Digitrustec · Digital Signature Platform DSP as a Service · Ooredoo Kuwait Full picture

Integration architecture · for Ooredoo Kuwait

DSP as a Service, one dedicated instance per customer

How Digitrustec's Digital Signing Platform runs on Ooredoo's infrastructure for each business customer, how it connects to PACI, the customer's directory, the Corporate Mobile ID app and the HSM, and who owns what.

Instance per customer · no shared tenancy Hosted & operated by Ooredoo HSM key custody at Ooredoo Hawiyati · Kuwait Mobile ID (PACI) Corporate Mobile ID as authenticator

1DSP instance per customer, fully isolated
2identity methods: Hawiyati for everyone, Corporate Mobile ID for employees
1identity for everyone: Hawiyati, the Kuwait Mobile ID issued by PACI
1authenticator for employees: the Corporate Mobile ID app, keys in the HSM
5external integrations: PACI, Apple, Google, customer AD, customer LOB systems
0private keys outside the HSM: employee signing keys never leave Ooredoo's HSM
0signing keys on the server: with Hawiyati the key stays with the signer, issued by PACI

High-level design

The big picture: who connects to the customer's DSP instance

High-level design: users, PACI, push services, the DSP instance at Ooredoo, the HSM, the customer's systems and Digitrustec
request / data callback · notification · support external party key custody (HSM)

Integration points

Integration points: every party, what it is for and who holds the credentials

PartyUsed forHow it connectsRegistration & credentialsHeld by
Identity and trust
PACIKuwait Mobile IDHawiyati · PACILegally recognised signatures by citizens, residents and employees; identity assurance for signingSigning request from the instance, signed result returned by callback (mutual TLS, allow-listed PACI addresses)Service-provider registration, client certificate and callback URL, one per customer instance (or under Ooredoo’s registration, by agreement with PACI)Ooredoo on behalf of the customer
Mobile platforms
AppleApplepush notifications · App AttestPush delivery of approval requests to iPhones; proof that the Corporate Mobile ID app and its key are genuineOutbound push from the instance; the app’s attestation is verified by the instanceApple push key and app identity, tied to the published appDiyar United Company app publisher
GoogleGooglepush notifications · Play IntegrityPush delivery to Android phones; integrity verdicts for the Android appOutbound push from the instance; integrity verdicts verified by the instanceFirebase project and Play Integrity linkage, tied to the published appDiyar United Company app publisher
Customer environment
Customer directoryActive Directory / Entra IDSource of employees and groups; staff single sign-on to the portals; who may enrol a Corporate Mobile IDDirectory read by the instance; staff login redirected to the customer’s identity providerRead-only service account or app registration; network path from the instance to the directoryCustomer
Business systemsCRM · ERP · document systemsSubmit documents for signing or sealing, request strong authentication, receive resultsRequest to the instance’s API; signed documents and results returned by callbackAPI key per system, issued in the instance’s admin console; callback URL and shared secretCustomer
Corporate e-mailSMTP relayEnrolment codes, notifications, signing invitationsOutbound e-mail from the instanceRelay account or allow-listed senderCustomer or Ooredoo relay
Ooredoo platform services
OoredooHSMhardware security moduleGeneration and use of employee signing keys, organisation seal keys and the instance’s service keysPrivate connection from the instance inside the data centre; one partition per customer instancePartition credentials and key-management roles, initialised by OoredooOoredoo
OoredooTimestampingtrusted time sourceTrusted timestamps so signatures and seals stay verifiable for yearsOutbound request from the instanceTimestamping account, if a commercial service is usedOoredoo

Network note. All inbound traffic terminates on Ooredoo's edge. Outbound calls to PACI, Apple and Google leave through Ooredoo's egress; the HSM and data stores are reachable only from inside the instance. The instance has no inbound dependency on Digitrustec systems.

Business model

Ooredoo sells and operates, Digitrustec builds and supports, the customer owns its data

A three-party model with a clear line of responsibility at every layer. Ooredoo white-labels DSP into its B2B portfolio and provisions a dedicated instance for each customer it signs.

Diyar United Company

Product vendor · Digitrustec DSP

  • DSP software: signing, e-sealing, strong authentication, Corporate Mobile ID
  • Release packages, security updates and upgrade runbooks
  • Per-instance licence (modules, validity) and licence activation
  • Corporate Mobile ID app on the App Store and Google Play
  • Level-3 support and incident escalation; integration consulting
Ooredoo

Service provider

  • Infrastructure: servers, network, storage, reverse proxy, egress, DNS and TLS
  • HSM ownership and operation; one partition per customer instance
  • Provisioning and operating one DSP instance per customer; monitoring, backup, DR
  • PACI service-provider registration and relationship, per customer
  • No key custody: signer certificates and keys are PACI's, on the signer's phone
  • Sales, contracting, billing, Level-1/2 support to the customer
Business customer

Instance owner

  • Users, roles and signing policies in its own administrator console
  • Directory integration (AD / Entra ID) and staff single sign-on
  • Integration of its LOB systems through the API, or use of the portals
  • Employee enrolment of the Corporate Mobile ID app
  • Ownership of documents, audit trail and certificates issued to its employees
  • Ownership of documents and audit trail; signers bring their own Hawiyati

Commercial flow

Customer

Subscribes to the Ooredoo service: instance fee plus usage (signatures, seals, authentications).

pays Ooredoo
Ooredoo

Provisions and operates the instance; licenses the software per instance from Digitrustec.

licence + support
Diyar United Company

Diyar United Company delivers releases, licences and Level-3 support, and publishes the mobile app.

Responsibilities

Who owns what

AreaDiyar United CompanyOoredooCustomer
Servers, network, storage, reverse proxy, TLSAdvises sizingOwns—
HSM and key custodyKey policy designOwns & operates—
DSP software, releases, security patchesOwnsApplies—
Instance provisioning and configurationRunbook, first instance togetherOwnsProvides inputs
Licence per instanceIssuesActivates—
Signer certificates and keysPACI integrationPACI relationshipSigners' own Hawiyati
PACI service-provider registrationTechnical onboardingOwns relationshipSigns forms where PACI requires
Directory integration, staff SSOSupportsConfiguresOwns
LOB integration (API, callbacks)SDK, guidesEnablementOwns
Employee enrolment and device pairingApp and enrolment flowSupportsOwns
Corporate Mobile ID app publishingOwns—Distributes to employees
Monitoring, backup, disaster recoveryHealth endpoints, guidanceOwns—
SupportLevel 3Level 1 and 2Internal first line
Documents, audit trail, user data—CustodianOwns

Deployment model

Instance per customer on Ooredoo's infrastructure

Several isolated DSP instances in the Ooredoo data centre

Onboarding a customer

From contract to first signed document

ContractCustomer subscribes with Ooredoo; services and volumes agreed.
ProvisionOoredoo creates the instance: compute, databases, storage, DNS, TLS, HSM partition.
ProvisionOoredoo creates the instance: compute, databases, storage, DNS, TLS.
Install & licenseRelease package deployed from the runbook; Digitrustec issues the instance licence.
PACIService-provider registration, client certificate and callback URL registered for the customer.
Directory & appAD / Entra ID connected; employees enrol the Corporate Mobile ID app; keys created in the HSM.
DirectoryAD / Entra ID connected for staff single sign-on.
IntegrateLOB systems connected through the API, or teams onboarded to the portals; test signatures verified.
Go-liveOperations handover to Ooredoo NOC; Level-3 support path with Digitrustec active.
1 / 7