Most Cloud-Native Architecture

Most Cloud-Native Architecture: expert analysis covering cloud infrastructure design, scalability, multi-device synchronization, backup capabilities, and the privacy-convenience tradeoffs of cloud-based EUDI Wallet implementations.

Top Recommendations

Why Cloud-Native Architecture Matters

Cloud-native architecture is essential for serving digital identity at the scale of entire national populations. France Identite demonstrates this with its cloud infrastructure serving 5 million active users, handling peak loads during tax season and enrollment drives without degradation. A cloud-native approach also enables rapid deployment of updates, automatic scaling, and geographic redundancy that ensures the wallet service remains available even during regional outages.

The practical benefits for users are significant. With cloud-based credential storage, losing or replacing your phone does not mean losing your digital identity. France Identite users can set up a new device and have all their credentials restored within minutes, simply by authenticating with their FranceConnect account. This is a major advantage over local-only wallets where device loss requires a complete re-enrollment process that can take days.

For organizations deploying EUDI Wallet verification, cloud-native backend infrastructure means easier integration and lower operational costs. Cloud-based verification services can be consumed as APIs without managing on-premise hardware. Belgium's itsme ecosystem, serving 7 million users, has proven this model with thousands of businesses using cloud-based APIs to verify itsme-based identities through MyGov.be.

How We Evaluated Cloud Architecture

Our evaluation assessed cloud architecture across four dimensions. First, we examined the infrastructure design: is the wallet built on modern cloud-native principles (microservices, containerization, auto-scaling) or is it a traditional application deployed in the cloud? France Identite scored highest with its microservices architecture built on the French government's SecNumCloud-certified infrastructure, designed from the ground up for cloud deployment.

Second, we tested device portability and backup capabilities. We simulated phone loss scenarios and measured how quickly credentials could be restored on a new device. France achieved the fastest recovery at under two minutes. Germany's hybrid approach required re-reading the eID chip but restored cloud-backed credentials quickly. The Netherlands, with its local-first design, required a longer re-enrollment process but offers optional encrypted cloud backup.

Third, we evaluated the security of cloud-stored credentials. This includes encryption at rest and in transit, key management practices, EU data residency compliance, and the ability of the cloud provider to access credential data. All implementations encrypt credentials, but the approaches differ. France uses server-side encryption with client-held keys. Germany encrypts locally before cloud upload. The critical question is whether the cloud operator can be compelled to access data, which varies by national law.

Key Cloud Features to Look For

Multi-device synchronization is the most visible benefit of cloud-native architecture. Look for wallets that allow you to use the same identity credentials on multiple devices simultaneously (phone, tablet, potentially smart watch). France Identite supports multi-device access through the FranceConnect ecosystem. Germany's approach ties the primary identity to the eID chip but allows cloud-synced supplementary credentials across devices.

Automatic credential updates are another key cloud advantage. When a credential is renewed, revoked, or updated, a cloud-native wallet can receive the update instantly without user intervention. This is particularly important for time-sensitive credentials like health insurance cards or professional licences. Belgium's MyGov.be handles credential lifecycle management through its cloud backend, ensuring users always have the most current version.

Data residency and sovereignty controls matter for cloud-hosted identity data. The eIDAS 2.0 regulation requires credential data to be stored within the EU. Look for wallets that clearly specify their data center locations and that use EU-certified cloud infrastructure. France uses SecNumCloud-certified providers, Germany uses BSI-approved infrastructure, and Italy is building its cloud infrastructure on the national cloud platform Polo Strategico Nazionale for SPID's 37 million users.

Future Developments in Cloud Identity Infrastructure

The EU's Digital Identity Wallet Toolbox is developing standardized cloud deployment patterns that will make it easier for smaller member states to deploy compliant wallet infrastructure without building everything from scratch. These reference architectures will include pre-certified cloud components that can be assembled like building blocks, significantly reducing deployment time and cost.

Edge computing is emerging as a bridge between cloud and local architectures. By processing credential verification at edge nodes closer to the user, wallets can maintain cloud-level scalability while reducing latency and improving privacy. Germany is exploring edge computing for AusweisApp verification services, and the Netherlands is considering edge-cached trust anchors for its verification infrastructure.

The concept of "sovereign cloud" for digital identity is gaining traction, where EU member states use exclusively European cloud infrastructure for wallet services. The GAIA-X initiative and the European Alliance for Industrial Data, Edge and Cloud are developing the frameworks for this. Poland's mObywatel, serving 20 million users, is planned to migrate to a sovereign cloud infrastructure as part of its 3.0 upgrade to ensure complete data sovereignty for Polish citizens.