The Personal Data Store Landscape, Compared Honestly

The direct successor to Block's Web5: when Block shut down its TBD division in 2024, one of Web5's lead architects (and the co-chair of the DWN working group at DIF) continued the work as Enbox, sharing much of the same code. It is a Decentralized Web Node (DWN) stack: a high-level SDK with typed protocols, a headless auth layer, an agent runtime with an encrypted identity vault and bidirectional sync, and a self-hostable multi-tenant DWN server with SQL backends. Apps define portable record schemas and access rules; users hold DIDs (did:dht by default) and choose their DWN endpoints; records marked encryptionRequired are encrypted at the DWN layer, and sync converges data across a user's devices and permitted apps.

In practice: build on it if you want apps with private, structured, per-user data that follows the user across devices and can be shared with specific people — and you can tolerate a young stack. Don't build on it yet if you need SLAs, a managed service, or mobile SDKs.

The personal data server of the AT Protocol: each account is a signed repository — a Merkle Search Tree of records typed by Lexicons — hosted on a PDS of the user's choice, with did:plc/did:web identity, OAuth 2.1 authorization, CAR-file export, and a designed account-migration flow. Third-party apps write their own Lexicon collections into the same repo, so it functions as a general (if public-oriented) personal data store, at production scale.

In practice: the only real option today for apps where user data is public or semi-public (social, publishing, reviews, events) and needs to reach an existing audience. If your data must be private from the host, look elsewhere.

Tim Berners-Lee's web-decentralization protocol: users keep data in "pods" (Linked Data containers), apps request access rather than holding the data. Identity is WebID + Solid-OIDC; access control is WebACL or ACP; the open-source Community Solid Server (MIT) is the main self-host path, with Inrupt's proprietary ESS powering enterprise deployments — most notably the Flanders data utility Athumi.

In practice: the choice for institutional data-exchange projects (government, credentials, consented B2B sharing) where Linked Data tooling already exists or a vendor like Inrupt is on contract. Painful for small teams building consumer apps.

A French personal cloud that aggregates your data — bank statements, utility bills, health records — via sandboxed "konnectors" into one per-user server, with apps for files, photos, contacts, and a zero-knowledge password manager (Cozy Pass, Bitwarden-compatible). The original company went through receivership (2024) and judicial liquidation (Feb 2025) before Linagora acquired the assets in a court-supervised sale (May 2025); development continues under the Linagora org.

In practice: the most complete "pull your life into one place" product — bank/utility/health aggregation plus files and passwords. Best fit if you're in its French market; the aggregation connectors are its real moat.

The oldest open protocol in the list (2011, "unhosted" movement): unhosted web apps store per-user JSON documents on a server of the user's choice, discovered via WebFinger from a user@host address, authorized by OAuth bearer tokens scoped per data category. Deliberately minimal — a folder tree, ETags, and a /public subtree.

In practice: perfect for small single-user web apps — notes, bookmarks, kanban — where you want zero backend and users bring their own storage. Anything needing queries, sharing, or privacy from the host outgrows it immediately.

Brad Fitzpatrick's "personal storage system for life" (née Camlistore): content-addressed blobs with a schema layer of permanodes and signed claims, importers for third-party services, full-text search, and optional age-encrypted blob storage. Single-user by design — it is a vault for one person's lifetime of data, not a multi-tenant app backend.

In practice: a personal archive for technical users — photos, files, service exports — not a platform other apps build on. Think of it as infrastructure for your data, not user data in general.

Sydney-based enterprise company (founded 2012) selling verifiable-credential infrastructure (SVX) and a zero-knowledge, end-to-end-encrypted digital vault. Aligned with eIDAS 2.0 / EUDI Wallet and the MyData movement; the rare PDS-era company that is unambiguously alive — because it went enterprise and proprietary rather than open protocol.

In practice: what you buy when an enterprise or government needs verifiable credentials and an encrypted vault with contracts attached — not something an indie app developer builds on.

The reference implementation of the Decentralized Web Node spec — and Enbox's direct ancestor. Block shut down its TBD division in November 2024; the repos moved to the Decentralized Identity Foundation org and have been dormant since autumn 2024 (not archived, but unmaintained). The DWN spec remains a draft that its DIF page still calls an "active work item," despite no substantive commits since September 2024. The engineering did not die with the division: one of Web5's lead architects continued the same codebase as Enbox, which is where the design actually lives now.

In practice: don't start new work on the DIF repos — use Enbox if you want this architecture, or fork knowing you'll be your own maintainer.

Vancouver startup building user-owned-data infrastructure: UCAN capability tokens and WNFS, an encrypted, content-addressed file system on IPFS with a genuinely zero-knowledge private partition. The company shut down in April 2024 (founder-confirmed); the domain is dead. UCAN outlived it — the community working group maintains v1.0 in production use at Storacha — while WNFS itself has no active maintainer.

In practice: of historical and design interest only. If you need capability-based auth, use UCAN via the community working group; the storage layer is gone.

The dominant "Web3 data" stack of 2021–2023: DID-authored, append-only signed event streams, with ComposeDB's GraphQL models on top. 3Box Labs merged with Textile into Recall Labs (Feb 2025), then pivoted to an AI-agent token network and deprecated js-ceramic and ComposeDB (Apr 2025), shutting down the hosted anchor service. The Rust node, Ceramic One, survives as MIT open source with best-effort maintenance.

In practice: Ceramic One is usable for public, verifiable event streams if you're willing to self-host and self-maintain. The productive developer platform (ComposeDB) no longer exists.

Australian project offering encrypted, user-owned document databases scoped per application "context," with NaCl keys held by the user, CouchDB-style replication between storage nodes, and a mobile Vault app — architecturally the closest recent sibling to Enbox's encrypted-data thesis. As of September 2026: repos stale since February, all project domains fail DNS resolution, and the VDA token trades near zero. No formal shutdown notice was found, but the project appears to have quietly collapsed.

In practice: don't build on it. Its encrypted-per-context data model was genuinely good — Enbox is the living place to get that architecture now.

MyData-aligned open-source PDS server from Fujitsu Labs: a "cell" per person containing per-app "boxes," WebDAV for files and OData for structured data, with PKI-signed tokens for cross-cell access. Won MyData Operator awards in 2020–21; last release November 2022, core repo untouched since March 2023.

In practice: superseded. Its cross-cell trust ideas remain worth reading for anyone designing PDS-to-PDS federation.

One of the original commercial PDS plays (founded 2009 as SocialSafe): a client-side-encrypted "personal data library" with user-held keys and consent-based sharing to apps. The consumer app was discontinued years ago in a B2B pivot; the website is live but public activity is minimal, and the company's current operating status could not be verified as of September 2026.

In practice: a B2B consent-sharing vendor, not a platform you can adopt — and its long arc (consumer PDS → enterprise pivot → quiet) is the category's business-model lesson in miniature.

Not a PDS, but the thing most people actually deploy when they want their data back: a self-hosted file sync and collaboration suite. Included because any honest comparison has to admit that for "my files, my server," the boring incumbent wins today.

In practice: if your actual need is files, photos, calendars, and collaboration under your own roof, deploy this and stop reading comparison pages. It does not give apps a structured, permissioned data layer over user data — which is the one thing everything else on this page is trying to do.