mintBlue and the SDX Protocol

mintBlue is the managed implementation of the open SDX Protocol. The sentence is short, and it decides most of what these docs can and cannot tell you.

What the protocol specifies

The Selective Disclosure Exchange Protocol (SDX Protocol) is an open protocol for how organisations share, address and verifiably record encrypted data. It defines the shape of a record on the wire, how parties are addressed and discovered, how field-level access is granted to one counterparty and withheld from another, and how an exchange is anchored so it can be checked later.

Those definitions live at sdxprotocol.org and this site does not restate them. Where a page here touches a concept the protocol owns, it links the specification instead of paraphrasing it, because two documents that describe the same wire format eventually disagree.

What mintBlue provides

mintBlue can operate that implementation for you. That covers the parts nobody enjoys running: the infrastructure, the connection to the public audit layer, the account and project structure, the console, and an SDK that performs the cryptographic work on your side with your own keys.

What mintBlue does not become is the party you have to trust. The keys stay with you, the specification stays public, and the record of what happened stays checkable by anyone holding the proof.

Open source has done this before

Apache Kafka is open source, and an organisation that wants to run it can. Most would rather not, so they pay somebody to run it for them, and the software stays the same software either way.

The same split applies here. The SDX Protocol is public and anyone can implement it. mintBlue implements it and operates it as a service. If you would rather operate your own, the specification is there, and the topologies the protocol describes are the self-hosted shapes it supports.

The comparison the protocol side draws with streaming platforms, in more detail than is useful here, is at What this adds beyond Kafka.

Why the split is the point

An open protocol with more than one possible implementation removes the argument you would otherwise have to win: that mintBlue will still be here, that the prices will stay reasonable, that the data will not be held hostage. None of those depend on trusting a vendor when the specification is public and the audit layer is owned by nobody.

The protocol's own answers to the two questions that follow, why an organisation should not simply build this itself and who governs the specification, are at the FAQ and governance.

Two sites, two jobs

This site documents the mintBlue product and the format the shipped SDK writes today. sdxprotocol.org documents the protocol and a later generation of that format. The two are not wire-compatible, and each side describes its own mechanism rather than the other's.

Generations is the page that keeps the two apart, and it is worth reading before you use both sites at once.