“Until now, video conferencing solutions did not have legal probative value”
Interview published in CSO Spain on March 29, 2022
(Interview in Spanish)
By Mario Moreno / Image: Juan Márquez
Víntegris was born in 2004 in Barcelona as an integrator of third-party technology systems specializing in cybersecurity solutions. But, due to market trends and regulatory requirements, says Javier Bustillo, CEO of the company, in 2016 it became a qualified trust service provider with its own platform in the cloud. This is based on guaranteeing the probative validity of digital processes and identities. “This allows us to create a secure digital alter ego,” he says.
What has been the historical journey of the organization to become a player based on digital signatures and identity?
Víntegris is a family company of Catalan origin that began its IT journey around three or four emblematic banking clients. After four or five years, a series of applications were built based on these developments with these users. One in particular, with client-server architecture, was licensed and began to be marketed in different sectors. Six years ago, with a change to SaaS architectures, the cloud solution known as nebulaSUITE began to be marketed. In addition, in 2016 the company established itself as a qualified provider of trust services on the eIDAS regulations, which has given this special characteristic to a cloud software manufacturer. Today, we operate mainly in Spain and barely 5% of our turnover comes from abroad. But we have the clear objective of internationalization due, precisely, to this EIDAS certification, which has European validity.
What have the years of the pandemic meant for the acceleration of business and the adoption of digital signature and identity processes?
As a company, and for the 70 people who are in Víntegris, it has meant a total transformation of the way we did things, we have even closed and opened the offices and the contractual model with the workers has changed. 95% of them have opted for a hybrid model in which they choose the percentage of time they want to be remote. In addition, we are incorporating talent in other cities, which allows the creation of a multidisciplinary group that helps with this digitization.
On the other hand, we have seen a series of changes over these two years, both in practice and in law, in which video identification was even allowed as a valid method during confinement and which, later, has become a Real Decree that has shaped what some companies offer. This is going to change the way in which citizens relate to administrations and how we relate to businesses. The ability to carry out transactions and identifications remotely and the ability to prove are changing many processes.
The solution that Víntegris has provided in this regard is called nebulaSUITE. What does it consist of?
nebulaSUITE is a SaaS solution platform that is made up of tools for issuance, centralization, management, identity verification, authentication, etc. It also has an advisory service for digital flows. In particular, this Royal Decree, which was approved in May 2021, has allowed qualified trust service providers, who are also software manufacturers, to be among the first companies in Spain to provide this service with this type of characteristics. depending on the sector and the use case. This changes the way of proceeding of the citizen; from renewing the DNI remotely to changes in the registry… We are also working in the justice environment to incorporate video identification and that trials can be carried out effectively remotely. In addition, the use of this technology is very powerful to prevent fraud.
How does it reduce the levels of fraud? Several studies say that, for example, bank fraud rises to levels of 3,000%.
One of the things that must be understood from the beginning is that the video conferencing solutions that existed until now in the banking sector or in many others did not have legal probative validity, which means having the ability to make transactions and create a digital ego of the person on the other side. This has been included in the law that, with the requirements of the National Cryptologic Center (CCN), has defined the characteristics of the technologies and the processes that must be implemented. Among them are the use of facial biometrics, the capture of documentation via OCR and the verification of certain characteristics of that documentation, in addition to a random test of life in real time, whether it is blinking or turning the head, etc. With all this information, a query is made to the National Police database to verify that it is consistent. This type of thing can only be done by providers by law. In addition, we have the requirement to safeguard all this for 15 years. All this set of procedures are what allow the qualification of a provider as an entity capable of creating a digital alter ego.
"Víntegris has the technological and legal backing to ensure that what exists in the metaverse is represented in real life"
Has the legislation supposed a delay to reach the current state?
The normal thing in technology is that the legislation, which is complex, is always a little behind the evolution. But this exercise that has been done in Europe, and accelerated by the pandemic, has had its benefits in some areas like this. Of course, both the regulator and certain agencies have been working against the clock. It’s not going as fast as we end-users would like, but we’ve come a long way, and proportionately so, in the last two years. Precisely because these technologies transform societies, regulations will become increasingly relevant.
The future metaverse, which is already developing, is closely related to digital identities. How do you see this environment?
The metaverse can be used for many things, from playing games to recreating simulation or collaboration environments. But, when there is a virtual representation of something real where there can be transactions with money and that affects companies and individuals, there must be a unique identification between the real identity and the digital alter ego. It is precisely this link that a provider like Víntegris can provide because it has the technological and legal backing to create, maintain and ensure that what exists in the metaverse is represented in real life.
Brussels is discussing in the European Parliament (EP) a new data law with the aim of defending the information of community companies and citizens against the American giants. What is your opinion about this?
I think the protectionist profile that the European Union (EU) is taking against the approach that other types of companies outside the continent have with regard to the privacy of people and the exploitation of the metadata that define their behaviour to make money. I believe in privacy and respect for that privacy , and I am more inclined to what is being built here than to the liberalism that is defended in other geographies, essentially in those in which there are more powerful multinationals.
Only 5% of the company's turnover comes from outside Spain, although it is present in several geographies. What internationalization project are you carrying out?
Víntegris was acquired two years ago by a Swiss group, Euronovate, which specializes in biometrics. Within our portfolio we have introduced the intellectual property of this group in what has to do with the biometric capture and digital signature devices, both at the hardware and software level. The core of our solution, nebulaSUITE, is being translated into seven languages and will be released in June this year because our goal for 2023 is to open offices in five countries: England, France, the United Kingdom, Italy and possibly , Greece. The idea we have is to move to business figures of 35% in three years in these enclaves.