Social
Telegram
Widely used across Cambodia for everyday messaging, and already a provider seam in our codebase.
AttaID · ATTA-KH
One identity across all our applications — built for how Cambodians actually sign in, and bridged to the government's own systems.
Telegram · Facebook · Phone · CamDigiKey
01 · Who signs in, and how
Social
Telegram
Widely used across Cambodia for everyday messaging, and already a provider seam in our codebase.
Social
The account many citizens have when they have no email address at all.
Phone
SMS code
For the farmer with a phone and no email. A code by text, no password to remember.
Existing
Farms Nexus · CashEW
Accounts people already hold. They keep their history and never re-register.
Every one of these is a door into the same identity.
A farmer taps “Log in with Telegram” and is in. Verified, government-grade identity through CamDigiKey comes later — only when an app actually needs it. The plan's job is to make sure four doors lead to one person, not four.
02 · Where the value actually is
What anyone can copy
Keycloak ships forty languages and Khmer is not one of them — but that gap is a translation file, not a moat. Any competitor closes it in a week. Sign-in, sessions, password resets: all commodity.
What they cannot
Membership of CamDX and a working CamDigiKey integration. That is a door only the government opens, and a commune app or a farmer cooperative will never walk through it alone.
We integrate with the government once. We serve the long tail many times.
That sentence is the company. Everything in this deck serves it.
03 · The government systems that matter
Transport
CamDX
The national data exchange, built on Estonia's X-Road. Every government integration runs over it. We must become a member.
Identity
CamDigiKey
National eKYC and authentication. Scan a QR, prove who you are. Our only realistic route to strong verified identity.
Documents
verify.gov.kh
Checks that a document or credential is genuine. Feeds our evidence records once membership is live.
Future
IPIS
The emerging national population register. We design the connection point now and depend on none of it yet.
04 · How CamDX works
X-Road is decentralised: our Security Server connects straight to theirs. The Central Server only publishes who is a member and whose certificates are valid — it never carries a request, and never sees one.
05 · Joining CamDX
Only CamDX can give us
What we control
The one question we must ask this week
We do not know whether a private company qualifies at all. Which member class would we fall into? If the answer is a queue, we wait and keep building. If it is an eligibility bar, we need a government sponsor — and that changes the company's plan, not just the project's.
06 · What running the gateway means
Two
gateways in production, so one machine failing does not cut us off from the government entirely.
2 / 4 / 100
cores, GB memory, GB disk. Ubuntu LTS. Modest hardware, published install guides, ready-made automation scripts.
Weeks
to recover if we lose the keys — a paperwork process, not a technical one. They get escrowed on day one.
It runs on its own isolated host with no application code on it, and its admin panel never faces the internet. This is the machine that proves AttaID is AttaID to the government, so it is treated like a vault, not like a server.
07 · CamDigiKey
That process is called KYC — know your customer — and it is a legal requirement for anything touching money. It is expensive and it carries liability.
The commercial argument, in one line
Verify a person once. Every app we serve consumes the result — with proof of where it came from — instead of paying to do their own checks and storing sensitive documents they would rather not hold.
We store the outcome and never the evidence: no ID numbers, no face images, no document scans.
08 · How a CamDigiKey sign-in works
We request a login token
AttaID asks CamDigiKey to start a session and gets back a one-time code.
We show a QR code
The only part the citizen ever sees. They scan it with the government app.
They approve it in CamDigiKey
The government app checks the person. That check is theirs, never ours.
We exchange it for a token
Proof that a verified person just authorised us — signed, and only for us.
We record the result
The account is marked strongly verified, with an expiry date. No documents kept.
Nine published operations in total — sign-in, token refresh, sign-out, profile lookup and organisation accounts among them. We wrap the government's own library rather than writing any of this ourselves.
09 · One architecture decision to take now
What we assumed
That Keycloak — the off-the-shelf engine underneath AttaID — could talk to CamDigiKey with configuration alone, the way it talks to Google.
What is actually true
CamDigiKey uses its own security scheme, not the industry standard one. Keycloak cannot speak it. The government publishes a library that can — and it is written in the same language our platform already uses.
So we build it in our own application layer, and use the government's library.
Caught now, this is a diagram change. Caught in month seven, it is a rewrite in a language nobody on the team writes. It is the single most valuable thing this review turned up.
10 · Why we do not have to wait
Public today
Gated behind membership
We build and test the whole integration now, against a stand-in.
When the credentials arrive we swap them in. That turns the government integration from a three-month project that starts after approval into a two-to-four-week finish — which is the difference between an answer and an excuse when someone asks how soon we can go live.
11 · The shape of the next eight months
The top bar has no end because we do not control it. Everything below it is designed so that waiting costs us nothing.
12 · What could go wrong
| Risk | Why it matters | What we do about it |
|---|---|---|
| Membership refused | No government verification, and the defensible part of the business goes with it. | Ask about member class this week. If a sponsor is needed, find that out in month one, not month six. |
| Nobody outside integrates | Farms Nexus and CashEW are ours. Proving we can connect to ourselves is not proof of a market. | Name one target outside the company now — and build for them from day one: our own apps connect through the same public interface a stranger would, with no shortcuts. |
| Apps depend on us with no way out | We ask apps to delete their own identity data. If AttaID stops, their logins stop — including ours. | Write the exit terms before the first outside integration, not during the negotiation. |
Seventeen further engineering findings — account takeover, data correlation, recovery, duplicate identities — are documented separately and are all fixable inside the plan above.
13 · What I need from you
1
Authorise the CamDX application
And name who owns chasing it. It is a relationship and a queue, not a ticket, and it is the longest lead time we have.
2
Farms Nexus drops its own farmer records
It reads them from AttaID instead. Ours to decide, and it is what makes the first milestone real rather than a demo.
3
CashEW consumes one verified detail
Rather than collecting it. Without this we are a login button, which is the outcome worth avoiding.
4
Half a day for the architecture decisions
Nine choices that are an afternoon now and months of rework later.
And one question I cannot answer for you: who is the first organisation outside this company that we want using AttaID? If we can name them, the plan has a target. If we cannot, that is the most useful thing to come out of this meeting.
The whole plan, in one line
Everything else we ship while it is opening.