Your ID should answer a question. Not leave a trail.

The plastic card in your wallet is turning into an app on your phone. Queensland, New South Wales, Victoria, South Australia and the Northern Territory already have digital licences in people's hands, and Western Australia is close behind.

Over the next decade it will quietly become the way you prove your age at the bottle shop, collect a parcel, rent a car, sign a lease or open an account. It will touch more of your life than the card ever did. That makes how it's built one of the most important decisions being made about your privacy right now, and almost nobody is talking about it.

Today, the same institutions often issue your digital ID, build the app that stores it, and run the systems that check it. That isn't a conspiracy. It's simply how first versions get built.

But it is the most centralised shape digital identity can take. If every check runs back through the issuer, then in principle the issuer can know when you were checked, where, and by whom. A record of the bars you visited, the cars you hired and the clinics you walked into could exist without you ever knowing it was being written.

Maybe nobody would ever look. We don't think your privacy should depend on that. Good intentions change with governments, budgets and data breaches. Architecture doesn't.

Your identity belongs to you, not to the agency that issued it or the company that checked it. Proving you're over 18 shouldn't hand over your name, your address, or the fact that you were at a particular venue at 9:42 on a Friday night.

A check should be a moment, not a record. You should share the smallest answer that settles the question, see exactly what you're sharing before you share it, and walk away knowing it hasn't been added to a file somewhere.

Cylinder verifies digital IDs directly between your customer's phone and your business. We check the credential's cryptographic signature against the issuer's published keys, so we can confirm it's genuine without ever asking the issuer. When we confirm a credential hasn't been cancelled, we download the issuer's whole status list rather than looking up one person, so even that step gives nothing away.

Your business gets exactly the answer it asked for, like over 18: yes, and nothing it didn't. No photocopied licences in a drawer. No database of customer IDs waiting to be breached.

For most businesses, checking ID has meant collecting it: a scan of the front and back of a licence, a photo of a passport, saved to a shared drive or an inbox and kept for years. Every one of those images is a full identity kit. It's exactly what criminals are looking for, and every one you hold is a liability you carry, from breach notifications to regulator questions to the trust you lose if it ever leaks.

Cylinder flips that around. Instead of handing you the whole credential, we map what comes back to the attributes your business actually needs, like age_over_18, licence_current or identity_verified. Your systems store those mapped fields, not photographs, dates of birth or licence numbers. If there's nothing sensitive in your database, there's far less to lose, to secure or to explain.

Your customers feel the difference too. Being asked to prove one thing, and seeing that only that one thing is shared, is a very different experience from handing a stranger a photocopy of your licence. Less collected means less exposed, and it builds the kind of trust that keeps people coming back.

Digital identity is moving fast, and the expectations on business are moving faster. New rules arrive with real deadlines and real penalties, but very little in the way of tools to actually meet them. Businesses are told what they must check, and left to work out how on their own.

Big banks have compliance departments and seven-figure identity budgets. The café, the bottle shop, the gym, the car rental counter, the tradie, the local accountant newly brought under AML/CTF rules: they don't. They've been left with photocopiers, guesswork and clunky tools built for someone else.

That's the gap Cylinder fills. We built it so a two-person business gets the same grade of verification as a bank, without a development team or a compliance department to run it. And so their customers can hand over their ID without wondering where it ends up.

Identity is no place for a clever new scheme. Cylinder is built on open standards from the OpenID Foundation, the same body behind OpenID Connect, which already signs you in across much of the internet. We use OpenID for Verifiable Presentations, W3C Verifiable Credentials, SD-JWT selective disclosure, and the ISO/IEC 18013-5 mobile licence standard.

That means public-key cryptography that has been studied for decades, formats any compliant wallet can speak, and no proprietary lock-in. If you ever outgrow us, your flows are built on standards you can take with you.

Cylinder is designed, built, owned and run in Australia, by a small team of software engineers who live under the same identity rules as everyone we serve. We understand the credentials Australians carry, the regulators businesses answer to, and the deadlines they're working against.

When something matters today, you'll reach a person in your timezone, not an overnight handover to the other side of the world.