Separate countries, one network: how instances trust each other without sharing data
In Essence's architecture, personal data belongs on country instances, not in a central store. In July we built the means for those instances to trust each other on terms that are recorded, checked and withdrawable.
A government department, a regulator or a bank is often asked for two things at once: keep people's data in the country, and work with organisations beyond it. On a platform that is one large system in one place, those demands pull against each other.
Essence is put together differently. Personal data belongs to the country it comes from, and the links between countries are recorded, checked and can be taken back. Our July release completed the part that makes those links explicit.
Separate instances, one network
Essence is a set of instances rather than one central system. Country instances serve people and organisations in their own jurisdiction. Our build includes three, for Great Britain, Germany and the United Arab Emirates. A central service coordinates the network.
Our target architecture, set in April 2026, divides the work between them. A country instance holds everything personal: vaults, encrypted documents, sign-in, devices, consent and document sharing. The central service holds what the network needs in common: the register of which instances exist, the published definitions of documents and fields, platform administration and audit verification. It is a coordination hub, not something people use.
The rule that ties this together is short. No personal data is to flow to the central service. What it receives is limited to aggregated figures, hashes and metadata about the network itself.
Trust that is written down
Separate instances still have to recognise each other. A request may start in one country and need to be accepted in another. For a public body or a regulated organisation relying on the boundaries, the terms of that recognition matter as much as the boundaries do.
So we wrote down the rules the platform is built to enforce:
- trust is a required part of bringing an instance into the network;
- a request from another instance is accepted only where there is an active trust between the two;
- when a trust is revoked, requests from that instance stop being accepted;
- sign-in within a single instance is never affected.
Those four rules make trust something that someone owns.
What our July release built
In our July release, the machinery behind those rules was completed and wired into the platform.
The platform's services can tell whether a request from another instance is covered by an active trust between the two.
Trust is part of approval. When an administrator approves a new country instance joining the network, the trust between that instance and the central service is created and verified at the same time. Joining the network and being trusted by it are one step.
Trust is visible. Administrators have a console that lists every trust, shows which are pending, and lets them verify or revoke each one. A revocation is a deliberate act with a clear owner.
The federation service also began recording which organisations are enrolled with which instance, so the network knows where each organisation belongs.
Residency as structure
Data residency is often offered as a promise: your data will stay in a particular country. We think it holds better as structure. If personal data sits on the instance for its country, and the coordinating service is never meant to receive it, the promise is part of how the system is assembled.
Explicit trust is the other half. A network of separate instances is only as sound as the links between them, and recording each link is what lets the shape of the network be read from a single list.
For a regulator, the question of which instances trust which has an answer in a record rather than on a slide. For an organisation, working with people in another country does not, by default, require their data to come to you or to a central store. If you are deciding where your people's data should live, and how a network can cross borders without moving it, we would be glad to talk it through.
Published 28 July 2026