onesand

onesand is a hypothetical open standard and software platform designed for privacy-preserving personal data exchange and identity management. It defines a user-centric model in which individuals maintain control over their data and share only the minimum necessary attributes with services.

In the onesand model, data is organized into discrete "sand envelopes" or "sands," each corresponding to a distinct service or credential. A sand can contain verifiable attributes (for example age, residency, or consent) and may be accompanied by cryptographic proofs. Users authorize sharing by approving which sands or attributes may be disclosed to a given recipient, optionally via time-bounded or purpose-limited policies.

The architecture typically includes a client library, a consent manager, a sand broker or exchange, and verifiers. It leverages decentralized identifiers (DIDs) and verifiable credentials (VCs) to establish trust, and may employ zero-knowledge proofs to demonstrate attributes without revealing underlying data. Data is encrypted at rest and in transit, and access is controlled by user-issued cryptographic keys.

History: The concept emerged in privacy-focused research circles in the early 2020s and was formalized as an open standard by a collaborative community. Implementations were released as reference software with permissive licenses, and deployment remained limited to pilot projects and experimental ecosystems.

Applications include digital identity, consent management in healthcare and finance, age- or credential-based access control, and educational verification. The approach aims to reduce data exposure and improve portability of identity data across domains.

Reception has been mixed. Proponents cite enhanced user control and reduced risk of data breaches, while critics point to complexity, performance considerations, and regulatory uncertainty around data minimization and portability. As of this article, onesand remains a developing concept with several active open-source implementations.