Centralized identity databases are breach honeypots. See how decentralized PII storage shards encrypted data so no single node ever holds a full record.
Table of contents
- Decentralized PII storage shards encrypted identity data across a distributed network so that no single node holds a complete, usable record.
- It directly attacks the honeypot problem: centralized identity databases are single high-value targets, and some of the largest breaches on record have hit exactly such stores.
- With a threshold scheme, a usable record can only be reconstructed from a minimum number of shards, so compromising one node, or a few, yields nothing usable.
- When the customer holds the encryption key and the provider holds no master key, even the provider cannot unilaterally reassemble identities, and a breach yields fragments.
- The architecture supports GDPR data-minimisation and per-region residency by design, because data is distributed and controlled rather than pooled.
- sharded storage is an architecture choice beneath identity products; it is not a silver bullet, but it changes the breach economics fundamentally.
Decentralized PII storage shards encrypted identity data across a distributed network so that no single node holds a complete, usable record, removing the central honeypot that makes identity vendors a prime breach target. Combined with a customer-held encryption key and a threshold reconstruction scheme, it means a breach of any node, or a handful, yields fragments rather than usable identities.
TL;DR
Every identity verification vendor that stores its customers' verified data in a central database is building a honeypot, a single, high-value target that, when breached, exposes everyone at once. The history of large data breaches is largely a history of centralized stores being compromised. Decentralized PII storage is the architectural answer: shard encrypted identity data across a distributed network so that no single node holds a complete record, and require a minimum number of shards to reconstruct one.
Layer on a customer-held encryption key with no provider master key, and the breach economics change fundamentally: an attacker who compromises a node, or several, gets fragments, not identities, and the provider itself cannot unilaterally reassemble the data. This guide explains what the sharded model is, why centralized storage is so dangerous, how sharding and threshold schemes work, what an attacker would actually need, who controls the keys, and how it supports GDPR and residency, while being honest about its limits.
10 min read. Last updated 21 August 2026.
What is decentralized PII storage?
Distributed storage is an architecture for holding personally identifiable information in which encrypted identity data is broken into fragments, or shards, and distributed across many independent nodes, so that no single node, and no single point, holds a complete, usable copy of any individual's record. Reconstructing a full record requires bringing together a defined minimum number of shards, governed by a cryptographic threshold scheme.
This is a deliberate inversion of the conventional model, where a verification vendor stores all its verified identities in one cloud database. The conventional model is operationally simple but creates a catastrophic single point of failure. Decentralized PII storage trades a little architectural complexity for the removal of that single point, which is why it underpins privacy-first identity approaches and the decentralised KYC model. It is the storage-architecture answer to the question every breach raises: why was all of this in one place.
Why is centralized PII storage a honeypot?
A honeypot, in security terms, is a concentration of value that attracts attackers, and a central database of verified identities is exactly that. When all the identity data sits in one store, a single successful breach exposes every record, which is why centralized identity and data stores have produced some of the largest breaches on record. The 2017 Equifax breach exposed sensitive data on roughly 147 million people; the 2019 First American Financial exposure made hundreds of millions of records, around 885 million, accessible; and large-scale exposures of aggregated personal data have continued since.
The pattern is consistent: centralize sensitive identity data, and you create a target whose compromise is total. For an identity verification vendor, this is the structural risk we describe in why your KYC vendor is your biggest data breach risk: the vendor accumulates everyone's documents and biometrics, and its breach becomes its customers' regulatory and reputational problem. the model removes the honeypot rather than trying to build ever-higher walls around it.
How does sharding with a threshold scheme work?
Sharding splits data into pieces; a threshold scheme governs how many pieces are needed to put it back together. In a threshold scheme, a record is divided into a number of shards such that a defined minimum subset, the threshold, is required to reconstruct it, and any smaller number reveals nothing. For example, in a 29-of-100 scheme, a record is split across 100 shares and at least 29 are needed to reconstruct it; holding 28 or fewer yields no usable information.
Zyphe applies exactly this kind of approach, sharding identity data across more than 60,000 decentralised nodes using a 29-of-100 threshold scheme. The security property is powerful: an attacker must compromise not one system but a threshold number of independent shards simultaneously, while the data is also encrypted. This is fundamentally different from breaching a single database, because there is no single database to breach, only a distributed set of fragments that are individually useless. The combination of distribution, encryption, and a reconstruction threshold is what makes decentralized PII storage robust.
What would an attacker actually have to compromise?
The threat model is where the difference becomes concrete. To reconstruct a single identity from a sharded PII store, an attacker would have to compromise a threshold number of independent nodes simultaneously, and then defeat the encryption protecting the shards, and, in a customer-key model, obtain the customer's key, which the provider does not hold. Compare that with a centralized store, where breaching one system and its access controls exposes everything.
The asymmetry is the point. In the centralized model, the attacker's job is a single, well-understood target. In the decentralized model, the attacker faces a distributed problem that scales against them: more nodes, more independent compromises required, no single jackpot. A breach of any one node, or even several below the threshold, yields fragments that cannot be assembled into a usable identity. Decentralized PII storage does not make attack impossible, but it makes a total breach far harder and a partial breach far less damaging, which is exactly the right trade for sensitive identity data.
Who holds the keys?
Architecture is only half the story; key control is the other half. In the strongest model, the customer, not the storage provider, holds the encryption key, and the provider holds no master key. That means the provider itself cannot unilaterally decrypt and reassemble a customer's identities, which removes both the insider-threat and the compelled-access concentration risks that plague central stores.
This is the model Zyphe uses: the customer holds the encryption key, and Zyphe has no master key, so there is no central party, not even the vendor, that can reconstruct identities at will. The significance for breach economics is decisive: even if an attacker somehow gathered enough shards, without the customer-held key the data stays encrypted. Key custody is therefore as important as sharding; decentralized storage with a provider-held master key would reintroduce a concentration point. The combination of sharded storage and customer-held keys is what fully removes the honeypot, and it is what makes a KYC passport built on it genuinely user-controlled.
How does it support GDPR and data residency?
Sharded storage aligns naturally with data-protection principles. GDPR emphasises data minimisation and security of processing, and an architecture where no single store holds complete records, and where the data subject's relationship to their data is stronger, supports both. Crucially, it reduces the blast radius of any incident, which is central to the security-of-processing obligation, and it can reduce the volume of complete identity data any single party holds.
On residency, distribution can be designed to keep data within required regions: Zyphe enforces per-region residency so that, for example, Swiss data stays in Switzerland, Singapore data in Singapore, and EU data within EU member states. That matters as regimes like the EU AML package and various national laws tighten residency and protection expectations. Decentralized PII storage is not a substitute for a complete data-protection programme, but it is an architecture that makes data-minimisation, residency, and breach-resilience easier to achieve than a single central database, which is why it features in the privacy-first vendor comparison.
When is decentralized storage not the answer?
Honesty about limits matters. this architecture is an architecture, not a complete security or compliance programme, and it does not by itself solve everything. It does not remove your obligations to verify identity, screen, and monitor; it changes where the verified data lives, not whether you must do the work. It also does not protect against every threat, a compromised endpoint capturing data before it is sharded, or a flawed key-management implementation, can still cause harm, so the surrounding controls matter.
There are also cases where the operational simplicity of a well-secured centralized store, with strong encryption and access controls, may be an acceptable choice for lower-sensitivity data or smaller scale, and adopting a distributed architecture adds complexity that must be justified by the sensitivity and volume of the data. The honest framing is that decentralized PII storage dramatically improves the breach economics for high-sensitivity identity data at scale, which is precisely where the honeypot risk is greatest, but it is one part of a defence-in-depth posture, not a silver bullet. For most identity-verification use, where the data is exactly the kind attackers want most, it is the right architecture. Book a demo to see it.
The bottom line
Most identity breaches share a root cause: a central database holding everyone's data in one place. sharded storage removes that root cause by sharding encrypted identity data across many nodes so no single one holds a usable record, requiring a threshold of shards to reconstruct, and, with a customer-held key, ensuring even the provider cannot reassemble identities at will.
The result is a fundamental change in breach economics: a compromised node yields fragments, not identities, and a total breach requires defeating many independent systems and the encryption at once. It supports GDPR data-minimisation and residency by design, and it is the right architecture for high-sensitivity identity data, provided it is paired with the surrounding controls. The honeypot is not better-defended; it is gone.
Book a demo, explore decentralised PII storage, or see how it works.
Related resources
- What is decentralised KYC, and how does it work?
- Why your KYC vendor is your biggest data breach risk
- What is a KYC passport?
- Privacy-first identity verification vendors compared
- Identity verification software comparison 2026
- Decentralised PII storage
- How it works
Cited sources
- US Federal Trade Commission, Equifax data breach settlement: https://www.ftc.gov/enforcement/refunds/equifax-data-breach-settlement
- NYDFS, First American Financial cybersecurity enforcement: https://www.dfs.ny.gov/
- EU GDPR information portal (data minimisation and security of processing): https://gdpr-info.eu/
- NIST, guidance on protecting personally identifiable information: https://www.nist.gov/privacy-framework
Michelangelo Frigo (Co-Founder at Zyphe) Michelangelo Frigo is a privacy and identity infrastructure expert and co-founder of Zyphe.