raheebwa/trustscore-architecture

Architecture case study: a portable, privacy-safe reputation passport for the informal economy — GSMA Africa Ignite 2026, 1st place. # A Credit Score That Follows You: Building a Portable Reputation Passport for the Informal Economy In Uganda's informal lending economy, reputation is trapped. A borrower who has repaid a SACCO faithfully for three years starts from zero the moment she walks into a different lender — there is no shared credit bureau she trusts, no national ID coverage she can rely on, and no lender willing to hand its ledger to a competitor. The engineering question underneath the product pitch is deceptively sharp: how do you make a single reputation score portable across mutually-distrusting lenders, with no central identity authority, without ever storing the one identifier everyone shares — a phone number — in a form that becomes a data-protection liability the day your database leaks? Every naive answer breaks one of those constraints. This is how I resolved the tension in a 12-day solo build — late April into May 2026 — that won GSMA Africa Ignite 2026. ## The problem: reputation is stranded because identity is unsafe to store The informal lenders in this market — SACCOs, microfinance institutions, village savings groups, shopkeepers extending credit, mobile-money agents — each keep their own ledger. Each ledger is a small, private truth about a borrower: she pays on time, she rolls over, she vanished once and came back. None of them share, because the ledger *is* the moat. A borrower's good name, painstakingly earned, is stranded inside whichever institution recorded it. To make reputation portable, you need one thing before you need anything else: a way for two lenders who have never spoken to point at the *same person* and agree that they mean the same person — with no central registry issuing IDs, and no fuzzy name-matching step that will confuse two Nakatos in the same village. The only identifier every party already holds is the borrower's phone number. It is universal, stable, and recognisable. It is also, under Uganda's Data Protection and Privacy Act, exactly th …