X-ROAD INSIGHTS · Introduction
Introduction
X-Road is the secured data-exchange layer Estonian agencies, banks and companies use to exchange data — without a central database. This site shows what actually flows across it: derived from the public operational logs for December 2025 to May 2026.
X-Road is not a central portal and not a big database, but a mediation and trust layer. Four principles define it.
Data stays in its respective registers. X-Road only transports requests and responses — there is deliberately no central "super-database". Each organisation runs its own connection point, the Security Server.
Information the state already holds should not have to be supplied again by the citizen. Instead of collecting data twice, the handling system fetches it from the responsible authority — and these very requests are what this site makes visible.
Every exchange is digitally signed, time-stamped and logged on both sides. This makes it traceable who accessed which data and when — the basis of trust (and of this analysis too).
Identities and certificates are managed centrally, but the data exchange runs directly between the parties. The whole thing is operated by the state, and the core is open source.
Example: an agency needs a person's registered address. Instead of asking for it, its case system fetches it from the population register.
The first version of X-Road was developed and put into operation in 2001 by Estonia's information system authority RIA (Riigi Infosüsteemi Amet). Since 2018 the open-source X-Road core has been developed by NIIS (Nordic Institute for Interoperability Solutions) — a joint body founded in 2017 by Estonia and Finland. The source code is publicly available on GitHub under the MIT licence; the "X-Road" trademark, however, belongs to RIA and is protected separately.
Which systems and services are connected to Estonia's X-Road is documented in the state catalogue RIHA (administration system for the state information system). The naming and background details on the sub-pages of this project come, where available, from RIHA and other official sources — and are marked as uncertain where they are.
Three entry points, depending on your interest. All figures are derived from the public operational logs, not from the content of the queries.