Electronic Identification, Authentication and Trust Services 2.0

Digital identities must remain inviolate and immune to forgery since they are legally binding.

ProvenRun provides a unified, high-assurance approach to modernize identity infrastructure and ensure eIDAS 2.0 compliance.

Unified compliance for eIDAS 2.0

High-assurance sovereignty and recovery

THE PROBLEM

Why Traditional Architectures Fail eIDAS 2.0

eIDAS 2.0 requires identity wallets to scale to millions of users while maintaining complex multi-tenant isolation and supporting diverse mobile hardware.

Traditional architectures cannot meet these requirements without compromising on security guarantees or certification scope.

Scaling trust to millions of users
Complex isolation of multiple tenants
Rigid hardware requirements for mobile devices

THE SOLUTION

ProvenRun's Approach

We secure the Wallet Secure Cryptographic Application within our EAL5+ certified HSM platform⁽¹⁾, acting as a network-attached secure device. This architecture provides a pragmatic and scalable path to meeting regulatory deadlines while ensuring strong isolation and built-in attestation for the entire wallet lifecycle.

_{(1) Certification is ongoing}

Wallet-native secure cryptographic device
Massive isolation with independent tokens
Built-in attestation and signed audit logs

EUDI Wallet: Secure WSCD & WSCA Solutions

ProvenHSM provides an assurance foundation for Independent Software Vendors (ISVs), Qualified Trusted Service Providers (QTSPs), and Trust Service Providers (TSPs) building the future of European digital identity.

ARCHITECTURE

Why Use Network HSMs as Trust Foundation

As Europe prepares for the 2026–2027 eIDAS v2 rollout, network-attached HSMs have emerged as the most practical and scalable option.

Serve millions of citizens without requiring secure hardware on each device

Fit naturally into existing audit and oversight models used by TSPs

Maintain full digital sovereignty by keeping sensitive operations in government-controlled data centers

The Pillars of Trust

ProvenHSM is a WSCD-ready appliance engineered to host these components in a sovereign, auditable, and high-assurance environment.

By separating crypto trust from service logic, it establishes clear governance boundaries and enables regulators, operators, and ISVs to work from a dependable, pre-certified foundation.

This means developers can deploy WSCA applications without rebuilding complex security infrastructure from scratch.

A Ready-Made Secure Foundation for ISVs

ProvenHSM is designed to accelerate development and reduce overhead for software vendors.

WSCA applications run inside a Common Criteria–certified execution environment, allowing teams to focus on business logic, user value, and innovation rather than building a secure base layer.

Thanks to compositional certification (unique to ProvenHSM), applications inherit assurance from the platform, lowering entry barriers and enabling a more interoperable and vibrant digital identity ecosystem.

Efficiency for QTSPs & Government Operators

For QTSPs and public-sector operators, ProvenHSM simplifies operations end-to-end:

Applications Run in a Controlled Zone With Predictable Interfaces

FEATURES

A Proven Commitment to High-Assurance Security

Across architectures (Arm and RISC-V), evaluation schemes (Common Criteria, SESIP, PSA Certified), and industry partners, ProvenRun consistently demonstrates that high-assurance, formally-verified security can scale to real-world products. These certifications reflect our ongoing commitment to delivering operating systems that meet the needs of regulated industries, safety-critical infrastructures, and next-generation IoT platforms.

BENEFITS