Principles
Data stays in its source registry. The Central Server is like a phone book: it knows who is where, but no data passes through it.
Two organizations' Security Servers connect directly over mTLS. There is no broker hub in between.
Every message is signed with the sending organization's key and timestamped by an RFC 3161 TSA. It holds up as legal evidence.
The service provider decides which services to open, and to whom. By default, all access is closed.
Each instance keeps a list of approved CAs, OCSP responders and TSAs. The global configuration is distributed signed, and every server caches it.
Two countries' instances can be joined. Estonia and Finland were the first to connect, in February 2018. Federation is not transitive: A–B and B–C do not mean A–C.
History
Estonian TV exposed a database that illegally merged government and mobile-operator data. From then on, Estonia chose not to centralize data.
Started under the Ministry of Economic Affairs and Communications; in 2000 it demonstrated 3 databases linked over XML-RPC.
Officially launched in Estonia. Followed by v2 (2002, SOAP), v3 (2004, asynchronous), v4 (2006) and v5 (2010).
On 2013-12-10, the Estonia–Finland memorandum became “the world's first international agreement signed digitally.” v6 shipped in 2014 with federation support.
The core code was published under the MIT license. The Faroe Islands and El Salvador (“Tenoli”) adopted it.
Estonia and Finland jointly founded the Nordic Institute for Interoperability Solutions, which has led core X-Road development since 2018.
In NIIS's words, “the biggest change since v6.” REST services described with OpenAPI 3, alongside SOAP.
A new admin UI and a Java/Spring stack. The 7.x series continued into 2026.
The current patch is 7.8.3 (2026-09-08). Supported versions: 7.8.3, 7.7.4, 7.6.5.
Beta released 2025-10-23. A modular, container-ready design built on data spaces and the Gaia-X trust framework. First production release in Q4 2026.
NIIS
The X-Road code is owned and developed by the Nordic Institute for Interoperability Solutions. Member countries fund it jointly and set the roadmap.
Strategic members
Founders, 2017.
Contributing member
Partner in 2018, full member on 2021-06-01. Its national layer is “Straumurinn.”
Associate members
Ukraine became a partner on 2024-03-11.
Worldwide
“More than 20 countries” is the safe phrasing. Some run not on open-source X-Road but on Cybernetica's commercial UXP — those are marked separately.
| Country / region | Name | Year | Notes |
|---|---|---|---|
| Estonia | X-tee | 2001 | Run by RIA. The original. |
| Finland | Suomi.fi Data Exchange Layer | 2015 | Mandatory use was lifted on 2026-01-01; it is now voluntary. |
| Azerbaijan | — | ≤2018 | Describes itself as “the second country after Estonia.” |
| Kyrgyzstan | Tunduk | 2016 | €500k (USAID + Estonia), 260 specialists trained. 3.5 billion transactions in 2024. |
| Faroe Islands | Heldin | 2016 | Population 54 thousand. One of 4 pillars, alongside eID, a portal and registries. |
| El Salvador | Tenoli | 2017 | Created the Tenoli-LAT branch to support other countries' PKI. |
| Iceland | Straumurinn | 2018+ | The obstacles were not technical — they were legal and about who is responsible. |
| Cambodia | CamDX | 2020 | Built in-house, with no vendor. 87 members, 117 million transactions (2026-05). |
| Turkmenistan | — | 2025 | Switched on 2025-07-28. Nortal + UNDP, 10 ministries · 12 services, hosted in-country. |
| Colombia, Argentina, Brazil, Mexico | X-Road CO, X-Via … | — | At state and national level. Colombia upgraded to 7.3.2. |
| Ukraine | Trembita | 2018+ | UXP Cybernetica's commercial fork. 20+ billion transactions, 300+ organizations. |
| Namibia | Nam-X | 2015+ | UXP |
| Mongolia | X-Road MN | 2026 | new Gerege Systems, instance MN. More on the “04 · Mongolia” page. |
“Japan uses X-Road” is wrong — MLIT's “xROAD” is a road transport system. “X-Road uses blockchain” is also wrong: the NIIS CTO stated plainly, “There is no blockchain technology in the X-Road.”