Open source

What is open

Everything. The VirtEngine network — including VEID, the identity layer — is written in Go and licensed under Apache 2.0, a permissive open-source licence. The mobile capture app that implements the wallet flow described on this site is public in the same repository.

• The network and identity layer: github.com/virtengine/virtengine — see the x/veid module for identity, consent and zero-knowledge proofs
• The wallet capture app: mobile/veid-capture-app in the same repository — document capture, liveness challenges, hardware biometrics, attestation
• The governing documents: the privacy policy, consent framework and biometric data addendum are versioned in the repository alongside the code they govern

What “reference implementation” means

The capture app is a reference implementation: a complete, working implementation of the wallet flow that serves as the blueprint for production wallets. Some production adapters — for example native machine-learning modules and production encryption backends — are pluggable extension points in the reference code. We say this plainly because honesty about maturity is part of being trustworthy infrastructure.

There are no official app-store listings at this stage. Any store listing claiming to be this wallet should be treated as suspect — see recognising scams.

Why openness is a security feature

• Anyone can audit it. Security researchers, journalists and rival experts can — and do — read the code. Flaws cannot hide behind a marketing page.
• Claims are falsifiable. When this site says biometric templates are encrypted with X25519-XSalsa20-Poly1305, you can find that code and check.
• No lock-in. If the steward ever failed the community, the code can be forked and continued — the public cannot lose access to it.

Contributing and reviewing

Issues and pull requests are open on GitHub. Security-sensitive findings should go to security@virtengine.com rather than a public issue — see the security page for the disclosure process.