There’s a paradox embedded in the architecture of the modern web. The data on these platforms was generated by you — your photos, your journal entries, your communications, your memories. But you don’t own it. You don’t hold it. In most cases, you can’t move it without the platform’s cooperation, and you can’t delete it with confidence that it’s actually gone. You created the content that powers some of the world’s most valuable companies, and the arrangement is structured so that they hold it and you visit.
This isn’t a new observation. What’s newer is the emergence of technical and legal frameworks designed to change it — frameworks that go beyond policy commitments and aim to make data ownership a technical reality rather than a marketing claim.
The cluster of ideas at the center of this movement is called self-sovereign identity, or SSI. It’s worth understanding what it actually means, why it’s technically difficult, where it’s been deployed, and what it suggests about where personal file storage is headed.
The Identity Problem That SSI Is Solving
Every time you sign up for a new service, you hand over some information about yourself — often an email address, sometimes your name and location, sometimes much more. You get a login credential in return. The service stores your profile on their servers.
What you’ve created is an identity record that belongs to the service, not to you. You can access it as long as the service exists and wants you to. If the service closes, changes its terms, or decides to ban your account, the record — and everything tied to it — can disappear or become inaccessible. Your identity, in the digital sense, is an artifact of the relationship between you and a set of corporations whose interests don’t necessarily align with yours.
Self-sovereign identity (SSI) is an alternative architecture. The core principle is that your digital identity should be something you hold — not something stored on a company’s server and made available to you through their interface.
SSI has three technical components:
Decentralized Identifiers (DIDs). A DID is a new type of identifier — like a URL, but globally unique and not controlled by any central authority. You generate a DID using cryptographic keys you hold. Your DID can be registered on a blockchain or a distributed ledger that no single company controls. It points to a document describing how to interact with you: what kinds of credentials you accept, how to encrypt messages to you, how to verify your signatures.
Verifiable Credentials. These are the digital equivalent of documents like passports, driver’s licenses, or degrees. A verifiable credential is issued by someone (a government, a university, an employer), cryptographically signed, and held by you in a digital wallet. When you need to prove something — your age, your address, your professional certification — you present the specific credential, without having to expose any information beyond what’s required for the specific interaction.
Data Pods (or Personal Data Stores). This is where the connection to personal files becomes direct. A data pod is a storage environment controlled by you — not a corporation — where your files, your data, and your personal records can live. Other applications request access to your pod to read or write data; you grant or deny those requests, on your terms.
The Solid Protocol
The most developed implementation of the data pod concept is the Solid Project, led by Tim Berners-Lee — the person who invented the World Wide Web — as an explicit effort to correct what he considers a fundamental mistake in how the web developed.
Solid (Social Linked Data) is a set of open protocols that allow individuals to store their data in personal online data stores (Pods) and control which applications have access to that data. The promise is significant: instead of your photos living in Google Photos, your notes in Notion, your calendar in Google Calendar, and your health data in Apple Health — each in a separate corporate silo — everything lives in your Pod. Applications access your Pod with your permission and write back to it, rather than storing data in their own infrastructure.
The concept has been piloted in a few meaningful contexts. Belgium’s Flanders region ran a pilot using Solid Pods to give citizens control over their government data records. Several healthcare projects have used Solid to give patients control over medical records, with clinicians requesting access rather than owning the record.
In practice, Solid has not yet reached mass adoption for a few interconnected reasons.
Application ecosystems are built around centralized data stores. An app that stores your data in its own infrastructure has a much easier development path than one that must interface with a user’s personal pod — wherever that pod happens to live, in whatever format it’s using. The incentives point away from pod-based architectures for commercial applications.
The network effect problem. Much of the value of a platform like Google Photos is what it can do with your data — search, AI organization, cross-device sync. A pod that holds your files but isn’t attached to processing infrastructure provides storage without those capabilities. Rebuilding them in a pod-compatible way is a significant technical and business challenge.
Security complexity. Your data pod is only as secure as however you’re running it. A corporate cloud service has infrastructure teams, security operations, and incident response. Your personal data pod, if self-hosted, has you. This is the same tradeoff that makes self-hosted servers generally more privacy-protective and generally less practically secure for non-technical users.
How SSI Concepts Are Starting to Appear in Mainstream Services
Even if the full SSI vision isn’t yet widely deployed for personal file storage, several of its component ideas are showing up in how services are designed and regulated:
Verifiable credentials are being adopted by governments. The EU Digital Identity Wallet, created by European regulation, is designed to give citizens a digital identity under SSI-like principles — credentials you hold in a wallet, presentable to services as needed, without creating a central identity database. The UK, several US states, and a number of other governments are developing compatible frameworks.
Data portability legislation encodes part of the pod concept in law. The EU Data Act, GDPR’s portability provisions, and similar laws create a legal right to take your data with you when you leave a service — which is a subset of what data pods accomplish technically. The law is moving toward the right of data sovereignty even when the technical infrastructure hasn’t caught up.
Decentralized social protocols are going mainstream. ActivityPub (the protocol behind Mastodon and other federated social services) and AT Protocol (the protocol behind Bluesky) implement a version of decentralized identity for social contexts. Your identity in these systems exists at a level of the protocol, not a specific company, and can theoretically move between hosts. This is the SSI concept applied to social networking, and it’s reached millions of users.
What This Means for Personal File and Memory Storage
The SSI framework raises a question that’s worth applying directly to any storage service you use: how much of the data sovereignty concept does this service actually implement?
The full SSI answer — you hold your identity, you control your pod, you grant access to applications — isn’t widely available for personal file storage today. But a spectrum exists, and different services sit at different points on it.
At one end: services where your data exists primarily as rows in the company’s database, your identity is defined by your account with that company, and leaving requires their cooperation and takes weeks. The company’s interests shape your data — what formats it’s stored in, what’s retained after deletion, what happens if they’re acquired.
At the other end: services where your data is in standard formats, exported cleanly at any time, deleted with verifiable permanence, and not processed for purposes outside serving you — where the service is genuinely a custodian of your files, not a custodian-with-interests.
The technical gap between these positions is narrower than the philosophical gap. A service doesn’t need to implement blockchain-based DIDs to function more like a data pod than like a data extracting platform. The practical differences are: standard file formats, portable export, verified deletion, no third-party data sharing, no AI training on content.
The Honest Current State
Self-sovereign identity represents a genuine reorientation of how data ownership is conceptualized. The Solid Protocol and its Pod architecture are real technology, backed by serious researchers and meaningful pilot deployments. The EU Digital Identity Wallet is moving toward deployment.
But the full vision is not yet widely available for personal file storage, and being clear-eyed about that gap matters. The infrastructure challenge — building app ecosystems that work with decentralized pods rather than centralized databases — hasn’t been solved. The usability challenge — making pod administration something ordinary users can manage securely — hasn’t been solved either.
What does exist, today, are services that operate much closer to the data sovereignty principle than the alternatives: transparent data practices, clean export, verified deletion, no advertising, no AI training on content. These aren’t pods in the SSI technical sense, but they implement the part of the SSI vision that has practical daily relevance for most people: your data is for you, not for the service.
The full technical vision of self-sovereign identity is a likely trajectory for parts of the digital infrastructure over the coming decade — the regulatory pressure, the protocol development, and the cultural shift toward data ownership rights are all moving in the same direction. The practical starting point, for anyone choosing where to store personal memories today, is asking the more immediate version of the same question: does this service treat my data as mine, or as its own?
See how daftei approaches your data — standard formats, clean deletion, no third-party training