Solid & Personal Data Stores

Solid, the project started by Tim Berners-Lee at MIT, solved personal data storage and access control years before Solidus existed, and solved it in public: WebID for identity, LDP for read/write over HTTP, WAC/ACL for authorisation, RDF and Turtle for interoperable data, Solid-OIDC for authentication. It has real institutional deployments behind it, the BBC, the NHS, the Flemish government. None of that is ours, and Solidus does not replace any of it.

What Solidus Pod actually is: a Community Solid Server deployment with a did:solidus bridge, plus JWT and Postgres for sessions and metadata, using WAC for access control. It is Solid-compatible and migration-ready. It is NOT running the Solid protocol and it is NOT Solid-conformant. Full protocol conformance would require work we have not done. Three of the eight entries here are shipped (pod, WAC/ACL, Solid-OIDC); five say not-built, including the Solid protocol itself, WebID, LDP, RDF and Turtle.

The rest of the standing caveats apply here as everywhere: the did:solidus identifiers a pod binds to resolve on a public testnet (there is no mainnet and no token).

Why this framing is non-negotiable

The sharpest criticism Solidus has received, and it was partly fair, was this:

"You're posting on the Solid forum about your Solid-compatible pod that isn't running Solid, using vocabulary and a founder's conversation borrowed from their community. That's audience arbitrage."

The only defence against that charge is to have said the true thing first, every time, unprompted. So: the vocabulary in this section is Solid's, the community that built it is not ours, and a conversation with a member of that community is texture, never validation. No Solidus claim rests on an endorsement from anyone associated with Solid, because none exists.

This section is written to one rule, stated so you can hold it to it: no entry may read as though Solidus built, extended, or improved on Solid. Report any that does.

What the terms mean

• Solid Protocol, the specification for a personal data store you own, with applications requesting access to it rather than holding copies. Stewarded by the W3C Solid Community Group.
• Pod, the store itself. Yours, portable, with you deciding who reads what.
• WebID, an HTTP URI that identifies a person and dereferences to a profile document. It predates DIDs and solves an overlapping problem differently; the two can coexist, which is what our bridge does.
• LDP (Linked Data Platform), the W3C Recommendation for reading and writing resources over HTTP. not-built here: our pod does not implement LDP's full surface.
• WAC/ACL, Web Access Control: per-resource authorisation rules. Shipped.
• RDF / Turtle: the data model that makes one pod's contents legible to an application written by someone else, and its human-readable syntax. not-built: our pod stores structured data, but not as conformant RDF.
• Solid-OIDC, how a pod authenticates you. Shipped, and it is where this section overlaps with the standards section's OAuth family.

Where this category ends

Credentials stored in a pod are the standards section. Selective disclosure of their contents is cryptography. The GDPR erasure duty versus an audit trail (a conflict a personal data store makes concrete) is in economics and EU regulation.

Where Solidus sits in this

As the junior party, and this section says so throughout. Solid solved personal data storage and access control years before Solidus existed. Solidus Pod is Solid-compatible and migration-ready; it is not running the Solid protocol, and every entry here states which of the two it means.