Transport
CamDX
The national data exchange, built on Estonia's X-Road. Every government integration travels through it. We must become a member.
AttaID · ATTA-KH
One identity across all our applications — and the only Cambodian identity layer that speaks to the government's own systems.
CamDX · CamDigiKey · Delivery plan
01 · Where the value actually is
What anyone can copy
Keycloak already speaks Khmer. Theming and translation get a competitor a localised login screen in a week. Sign-in, sessions, password resets — all commodity.
What they cannot
Membership of CamDX and a working CamDigiKey integration. That is a door only the government opens, and a commune app or a farmer cooperative will never walk through it alone.
We integrate with the government once. We serve the long tail many times.
That sentence is the company. Everything in this deck serves it.
02 · The four government systems that matter
Transport
CamDX
The national data exchange, built on Estonia's X-Road. Every government integration travels through it. We must become a member.
Identity
CamDigiKey
National eKYC and authentication. Scan a QR, prove who you are. Our only realistic route to strong verified identity.
Documents
verify.gov.kh
Checks that a document or credential is genuine. Feeds our evidence records once membership is live.
Future
IPIS
The emerging national population register. We design the connection point now and depend on none of it yet.
03 · How CamDX works
A Security Server is a dedicated, hardened machine that signs and encrypts every exchange. It is our end of the government pipe, it holds the keys that prove we are us, and operating one is a condition of membership — not an optional extra.
04 · Joining CamDX
Only CamDX can give us
What we control
The one question we must ask this week
Members today are mostly ministries and banks. Which member class would we fall into? If the answer is a queue, we wait and keep building. If it is an eligibility bar, we need a government sponsor — and that changes the company's plan, not just the project's.
05 · What running the gateway means
Two
gateways in production, so one machine failing does not cut us off from the government entirely.
2 / 4 / 100
cores, GB memory, GB disk. Ubuntu LTS. Modest hardware, published install guides, ready-made automation scripts.
Weeks
to recover if we lose the keys — a paperwork process, not a technical one. They get escrowed on day one.
It runs on its own isolated host with no application code on it, and its admin panel never faces the internet. This is the machine that proves AttaID is AttaID to the government, so it is treated like a vault, not like a server.
06 · CamDigiKey
That process is called KYC — know your customer — and it is a legal requirement for anything touching money. It is expensive and it carries liability.
The commercial argument, in one line
Verify a person once. Every app we serve consumes the result — with proof of where it came from — instead of paying to do their own checks and storing sensitive documents they would rather not hold.
We store the outcome and never the evidence: no ID numbers, no face images, no document scans.
07 · How a CamDigiKey sign-in works
We request a login token
AttaID asks CamDigiKey to start a session and gets back a one-time code.
We show a QR code
The only part the citizen ever sees. They scan it with the government app.
They confirm with their face
CamDigiKey checks the person and approves the request on their phone.
We exchange it for a token
Proof that a verified person just authorised us — signed, and only for us.
We record the result
The account is marked strongly verified, with an expiry date. No documents kept.
Nine published operations in total — sign-in, token refresh, sign-out, profile lookup and organisation accounts among them. We wrap the government's own library rather than writing any of this ourselves.
08 · One architecture decision to take now
What we assumed
That Keycloak — the off-the-shelf engine underneath AttaID — could talk to CamDigiKey with configuration alone, the way it talks to Google.
What is actually true
CamDigiKey uses its own security scheme, not the industry standard one. Keycloak cannot speak it. The government publishes a library that can — and it is written in the same language our platform already uses.
So we build it in our own application layer, and use the government's library.
Caught now, this is a diagram change. Caught in month seven, it is a rewrite in a language nobody on the team writes. It is the single most valuable thing this review turned up.
09 · Why we do not have to wait
Public today
Gated behind membership
We build and test the whole integration now, against a stand-in.
When the credentials arrive we swap them in. That turns the government integration from a three-month project that starts after approval into a two-to-four-week finish — which is the difference between an answer and an excuse when someone asks how soon we can go live.
10 · The shape of the next eight months
The top bar has no end because we do not control it. Everything below it is designed so that waiting costs us nothing.
11 · What could go wrong
| Risk | Why it matters | What we do about it |
|---|---|---|
| Membership refused | No government verification, and the defensible part of the business goes with it. | Ask about member class this week. If a sponsor is needed, find that out in month one, not month six. |
| Nobody outside integrates | Farms Nexus and CashEW are ours. Proving we can connect to ourselves is not proof of a market. | Name one target outside the company now — and build for them from day one: our own apps connect through the same public interface a stranger would, with no shortcuts. |
| Apps depend on us with no way out | We ask apps to delete their own identity data. If AttaID stops, their logins stop — including ours. | Write the exit terms before the first outside integration, not during the negotiation. |
Ten further engineering findings — account takeover, data correlation, recovery — are documented separately and are all fixable inside the plan above.
12 · What I need from you
1
Authorise the CamDX application
And name who owns chasing it. It is a relationship and a queue, not a ticket, and it is the longest lead time we have.
2
Farms Nexus drops its own farmer records
It reads them from AttaID instead. Ours to decide, and it is what makes the first milestone real rather than a demo.
3
CashEW consumes one verified detail
Rather than collecting it. Without this we are a login button, which is the outcome worth avoiding.
4
Half a day for the architecture decisions
Nine choices that are an afternoon now and months of rework later.
And one question I cannot answer for you: who is the first organisation outside this company that we want using AttaID? If we can name them, the plan has a target. If we cannot, that is the most useful thing to come out of this meeting.
The whole plan, in one line
Everything else we ship while it is opening.