Architecture
Three parties, cryptographically separated.
The individual, the business, and the agency never share a raw identifier. Everything sensitive lives inside a sealed platform layer; everything outside it works on tokens. Here's how the pieces fit.
The system
Tokens cross the boundary. Identifiers never do.
Clients & partners
Consent widget
Encrypts the identifier in the browser
Partner systems
Store tokens, never identifiers
Partner console
Operators act by token reference
encrypted ID
token
encrypted ID · token
Sealed platform layer
The encryption boundary — raw identifiers never leave
API Gateway
Multi-tenant entry · auth, consent, routing
issue request
Tokenization Engine
Mints the opaque token · seals the identifier
seal at rest
Identity Vault
Sealed identifiers, encrypted at rest
resolve at filing only
Resolution Engine
Token → identity, at filing time only
Audit Logger — append-only, per-tenant record of every access above.
filing
receipt
filing · receipt
Agencies
IRS
MeF & FIRE transmission
SSA
Wage reporting
Receipt back
Acceptance + redacted document
Tokens & receipts cross the boundary
Raw identifiers stay sealed inside
Core services
Five services, one responsibility each.
Identity VaultThe sealed store
Holds verified identifiers encrypted at rest under keys wrapped by a managed key-management service (HSM-backed in production). Nothing reads it directly; access is bounded to the resolution path and logged.
Tokenization EngineThe boundary
Mints opaque, scoped tokens bound to a specific authorization. Tokens are not derivable from the identifier and are the only thing that leaves the layer.
API GatewayThe front door
Multi-tenant entry point for consent, filing, and webhooks. Enforces key scopes, domain restrictions, rate limits, and routes each request to the right tenant lane.
Audit LoggerThe record
Writes an append-only, per-tenant log of every action — operator, system, or GitOps; SIEM and compliance export is on the roadmap.
Resolution EngineThe one exception
The only component that can map a token back to identity, and only at transmission time to complete protected fields. The mapping never leaves the sealed layer.
The encryption boundary
Where plaintext can and cannot exist.
Inside the sealed layer
- Plaintext identifiers exist only transiently, only during resolution.
- Keys never leave the key-management service; resolution requires it.
- Every access is written to the append-only audit log.
Outside the boundary
- Partner systems, consoles, and your code see only tokens.
- Data is encrypted in the client before it reaches our edge.
- Documents returned to partners have sensitive fields redacted.
Multi-tenancy & hosting
Every tenant gets isolated workspaces on Othentity-owned subdomains.
A business <tenant> is provisioned with both a Sandbox and a Live workspace, each hosted under Othentity subdomains — never the tenant's own domain.
| Surface | Sandbox | Live |
|---|---|---|
| Tenant dashboard | sandbox.<tenant>.othentity.com | <tenant>.othentity.com |
| Tenant API | api.sandbox.<tenant>.othentity.com | api.<tenant>.othentity.com |
| Shared API root tenant create / delete only | api.othentity.com | |
| Customer dashboard where individuals manage consent | customer.othentity.com | |
Webhook receiving endpoints stay on the tenant's own domain — e.g. api.meridianfin.com/othentity/events. Those are the tenant's servers, not Othentity infrastructure.
Availability
Engineered for the filing peak.
Filing is seasonal and unforgiving — the platform is designed to hold up at the W-2 / 1099 deadline crush.
99.998%
Internal engineering target for backend production infrastructure.
99.99%
Committed enterprise SLA for production tenants.
~10m
Allowed downtime per year at the internal target (≈10 min 31 s).
Async
Bulk filing is queued and retried, decoupled from request latency.
Targets reflect current engineering goals and roadmap, not commitments outside a signed enterprise SLA.
Build on it
Ready to wire into the gateway?
We're onboarding design partners now — tell us your stack and we'll scope the integration with you.