Integration architecture · for Ooredoo Kuwait
How Digitrustec's Digital Signing Platform runs on Ooredoo's infrastructure for each business customer, how it connects to PACI, the customer's directory, the Corporate Mobile ID app and the HSM, and who owns what.
High-level design
One dedicated DSP instance per customer, hosted and operated by Ooredoo with the keys in Ooredoo's HSM. Every integration is a request followed by a callback: from PACI with the signed result, from the Corporate Mobile ID app with the approval, and to business systems with the signed documents.
Architecture
Select a flow to follow it through the components. Every box is a deployable service of the DSP platform or an external party; the lines are the actual integration paths.
Integration points
| Party | Used for | How it connects | Registration & credentials | Held by |
|---|---|---|---|---|
 Kuwait Mobile IDHawiyati | Legally recognised signatures by citizens, residents and employees; identity assurance for signing | Signing request from the instance, signed result returned by callback (mutual TLS, allow-listed PACI addresses) | Service-provider registration, client certificate and callback URL, one per customer instance (or under Ooredoo’s registration, by agreement with PACI) |  on behalf of the customer |
 Applepush notifications · App Attest | Push delivery of approval requests to iPhones; proof that the Corporate Mobile ID app and its key are genuine | Outbound push from the instance; the app’s attestation is verified by the instance | Apple push key and app identity, tied to the published app |  app publisher |
 Googlepush notifications · Play Integrity | Push delivery to Android phones; integrity verdicts for the Android app | Outbound push from the instance; integrity verdicts verified by the instance | Firebase project and Play Integrity linkage, tied to the published app | app publisher |
 Customer directoryActive Directory / Entra ID | Source of employees and groups; staff single sign-on to the portals; who may enrol a Corporate Mobile ID | Directory read by the instance; staff login redirected to the customer’s identity provider | Read-only service account or app registration; network path from the instance to the directory | Customer |
| Business systemsCRM · ERP · document systems | Submit documents for signing or sealing, request strong authentication, receive results | Request to the instance’s API; signed documents and results returned by callback | API key per system, issued in the instance’s admin console; callback URL and shared secret | Customer |
| HSMhardware security module | Generation and use of employee signing keys, organisation seal keys and the instance’s service keys | Private connection from the instance inside the data centre; one partition per customer instance | Partition credentials and key-management roles, initialised by Ooredoo | |
| Corporate e-mailSMTP relay | Enrolment codes, notifications, signing invitations | Outbound e-mail from the instance | Relay account or allow-listed sender | Customer or Ooredoo relay |
| Timestampingtrusted time source | Trusted timestamps so signatures and seals stay verifiable for years | Outbound request from the instance | Timestamping account, if a commercial service is used | |
Network note. All inbound traffic terminates on Ooredoo's edge. Outbound calls to PACI, Apple and Google leave through Ooredoo's egress; the HSM and data stores are reachable only from inside the instance. The instance has no inbound dependency on Digitrustec systems.
Business model
A three-party model with a clear line of responsibility at every layer. Ooredoo white-labels DSP into its B2B portfolio and provisions a dedicated instance for each customer it signs.
Business customerCustomerSubscribes to the Ooredoo service: instance fee plus usage (signatures, seals, authentications).
Provisions and operates the instance; licenses the software per instance from Digitrustec.
Delivers releases, licences and Level-3 support; publishes the mobile app.
Responsibilities
| Area | | | Customer |
|---|---|---|---|
| Servers, network, storage, reverse proxy, TLS | Advises sizing | Owns | — |
| HSM and key custody | Key policy design | Owns & operates | — |
| DSP software, releases, security patches | Owns | Applies | — |
| Instance provisioning and configuration | Runbook, first instance together | Owns | Provides inputs |
| Licence per instance | Issues | Activates | — |
| PACI service-provider registration | Technical onboarding | Owns relationship | Signs forms where PACI requires |
| Directory integration, staff SSO | Supports | Configures | Owns |
| LOB integration (API, callbacks) | SDK, guides | Enablement | Owns |
| Corporate Mobile ID app publishing | Owns | — | Distributes to employees |
| Monitoring, backup, disaster recovery | Health endpoints, guidance | Owns | — |
| Support | Level 3 | Level 1 and 2 | Internal first line |
| Documents, audit trail, user data | — | Custodian | Owns |
Deployment model
Each customer gets a complete, isolated DSP instance: its own applications, data and HSM partition. Customers share only the physical platform Ooredoo operates underneath. No multi-tenant logic is involved.
Onboarding a customer