Building Products That Last: How Product Ownership Helped Singpass Evolve into a Trust Ecosystem

Scan a QR code, log in, and access services. The whole thing takes seconds. But in those seconds, Singpass ↗ (opens in new tab) is doing far more than checking your password, it’s verifying your information, confirming your authority to act, checking your consent, and screening the interaction for fraud. Most people never see any of this, and that is the point of a seamless experience.

That gap, between what Singpass looks like and what it actually does, is the idea Winston Teo wants to uncover at STACK Conference 2026. In his session, "Earning Trust at Every Level: How Singpass Uses Data and AI to Protect Its Systems, Its Users and Its Ecosystem," he shares how Singpass grew from a login tool into what he calls Singapore's Trust Operating System, a foundation that a growing share of the country's digital economy now operates on.

Winston is a Senior Director of Singpass under Government Digital Products at GovTech Singapore. With almost two decades of experience in technology, product and engineering leadership, he leads the continued development of Singpass, focusing on the platform's security, usability and inclusivity as it evolves with Singapore's digital needs. 

In this article, ahead of his session, Winston shares more about his view of product ownership, one built for decades rather than roadmaps, and why he believes it separates infrastructure that lasts from infrastructure that has to be rebuilt every few years.

From a login screen to a trust platform

Authentication, Winston points out, is only one part of what Singpass does today. Underpinning it are the platform's Trust & Safety capabilities, which detect unusual or abusive activity and step up assurance when needed.

"This is why I increasingly describe Singpass as Singapore's Trust Operating System," Winston said. "The idea is to provide a common set of trusted capabilities, or trust primitives, that relying partners can build on, instead of requiring everyone to solve the same problems independently."

The scale of that shift is significant. Five years ago, capabilities like the Singpass app with Digital IC, Myinfo, Face Verification and digital signing were already emerging. Today, Singpass supports more than 2,700 services across over 800 government agencies and businesses, facilitating more than 41 million transactions each month ↗ (opens in new tab). It has also kept pace with evolving security standards, moving towards FAPI 2.0, a modern security profile that strengthens protection against threats such as token theft, and launched passkeys in July 2026 ↗ (opens in new tab) for a more phishing-resistant way to log in.

For Winston, the more telling shift is not an improvement in Singpass’s features but the platform's trajectory, from an app used to access a government website into infrastructure that now underpins a meaningful part of Singapore's digital economy.

Ownership as a discipline, not a milestone

Behind that growth is a particular belief of what it means to own a national platform. To Winston, product ownership means owning the outcome for a product's entire lifetime.

"When we introduce a capability on a national platform, we live with that decision for many years," he explains. "We have to secure it, operate it reliably, support users and partners, understand whether it is working, evolve it as technologies and threats change, and eventually determine how to migrate or retire it."

A product, in his view, is not finished when it goes live as that is when the obligation of ownership begins. Much of that responsibility is invisible to users: resilience, security, privacy, governance and maintainability. It's a philosophy Singpass has formalised as one of its product principles, Design for the Long Run.

That same long-term ownership is what allows Singpass to keep evolving without starting from zero each time. Its capabilities, built up over many years in response to real needs, have to keep working together coherently rather than drifting into a collection of products with different assumptions. Winston terms this as evergreen modernisation: modernising legacy systems, consolidating capabilities, and simplifying partner integration, even when users do not see the work.

Breaking trust down into reusable parts

Keeping Singpass's capabilities coherent, rather than a growing pile of one-off features, required more than discipline. It required a shared vocabulary and Winston's answer is establishing a framework: trust primitives, a small set of reusable building blocks he argues any digital system needs, regardless of the sector. Authentication establishes who someone is; authorisation and delegation define what they're allowed to do; verifiable credentials vouch for what can be trusted about them; and digital signing proves they genuinely approved the transaction." Trust & Safety runs across all of them, screening for risk and stepping in when something looks wrong.

Such a framework did not emerge overnight. As more of daily life moved online, citizens grew tired of creating new logins for every service and signing paper forms by hand, while agencies and businesses needed reliable ways to establish identity, obtain verified information with consent, and complete transactions at the right level of assurance, all against a shifting landscape of phishing, impersonation and scams. Winston's move was to stop treating each of those needs as a one-off problem and instead build them as parts any service could reuse.

"When those primitives are reusable, the ecosystem gains leverage," he said. "Individual agencies and businesses don't have to recreate identity, authorisation, verified-data or digital-signing mechanisms from scratch."

Where digital trust goes next

Looking ahead, Winston expects digital trust to become more contextual, portable and user-controlled. The question he keeps coming back to is simple: what is the minimum information needed to safely complete this transaction? A service that only needs to confirm someone is above a certain age, for instance, shouldn't need their full identity or date of birth. Credentials, in his view, should also be portable, carried by users and presented across services rather than requiring a return to the original source.

He is equally focused on a tougher problem: representing authority and delegation, as caregivers act for family members, employees act for companies, and AI agents increasingly carry out parts of a digital journey on someone's behalf. Identity alone will no longer suffice as systems will need to know on whose behalf someone is acting, what they have been authorised to do, and whether that authority can be revoked.

What excites Winston most is the leverage such infrastructure gives the wider ecosystem, sparing agencies and businesses from solving the same foundational problems repeatedly.

"The best infrastructure eventually becomes almost invisible," he explains. "People don't need to understand the protocols or cryptography behind a transaction. They simply know that it works, that it is safe, and that they can trust it."

A lesson for other product teams

When asked what other product teams might take away from Singpass's trajectory, Winston points to a different operating philosophy: thinking past the immediate roadmap to the long-term consequences of today's decisions, and asking whether a team is solving only the immediate problem or building a reusable capability that can evolve and be operated reliably at scale.

There is a balance to strike, he cautioned. Generalise too early and a team risks over-engineering before it understands the problem.Solve only for the immediate use case and one-off solutions pile up, making the platform harder to evolve later. "The lesson is to be intentional about the level at which you are solving the problem," he said. "For a national platform, security, reliability and long-term maintainability cannot be afterthoughts. They must be designed from the start."

That is the mental model Winston plans to unpack at STACK Conference 2026: starting with the login capability everyone recognises, then working outward to the fuller set of trust capabilities and Trust & Safety systems behind it. Seen through that lens, many seemingly different problems reduce to a few fundamental questions: who is this, what are they allowed to do, what did they genuinely approve, and how is the interaction kept safe.

For anyone building products meant to outlast a single roadmap, those are questions worth sitting with. At STACK Conference 2026, this is where Winston will unpack how Singpass has answered them at national scale, a working example of what it actually takes to build infrastructure that lasts.

Join Us at STACK Conference 2026 

Looking for a solution to a current challenge, exploring an unfamiliar technology, or seeking perspectives from another part of the ecosystem? 

STACK Conference explores the ideas shaping technology’s future. STACK Expo offers a place to make those connections and brings them to life.

Happening on 4–5 November 2026, STACK Conference and Expo 2026 brings together two days of keynotes, technical deep dives and conversations with leaders and practitioners across the technology ecosystem. 

Gain fresh insights, exchange ideas and see technology in action. Get your tickets now! ↗ (opens in new tab)