X-Road (X-tee in Estonian) is Estonia's electronic data exchange infrastructure connecting state e-services to one another. The world's first nation-level security protocol, running since 2001. As of today it connects over 1,000 organizations, with up to 3 billion queries per year. In this guide we look at how X-Road works, what data is shared, and how the consent mechanism operates.
X-Road is a distributed architecture: every organization has its own security server that encrypts and signs all data exchanges. Technology: SOAP/REST API, TLS 1.3 encryption, RSA 4096 digital signature. Every query leaves a digital audit trail (who, when, what, why). Audit trails can be reviewed retrospectively — users have the right to see who queried their data. The Estonian Information System Authority (RIA) manages the central registry and certificates.
Via X-Road the following are available: Population Register (by personal code: name, date of birth, residence, citizenship), e-Business Register (by registry code: company name, board, capital), Cadastre Register (by cadastre code: property owner, area, assessed value), Vehicle Register (by license plate: owner, make, model, technical inspection), Health Information System (TIS — e-Health), Bank Register (by IBAN: holder, bank). Each registry is a separate system; X-Road connects them with a standardized protocol.
Estonian data protection principle: personal data is shared only on consent basis (GDPR and Estonia's Personal Data Protection Act). Every query needs user consent via Smart-ID / ID-card. Exception: public information (e-Business Register) is freely accessible; private individual info (Population Register) always needs consent. The user can check their consents in the state portal eesti.ee: sees who and when has queried their data, can revoke consent. The audit trail is immutable.
4b2b is registered as an X-Road service provider — meaning our clients can query state registries directly from their accounting software. Typical use cases: adding a partner — registry code → e-Business Register query → company profile fills in 2 seconds. Hiring an employee — personal code → Population Register query (with employee consent) → HR module. Entering an IBAN — IBAN → Bank Register query → holder name displayed for verification.
Talk to us about how the 4b2b ecosystem fits into your existing EMTA flow. We have implementations from 10-employee firms to Nasdaq Tallinn companies.
