Trust you can verify
We do not ask you to take our security on faith. AlgoVoi runs in your own infrastructure, holds nothing of yours, and produces signed evidence you can check offline. Trust here is a property you verify, not a badge you accept.
Operator held custody
You hold the keys and the funds. The gateway signs payouts with the operator's own key, in your environment or your HSM or KMS, and that key never leaves the box. AlgoVoi never takes custody of your funds and never holds your data. There is no AlgoVoi account in the settlement path.
Everything is signed
Post quantum signatures
Records and security decisions are signed with Falcon-1024 and ML-DSA-65, so evidence made today stays verifiable across a long retention horizon.
Content addressed
Every signed artefact is identified by the hash of its own canonical bytes (RFC 8785), so a record cannot be quietly swapped for another.
Sealed at rest
Sensitive content is sealed under ML-KEM-1024 while the evidence chain around it stays readable and verifiable from the published public key.
Trusted time
RFC 3161 timestamps bind records to an independent authority's clock, with an air gapped fallback that makes no external call.
Verify it yourself
Every deployment emits a self contained evidence pack: the signed chains, the public key and a standalone verifier. The verifier's whole trust base is two public libraries. No AlgoVoi code runs in the check, no service is called, and no network is required.
pip install pqcrypto rfc8785
python verify_evidence_pack.pyThe canonical bytes a signature covers reproduce byte identically across eight independent RFC 8785 implementations, so the exact preimage is reconstructible in your own stack.
Data handling
- Receipts and decisions carry amounts, references and hashes, and no customer PII.
- The stack is air gap capable and makes no outbound call to AlgoVoi.
- Bring your own key custody: HSM, AWS KMS, HashiCorp Vault or PKCS#11. The signed output is unchanged, so verification stays identical.
Evidence instead of a badge
We do not claim certifications we do not hold, and this page carries none. The point of the design is that you do not need to trust a third party attestation about us: the records and decisions verify on their own from public primitives. Where you need a regulatory record keeping posture, see regulatory evidence and our compliance summary.