Platform

A control plane for digital trust

proConsul is the orchestration layer — the policy engine and control tower — that brokers credential verification, issuance, presentation, status, and timestamping across a coordinated set of trust services. It integrates with existing identity providers and registries, delegates all cryptographic operations to TrustVault via an HSM-broker, and exposes flows built around OpenID for Verifiable Credential Issuance (OID4VCI), OpenID for Verifiable Presentations (OID4VP), W3C Verifiable Credentials, Decentralized Identifiers, and ISO/IEC 18013-5 mDL.

Platform at a glance

One coherent platform for trust operations

proConsul is not a monolith — it is a coordinated set of deployable services with a strict internal contract: the API gateway admits traffic, the policy/orchestration engine sequences service calls, five specialised trust services (verification, issuance, presentation, status-list, TSA) execute narrow operations, and TrustVault via an HSM-broker signs everything. Together they present as a single control plane to the integrator.

Stateless orchestration engine

The policy/orchestration engine evaluates declarative policy rules and sequences calls to downstream trust services — it holds no credential state between steps. This stateless design means the orchestration layer scales horizontally without any inter-replica coordination, while durable state (credential records, status-list entries, audit events) remains in the Postgres registries.

Integrates with existing infrastructure

proConsul federates with existing IdPs via OpenID Connect and SAML 2.0 at the gateway — no replacement of existing identity infrastructure is required. It consumes TrustVault for key custody and PKI operations rather than implementing its own CA, and exposes credential flows over OID4VCI and OID4VP so that relying parties and wallets can integrate using standard protocol libraries.

Audit-ready by architecture

Every credential transaction — issuance, presentation, verification, revocation, status-list update — produces an immutable audit event timestamped by the TSA service (RFC 3161-aligned). Append-only event records in the Postgres audit stream and status-list entries in W3C StatusList2021 format give compliance teams a complete, cryptographically-anchored evidence chain without requiring a separate logging overlay.

Deployable as a coordinated service set

All components deploy as containerised services behind the API gateway, on-premises or in a private cloud. The orchestration layer and trust services are stateless; only the Postgres registries and Vault cluster require persistent storage. The HSM-broker can address a hardware HSM on-site or TrustVault in a hybrid configuration, making the topology adaptable to sovereignty and security requirements without code changes.

proConsul system overview: frontend portals, orchestration APIs, TrustVault cryptographic services and external identity providers unified into a single governance platform.

proConsul integrates frontend portals, orchestration APIs, TrustVault cryptographic services and external identity providers into a unified governance platform. Click to zoom.

Policy engine & orchestration

Define, enforce and monitor every policy

The policy/orchestration engine is the decision-making core of the platform. It evaluates rules against the verified subject context produced by the identity plane, then directs the downstream trust services — verification, issuance, presentation, status-list, TSA — to execute specific operations in the required sequence. The engine is intentionally stateless: it reads policy from a versioned policy store and reads subject attributes from the Postgres registry; it never accumulates session state.

Policy definition & evaluation

Policies govern every credential operation: which attribute claims are required for issuance, which credential formats are permitted (W3C VC SD-JWT, ISO mdoc), what the minimum trust level is for a given relying party, how long a credential is valid, and under what conditions revocation is mandatory. Policies are versioned, auditable, and evaluated at runtime — the engine resolves the current policy version for every incoming request, so policy changes take effect without redeployment. Attribute constraints can reference DID-bound subject records in the Postgres registry or live assertions from a federated IdP.

Multi-step orchestration sequences

A single credential issuance transaction can require the orchestration engine to call the registry for attribute validation, place the request in an approval queue, call the issuance service (which calls the HSM-broker for signing), call the status-list service to allocate a revocation bit-index, and call the TSA service for a timestamp — all before returning a response to the caller. The engine tracks which steps have completed and which are outstanding, and can resume an interrupted sequence from a durable checkpoint rather than restarting from scratch.

Routing & service selection

The orchestration engine selects which verification, issuance, or presentation service instance to invoke — routing by credential type (OID4VCI credential format, ISO mdoc variant), by jurisdiction (for data-residency compliance), or by capability (e.g. a service instance with an attached hardware-backed HSM). Routing rules are part of the policy configuration, not hardcoded; adding a new credential type or jurisdiction requires a policy update, not a code change.

Policy enforcement & observability

Every policy evaluation — pass, fail, or escalation — is recorded as a structured event in the Postgres audit stream and timestamped by the TSA service. Operators can query the policy decision log to audit exactly which rule was applied to a given transaction and what the attribute values were at evaluation time. OpenTelemetry traces span the full orchestration sequence, enabling per-step latency attribution across the gateway, orchestration engine, and downstream trust services.

proConsul policy pipeline: request flows from the gateway through services to data stores and Vault mounts, with governance enforced at every step.

The proConsul policy engine orchestrates request flows from gateway through services to data stores and Vault mounts, enforcing governance at every step. Click to zoom.

Admin consoles & dashboards

Purpose-built for the teams who run trust

Dedicated interfaces for operations teams, security analysts and compliance officers.

Operations console

Manage day-to-day credential issuance, verification and lifecycle management. Monitor system health, process approval queues, handle exceptions and coordinate with identity providers and relying parties.

  • Dashboard with real-time metrics
  • Approval queue management
  • Exception handling workflows
  • System status monitoring

Security & threat management

Enterprise-level threat-intelligence routing and incident-response coordination. Integrate fraud signals from idGuard AI, external feeds and security monitoring systems. Coordinate response actions across the ecosystem.

  • Threat intelligence aggregation
  • Fraud signal processing
  • Incident response coordination
  • Risk scoring and analytics

Compliance & audit dashboard

Comprehensive compliance monitoring and evidence management. Generate reports for regulatory oversight, track policy enforcement, review audit trails and manage data-subject-rights requests under GDPR and equivalent frameworks.

  • Audit log review and export
  • Compliance report generation
  • Data-subject-rights management
  • Regulatory evidence collection

Analytics & insights

Operational intelligence for strategic decision-making. Analyse usage patterns, identify optimisation opportunities, track service-level agreements and forecast capacity requirements across your digital identity infrastructure.

  • Usage analytics and trends
  • Performance metrics tracking
  • Capacity planning insights
  • Service quality monitoring

Integration layer

Designed to fit your existing infrastructure

proConsul is engineered to fit into an existing enterprise or government trust fabric rather than requiring a greenfield build. Each integration point uses standard protocols, so existing deployments of identity providers, registries, and wallets can connect without bespoke adapters.

Identity provider federation

The API gateway federates with existing IdPs — national identity systems, population registries, and enterprise directories — via OpenID Connect and SAML 2.0. OAuth 2.0 authorisation servers issue the access tokens that gate OID4VCI issuance flows. OpenID Federation is supported for cross-border trust chain discovery, enabling a relying party's trust anchor to be resolved dynamically from a federation registry rather than pre-configured bilaterally. Subject identifiers from federated IdPs are bound to W3C Decentralized Identifier (DID) records in the Postgres registry, providing a stable, resolver-addressable subject reference throughout the credential lifecycle.

Credential issuance & verification protocols

Credential issuance flows are built around OpenID for Verifiable Credential Issuance (OID4VCI): the credential endpoint, pre-authorised code flow, and proof-of-possession JWT semantics. Credentials are issued as W3C Verifiable Credentials (SD-JWT VC or JSON-LD) or as ISO/IEC 18013-5 mobile Driving Licence (mDL) mdoc structures, depending on the credential type policy. Presentation and verification flows are built around OpenID for Verifiable Presentations (OID4VP): the presentation service generates authorisation requests with Presentation Definitions, and the verification service validates the returned VP tokens and ISO mdoc DeviceResponse structures. All protocol alignment is described as engineered-to-align-with the relevant specifications; deployment conformance testing is a separate step for each integration.

TrustVault & HSM-broker integration

proConsul consumes TrustVault for all cryptographic operations — it does not implement its own CA or key-generation routines. The HSM-broker is the sole service that crosses the boundary between proConsul's internal service zone and the TrustVault secure zone. It exposes a signing API (PKCS#11-compatible, JWK key references) that the issuance service calls with a serialised to-be-signed payload and a key handle. TrustVault executes the signing operation (ECDSA P-256 or P-384, as required by the credential format) inside the HSM and returns the signature bytes. The PKI hierarchy managed by TrustVault — IACA root, DSC, end-entity certificates — is referenced by the verification service when resolving issuer trust chains during credential validation.

Wallet & relying party integration

Credential holders (including the idGuard wallet) interact with proConsul over OID4VCI issuance endpoints and OID4VP presentation endpoints — the same protocol surface used by any conforming wallet. The issuance service returns credentials in the format the holder requested (W3C VC or ISO mdoc); the presentation service accepts VP tokens from any OID4VP-capable wallet, not only idGuard. Relying parties that already implement OID4VP or ISO/IEC 18013-5 proximity/remote flows can integrate against proConsul's presentation service without changes to their verification logic.

Observability & SIEM integration

Structured audit events from the Postgres event stream are exported in standard log formats (JSON, CEF) to enterprise SIEM platforms and SOC tooling. OpenTelemetry traces and Prometheus-compatible metrics cover every service boundary — gateway, orchestration engine, each trust service, and the HSM-broker. Security operations teams get per-operation visibility: which credential type was issued, which relying party requested a verification, which policy version was evaluated, and what the TSA timestamp was for each event.

Ready to see proConsul in action?

Schedule a demonstration to see how proConsul can transform your digital trust infrastructure.

Request a demo View technical architecture