Share what is needed.
Know who is asking.
Selective disclosure shows each party only the field or answer it needs. Every request is signed and carries a mandate that is checked before anything moves.
Most checks still move the whole record.
To answer one question, such as whether a supplier is certified or a licence is valid, organisations often exchange complete records. A login shows who signed in, not on whose behalf they acted.
Here data travels encrypted under keys you control, and each request with its mandate.
Share the record
- Whole records exchanged to answer one question
- Copies kept by every party that asked
- Logins show access, not authority
- Mandates kept on paper and checked afterwards
Share what is needed
- Encrypted under keys you control
- The other party opens only what it needs
- Every request signed by its sender
- Mandates checked before anything moves
How a check works
One check between two organisations.
How a check between two organisations works, step by step.
- 01
A request with a mandate
An employee asks another organisation a question on behalf of their own, for example whether a registration number is valid. The request is signed and carries the mandate it relies on.
- 02
Checked before anything moves
The receiving side checks the signature and the mandate. If either is missing, expired or out of scope, the request is refused and nothing is shared.
- 03
Only the answer travels
The answer comes back as a yes or a no, or as the one field the requester is entitled to. Every other field stays closed.
- 04
Recorded for the auditor
Request, mandate and answer are recorded in the audit trail, so an auditor can later see who asked what and on which basis, without seeing the content.
Compared with logins and signatures
Proves who sent a request
- Logins (OAuth, SAML):
- Per session
- Signed documents (PKI):
- Per signed document
- mintBlue:
- Per request
Shows on whose behalf
- Logins (OAuth, SAML):
- Through roles inside one organisation
- Signed documents (PKI):
- The organisation in the certificate
- mintBlue:
- A mandate with every request
Shares only what is needed
- Logins (OAuth, SAML):
- Depends on each interface
- Signed documents (PKI):
- The whole document
- mintBlue:
- Encrypted under keys you control
Checked before anything moves
- Logins (OAuth, SAML):
- At login
- Signed documents (PKI):
- When the document arrives
- mintBlue:
- On every request
Can be checked afterwards
- Logins (OAuth, SAML):
- In the provider's logs
- Signed documents (PKI):
- Through the signature
- mintBlue:
- In the audit trail
This complements your login system. People still sign in as they do today; mintBlue adds a signature and a mandate to each exchange between departments and organisations.
Frequently asked questions
Privacy
Technical
Next step
Bring the question you have to answer.
Which question does another department or organisation need answered, and what may not leave yours? We work out which fields travel and which mandate each request needs.
Next step
Bring the question you have to answer.
Which question does another department or organisation need answered, and what may not leave yours? We work out which fields travel and which mandate each request needs.