Question 1

What is EUDI?

Accepted Answer

EUDI (European Digital Identity) is the EU-wide framework that lets people prove who they are, online and in person, using a European Digital Identity Wallet. It is set out in the eIDAS 2.0 regulation and covers the wallets themselves, the organisations that issue documents into them, and the organisations that request and check those documents — under one set of rules that holds in all 27 member states.

Question 2

What is the European Digital Identity Wallet (EUDIW)?

Accepted Answer

The EUDI wallet is a free app that every member state must make available to its citizens, residents, and businesses. It holds government-issued identity and other official documents — an ID, a mobile driving licence, a diploma, a professional licence — and presents them to a service in seconds. The holder decides what is shared each time, and can share a single attribute instead of a whole document.

Question 3

Can EUDI wallets sign documents?

Accepted Answer

Yes. Besides holding and presenting credentials, every EUDI wallet must let its holder create qualified electronic signatures (QES), free of charge for non-professional use. Under eIDAS a qualified electronic signature has the same legal effect as a handwritten one and is recognised in all 27 member states, so a contract, a consent form, or an agreement can be signed in the wallet in a few taps — no separate signing app, no printing, no scanning.

Question 4

How does signing with an EUDI wallet work?

Accepted Answer

The organisation that needs the signature sends a signing request as a QR code or a link. The holder opens it in their wallet, reviews the document, and confirms with their PIN or biometrics. The wallet identifies the signer to a qualified trust service provider, which creates the signature with a qualified certificate, and the signed document goes back to the organisation. LutraID covers the organisation's side: sending the request and receiving the signed document.

Question 5

What is eIDAS 2.0?

Accepted Answer

eIDAS 2.0 is the 2024 update to the EU regulation on electronic identification and trust services. It obliges every member state to offer a wallet, opens digital identity to the private sector, requires large online platforms to accept the wallet, and fixes the common technical standards — the Architecture and Reference Framework — that let wallets, issuers, and verifiers work together across borders.

Question 6

What are verifiable credentials?

Accepted Answer

A verifiable credential is a digital document signed by the organisation that issued it. Because the signature covers the contents, anyone can confirm the data is genuine and unaltered without calling the issuer. Credentials live in the holder's wallet, so the holder decides who sees them. In the EUDI ecosystem they arrive in one of two formats: SD-JWT VC or ISO mdoc.

Question 7

Who are issuers, holders, and verifiers?

Accepted Answer

Three roles. An issuer — a ministry, a university, a bank, an employer — signs a credential and puts it in someone's wallet. The holder keeps it on their device and presents it when asked. A verifier, also called a relying party, requests exactly the attributes it needs and checks the signature, the issuer's place on the EU trust lists, and whether the credential is still valid. LutraID gives your organisation the issuer and verifier sides of that picture.

Question 8

What is selective disclosure?

Accepted Answer

Selective disclosure means presenting part of a credential instead of all of it. Asked to confirm an age, a wallet can prove "over 18" from an ID without revealing the date of birth, the name, or the document number. Verifiers ask for the minimum their policy needs, which is both a privacy property of the technology and a data-minimisation obligation under GDPR.

Question 9

When will EUDI wallets be available?

Accepted Answer

Member states must offer at least one wallet to their citizens by the end of 2026, and national pilots and rollouts are already running. Nobody has to wait for that date: issuance and verification flows built to the same standards today will work with the national wallets as they arrive.

Question 10

What do we need before we can issue or verify anything?

Accepted Answer

An organisation profile, and the certificates that follow from it. The profile holds the legal name, registration and VAT numbers, addresses, contact points, and logo, and the rest of the platform draws on it — certificate requests cannot be made without it. Fill it in once and you are ready to request the access and registration certificates that put your organisation into production.

Question 11

What are access and registration certificates?

Accepted Answer

Two different things, and issuers and verifiers need both. A registration certificate records that your organisation is entered in a national register as a relying party and states which attributes you are entitled to request. An access certificate is what your service presents to a wallet to prove it is that registered organisation. LutraID tracks the status and expiry of each one, so nothing lapses without warning.

Question 12

Do you help us get registered?

Accepted Answer

Yes. We prepare the submission to the national register, supply the technical details, and keep the registration current as your use cases change. The registration stays in your name and the national supervisory body decides — we cannot grant it, but we can do the work around it.

Question 13

Where do our signing keys live?

Accepted Answer

In hardware security modules. Keys are generated inside the module and the private material never leaves it: signing happens in the HSM and the platform only handles the result. You decide which keys exist and what each one is used for.

Question 14

Can we manage several legal entities?

Accepted Answer

Yes. Parent companies, subsidiaries, and departments can each be their own organisation, with credentials, certificates, and keys scoped to the entity that owns them. Members and API keys are granted per organisation.

Question 15

Who on our team can do what?

Accepted Answer

Access is role-based. You decide who can edit the organisation profile, request certificates, issue, verify, or only read. Every action is written to an audit trail.

Question 16

What can we issue?

Accepted Answer

Any attestation your organisation is entitled to make: diplomas and transcripts, professional licences, memberships, employee IDs, insurance and compliance certificates, or a document type you define yourself. You build a reusable template once — the fields, the validity period, the branding — and issue against it.

Question 17

How does a credential get into someone's wallet?

Accepted Answer

You create a credential offer and hand it over as a QR code, a link, or an email. The holder's wallet opens the offer, authenticates them, and pulls the signed credential over OpenID for Verifiable Credential Issuance (OpenID4VCI). The credential is bound to a key on their device, so a copy in someone else's wallet is worthless.

Question 18

How long does issuance take?

Accepted Answer

A single credential is issued in seconds. Batches run from a CSV upload or the API and process thousands of documents in minutes, depending on the template and how they are delivered.

Question 19

What stops an issued document being altered?

Accepted Answer

The signature. Documents are signed with keys held in hardware security modules, and any change to the contents breaks the signature, so a verifier sees the tampering immediately. Every issuance is recorded for audit.

Question 20

Can we revoke a document after issuing it?

Accepted Answer

Yes. Documents can be suspended or revoked at any time, from the dashboard or the API. The change is published to the status list that verifiers check, so the next verification anywhere in the EU sees the new status.

Question 21

How do we integrate issuance into our systems?

Accepted Answer

Three ways, and you can mix them: issue by hand from the dashboard, upload a CSV for a batch, or call the REST API from your own systems. The data does not have to be stored with us either — we can fetch attributes from your systems or a third-party source at the moment of issuance.

Question 22

Which formats and protocols do you support?

Accepted Answer

SD-JWT VC and ISO/IEC 18013-5 mdoc for the credentials, OpenID4VCI for issuance — the same set in the sandbox as in production, so nothing about the integration changes when you go live.

Question 23

What actually happens during a verification?

Accepted Answer

You publish a request describing the attributes you need. The holder's wallet shows them what is being asked and by whom, and they consent. Your service then checks the signature against the issuer's key, checks that the issuer sits on the EU trust lists, checks that the credential has not been revoked or expired, and confirms it was presented by the device it was issued to.

Question 24

What can we verify?

Accepted Answer

Any EUDI-compliant credential from a trusted issuer: national identity data (PID), mobile driving licences, diplomas, professional licences, company credentials, and anything you issued yourself. Verification works online and in person — proximity flows exchange the credential with the device over a local connection, with the same cryptographic checks.

Question 25

How long does verification take?

Accepted Answer

Real time, typically a second or two. The cryptographic checks are local; what takes any time at all is fetching the issuer's revocation status, which is why a live verification needs connectivity.

Question 26

What data do we receive?

Accepted Answer

Only what your policy asked for. You define the attributes per use case and the wallet releases nothing else — often a statement rather than a value, such as "over 18" or "licence valid" instead of a birth date or a licence number. Asking for less is also the safer position under GDPR: data you never received is data you do not have to protect.

Question 27

How do we know a credential has not been revoked?

Accepted Answer

Every credential points at the status list its issuer publishes. LutraID checks that list at the moment of verification, so a document revoked this morning fails this afternoon's check.

Question 28

Do we have to contact the issuer?

Accepted Answer

No. The signature is checked against the issuer's public key from the EU trust lists, so authenticity does not depend on the issuer being online — or on the issuer learning who is asking about whom. Only the revocation status is fetched, and it is published for everyone rather than answered per request.

Question 29

How do we integrate verification?

Accepted Answer

Verify by hand from the dashboard, or call the REST API from your access control, onboarding, or back-office systems and take the result on a webhook. Policies are configured per use case, so each flow requests exactly its own set of attributes.

Question 30

How do we get started?

Accepted Answer

On the free Sandbox plan. It is the real platform with unmetered test transactions, issuer and verifier, SD-JWT VC and mdoc, and no card. Build and test the full flows there, then move up to Starter when you want production traffic.

Question 31

Can we run LutraID on our own infrastructure?

Accepted Answer

Yes, though SaaS is the usual route. Where a regulator, a risk function, or an internal policy requires it, we package the full solution for self-hosted or on-premise deployment. That sits under the Partner plan, together with the integration work around it.

Question 32

Who operates the managed platform?

Accepted Answer

Lutra Labs, from Maribor, Slovenia. The platform, the company, and the people running it are all in the EU, and a data processing agreement under GDPR Article 28 is part of our standard terms on every plan, Sandbox included.

Question 33

What do we get when procurement starts asking?

Accepted Answer

The compliance pack: the DORA Article 30 contractual provisions, our technical and organisational measures, the sub-processor register, and the security whitepaper. From Business it also covers one audit cycle a year; Enterprise adds hands-on audit support and consultancy hours.

Question 34

What support is included?

Accepted Answer

Community support on Sandbox, email support from Starter, and from Business a dedicated channel with a named contact and a 99.9% uptime SLA, rising to 99.95% on Enterprise.

Question 35

How is usage counted?

Accepted Answer

One transaction is one completed wallet interaction. Issuing any number of credentials in a single offer counts as one; verifying a presentation counts as one, however many credentials or attributes it carries; a completed signature request counts as one. Failed and abandoned interactions are free, and sandbox usage is never metered.

Question 36

What if we need something the pricing page does not list?

Accepted Answer

That is what Partner is for: deployment models and volumes we do not list, credential and data modelling done with your team, integration engineering, and a shared roadmap. It is also the route for public bodies, education, and non-profits.

Question 37

What is the European Business Wallet?

Accepted Answer

The EBW is a wallet for companies rather than people. It holds a company's identity and the official documents that go with it — registration extracts, licences, tax and VAT numbers, certifications, insurance — and lets the company present them to public bodies and business partners anywhere in the single market, sealed and instantly checkable.

Question 38

How does it differ from a personal EUDI wallet?

Accepted Answer

A citizen wallet is an app on one person's phone. A business wallet is operated by an organisation and used by many people on its behalf, which changes what it has to do: run server-side, hold several entities and subsidiaries, enforce role-based access, carry mandates that say who may act for the company, and expose APIs so other systems can use it without a person present.

Question 39

What are mandates and powers of representation?

Accepted Answer

A mandate is a verifiable statement that a named person may act for the company, and within what limits. It answers the question every counterparty and public body actually has: not just whether the company is real, but whether this person may sign this, for this company, today. Presented digitally, it replaces the register extracts and signature specimens that answer it on paper.

Question 40

Where does the regulation stand?

Accepted Answer

Still in progress. The European Commission proposed the Business Wallet regulation in 2025, the Council and Parliament are negotiating, entry into force is expected around 2027, and public bodies are expected to accept business wallets from around 2029. The trust framework and the technical specifications are still settling.

Question 41

Should we wait until the rules are final?

Accepted Answer

The parts that will not change — company credentials, qualified seals, mandates, verification against trust lists — can be built now, and the EU's own estimate puts the saving at over €150 billion a year once companies stop re-proving themselves on paper. We track the specification as it moves so that you build against one stable platform instead of a moving target.

Question 42

Can we use a business wallet today?

Accepted Answer

In beta, yes: the European Business Wallet beta is included on the Enterprise plan and quoted separately elsewhere. The pieces underneath it already run in production — issue sealed company documents, verify who you are dealing with, and manage your organisation's certificates and keys.

Knowledge Base

How European digital identity works, and how to build on it.

Dive deeper into EUDI

EUDI Fundamentals

Manage Identity

Issue Documents

Verify Documents

Deployment and Support

European Business Wallet (EBW)