The Verifiable Compliance Suite
The AlgoVoi Verifiable Compliance Suite is a self-hosted, air-gap-capable compliance evidence and long-term records platform with post-quantum signatures (Falcon-1024 and ML-DSA-65) and offline-verifiable integrity proofs. It is the digital-preservation and audit-evidence estate for regulated sectors that must keep records provably intact and confidential for decades, on their own infrastructure, with no vendor in the verification path.
What it is
Documents are preserved write-once in a tamper-evident, content-addressed archive: encrypted at rest, RFC-3161 timestamped, and offline-verifiable with no vendor in the loop. Post-quantum signing keeps the evidence verifiable as cryptography evolves. Records are added and removed the compliant way: a legal hold blocks deletion, then a signed erasure tombstone leaves proof the record existed while the content is irrecoverable. The Compliance Command Center re-verifies every signed chain offline and shows one proven posture, where every figure is recomputed, not asserted. The whole estate installs from one encrypted deliverable under a single Falcon-1024 licence that is both the decryption key and the runtime licence.
What is in the estate
One perpetual licence ($5,000) installs and runs the whole estate, air-gap capable, with no PyPI at runtime:
Compliance Command Center
Evidence console and one-posture dashboard, IQ/OQ/PQ self-validation pack, SCIM and TOTP sign-in, SIEM forwarding.
Records Vault + .epi export
Write-once regulated-records vault with portable, offline-verifiable evidence export and a volume importer.
Recovery Vault
Threshold (Shamir k-of-n) post-quantum key recovery for any Substrate 2 key.
Verifiable Archive
Doc-archive engine with S3, KMS, PKCS#11 and HashiCorp Vault key custody; Merkle-batch or per-document signing.
Verifiable Audit Log
Tamper-evident, offline-verifiable append-only audit chain with optional live SIEM forwarding.
Compliance Gate
Policy-bound ALLOW / REFER / DENY decision engine, signed and no-PII.
Sanctions Monitor & Travel Rule
Screening and FATF Recommendation 16 evidence, signed and no-PII.
Crypto-Agility + Retention
Classical-to-post-quantum migration with provable continuity, plus retention and disposition.
All on the Substrate 2 core: Falcon-1024 and ML-DSA-65 signatures, ML-KEM-1024 sealing, JCS (RFC 8785) canonicalisation, and policy binding.
Self-hosted vs cloud preservation
| Axis | Managed cloud preservation (Preservica, Arkivum) | Verifiable Compliance Suite (self-hosted) |
|---|---|---|
| Where records live | Vendor-operated cloud | Your servers, including fully air-gapped networks |
| Commercial model | Recurring subscription | One perpetual licence |
| Verification | Inside the vendor platform | Offline, against a published public key, no vendor in the loop |
| Dependency at year 20 | Vendor must still exist and hold your data | None: the estate and its evidence outlive the vendor |
| Signatures | Vendor-managed | Post-quantum (Falcon-1024, ML-DSA-65) plus RFC-3161 timestamps |
| Data sovereignty | Contractual | Physical: data never leaves your perimeter |
See the detailed Preservica alternative and Arkivum alternative comparisons.
Regulatory coverage
The suite produces the tamper-evident, independently verifiable evidence underlying these frameworks. Your counsel certifies compliance; the suite provides the evidence certification rests on.
| Framework | Evidence the suite provides |
|---|---|
| HIPAA §164.312 | Signed tamper-evident read-access log and write-once content-addressed archive; the signed chain breaks on any alteration |
| GDPR Art. 17 & 5(1)(f) | Signed erasure tombstones (content crypto-shredded, proof of existence survives); ML-KEM-1024-sealed records at rest |
| eIDAS | RFC-3161 qualified timestamps from an independent TSA, with an air-gap fallback to a signed chain |
| 21 CFR Part 11 | IQ/OQ/PQ self-validation pack generated on installation |
| EU AI Act Art. 12/19/26 | Automatic, tamper-evident AI-decision record-keeping and enforced retention (details) |
| MiCA Art. 68(9) & DORA | Self-hosted, offline-verifiable logging under your own keys (details) |
| Long-term retention | Falcon-1024 and ML-DSA-65 keep evidence verifiable after the post-quantum migration |
How verification works
Each record recomputes from its own canonical bytes: canonicalise under RFC 8785 (JCS), hash with SHA-256, and check the Falcon-1024 signature against the published public key. There is no issuer call, no registry lookup, and no network dependency, so an auditor or regulator checks the evidence on an air-gapped machine. Sealed containers (.acv) open with a self-contained extractor that imports no AlgoVoi software, so an auditor in 2045 does not need AlgoVoi to exist.
Pricing
A one-time purchase on a perpetual licence at $5,000, bought self-serve from the suite store. One licence installs and runs the whole estate with no per-seat charge, no per-record charge, and no recurring subscription. Cost does not compound with retention duration, which is the structural difference from any subscription preservation service.
Frequently asked questions
What is the AlgoVoi Verifiable Compliance Suite?
It is a self-hosted, air-gap-capable compliance evidence and long-term records platform. It preserves documents write-once in a tamper-evident, content-addressed archive, signs every evidence chain with post-quantum cryptography (Falcon-1024 and ML-DSA-65), and lets anyone verify integrity offline against a published public key, with no AlgoVoi software or network call in the trust path.
Is it a self-hosted alternative to Preservica and Arkivum?
Yes. Preservica and Arkivum are cloud-first managed preservation platforms. The Verifiable Compliance Suite runs the equivalent long-term preservation estate on your own servers under your own keys, adds post-quantum signatures and offline-verifiable integrity those platforms do not offer, and is licensed once perpetually rather than as an annual subscription.
Is it self-hosted and air-gap capable?
Yes. The entire estate installs and runs on your own infrastructure from a single encrypted deliverable, with no cloud service, no phone-home, and no PyPI dependency at runtime. A Falcon-1024 licence is both the decryption key and the runtime licence, so nothing contacts AlgoVoi to install, run, or verify.
How does post-quantum signing protect long-term records?
Records that must survive for decades will outlive today's classical signature algorithms once a cryptographically relevant quantum computer exists. The suite signs with Falcon-1024 and ML-DSA-65 (NIST post-quantum standards) and seals with ML-KEM-1024, so evidence signed today stays verifiable through the post-quantum migration rather than becoming forgeable.
Which regulations does the suite provide evidence for?
HIPAA audit controls and integrity, GDPR right to erasure and integrity, eIDAS qualified timestamps, 21 CFR Part 11 validation, EU AI Act Articles 12, 19 and 26 record-keeping, and MiCA and DORA logging. Your counsel certifies compliance; the suite provides the tamper-evident, independently verifiable evidence certification rests on.
How much does the Verifiable Compliance Suite cost?
A one-time purchase on a perpetual licence at $5,000, bought self-serve from the suite store, with no per-seat or per-record fee and no recurring subscription.
Last updated: 3 August 2026.