cannot join their records about you. Each verifier gets its own copy of a document and each site its own pseudonym: Unlinkability.
• Checking a document doesn't involve the issuer. A verifier checks a document against public lists, so the institution does not learn where you used it: No central database.

Where do institutions and trust lists still matter?

In most of the chain.

• Issuing. A document is only as good as its issuer. You cannot add a PDF or a photo yourself; a document always comes from an institution.
• Deciding who is trusted. The verifier doesn't trust a signature on its own. It looks the issuer up in a signed trust list that says which institutions may issue which document types. In the EU this is how member states' lists work too. Someone has to run those lists, and in Tamga Network that role is planned to pass to the state or a body it authorises.
• Recognising the wallet. Institutions check that your app is a genuine wallet on a phone with secure hardware. That check runs through the wallet provider, which is listed in the trust list.
• Revoking. If your university revokes a document, it stops working. Holding it does not make it valid.

None of this goes against the idea of user control. It means control is about how your documents are used, not about where their authority comes from.

How portable is a Tamga Wallet document?

Less than the word "portable" suggests, and on purpose.

Each document is bound to a key created in your phone's secure hardware, and that key never leaves the phone. That is what stops someone who copies your document from showing it in your place. The price is that you cannot simply copy your documents to another device. When you move phones, a password-protected file carries your document list and history, and you get the documents themselves again from the institutions: Move to a new phone. Neither Tamga Wallet nor its wallet provider holds a recovery key on your behalf, so no one at the centre can open your wallet either.

Portability works better at the level of standards. The documents use open formats, and Tamga Network recognises any wallet that follows its rules, not only Tamga Wallet. Tamga Wallet is the network's first wallet; it has no special position in it. Today the wallet reads Tamga Network's trust lists; reading the trust lists of the EU and its member states comes later. Tamga Wallet is EU-aligned and independent, and it is not one of the EU's official wallets: what EU alignment means.

So, promise or reality?

Both. The parts of SSI about holding your own documents, consenting to each use, revealing as little as possible and not being tracked can be built today, and Tamga Wallet does build them. The parts that suggest a person can stand alone without institutions were never realistic for documents whose value comes from who issued them. A fair description is "user-held, institution-issued": the institution vouches, and you decide how its word is used.

Frequently asked questions

Is Tamga Wallet a self-sovereign identity wallet?

It meets several SSI principles, such as user-held documents, consent, minimal disclosure and protection from tracking, but its documents are issued by institutions and checked against trust lists. We describe it as an EU-aligned digital identity wallet rather than claiming the SSI label.

Can I create my own credentials in Tamga Wallet?

No. A document always comes from an institution that has joined Tamga Network. That is what makes it verifiable.

Does SSI require a blockchain?

No. User-held documents, consent and selective disclosure work with ordinary digital signatures and signed lists. Tamga Network is not a new blockchain.

If the institution can revoke my document, do I really control it?

You control how it is used: who sees it, which fields and when. Whether it is still valid is the issuer's call, as it is with a paper document.