The longevity problem
A signed audit record is evidence for as long as its signature can be verified. ECDSA and RSA signatures depend on the hardness of elliptic-curve discrete logarithm and integer-factorisation problems. Both are broken by Shor’s algorithm on a sufficiently powerful quantum computer. NIST finalized post-quantum standards (FIPS 205, FIPS 206, FIPS 203) in 2024 and has already begun the process of deprecating RSA and ECC. The migration window has opened. For short-lived records, this is a planned upgrade problem. For long-lived records, it is a retroactive problem: a signature made today under RSA or ECDSA may not be verifiable in 20 years. Health records, insurance policies, defense contracts, and legal instruments routinely need to be provable for decades. Post-quantum signatures solve this at the point of writing. Sign a record today under Falcon-1024 or ML-DSA-65 and the evidence is mathematically verifiable after the migration, with no re-signing required.How post-quantum signatures work in a compliance archive
A compliance archive that uses post-quantum signatures from the start:- Writes each record as an encrypted, content-addressed entry.
- Signs the archive receipt with Falcon-1024 (NIST FIPS 206 lattice-based signature scheme).
- Chains each entry to the previous one with a SHA-256 hash-link, so the whole archive is a tamper-evident sequence.
- Stores the Falcon-1024 public key where auditors and regulators can verify it independently.
What Falcon-1024 and ML-DSA-65 protect in the AlgoVoi suite
The Verifiable Compliance Suite uses two post-quantum signature schemes and one post-quantum key-encapsulation mechanism:
Falcon-1024 has the smallest signature size among the FIPS 206 candidates (690 bytes), which matters for long-lived chains: a 20-year archive under a healthcare retention policy can hold millions of entries. ML-DSA-65 provides a second independent signing basis for compliance outputs.
ML-KEM-1024 encrypts the record content. A record is unreadable without the corresponding ML-KEM key. The evidence chain (the metadata, the hash, the timestamp, the access events) is readable by an auditor with only the public key; the content stays confidential.
Long-term key custody
Post-quantum signatures solve the algorithm problem. Key custody solves the operational problem: who holds the signing key, and what happens if it is lost or rotated? The suite supports three custody modes via bring-your-own-key custody:
For all three modes, the signed output is byte-identical. The offline verifier and the evidence pack work identically regardless of where the key was held at signing time.
Key rotation across decades
Every key rotation in the archive is itself post-quantum signed: the outgoing Falcon-1024 key authorises a successor public key, and the successor counter-signs the rotation entry. A holder of only the original published key can walk the rotation chain forward and verify every entry, with no third party and no online service. The chain is as long as the archive’s life.Compliance posture across the estate
Long-term evidence is only useful if you know, at any moment, that the evidence is intact. The Compliance Command Center is the self-hosted posture dashboard that ingests signed evidence from every product in the estate, re-verifies every chain offline, and renders one proven posture where every figure is recomputed, not vendor-asserted. When a chain entry is tampered with, the Command Center surfaces the broken entry at the next re-verification. An auditor who walks in and asks “is your evidence intact?” gets an answer grounded in cryptographic re-verification of the actual chains, not a status page. The Command Center self-validates with an IQ/OQ/PQ pack on first run, generating signed validation evidence your documentation team attaches to your 21 CFR Part 11 §11.10(a) submission.21 CFR Part 11 and long-term records
21 CFR Part 11 requires that electronic records be accurate, reliable, and readable over the record’s retention period (§11.10(a)), and that audit trails be computer-generated with timestamps (§11.10(e)). For records with retention periods of 10 to 30 years, “readable over the retention period” includes cryptographic verifiability. A signature that is obsolete before the retention period ends does not satisfy the longevity intent of the regulation. The suite addresses both provisions:- §11.10(a) validation: The Compliance Command Center generates a signed IQ/OQ/PQ validation pack on installation. The pack is itself Falcon-1024-signed and verifiable offline, so the validation evidence persists as long as the archive does.
- §11.10(e) audit trail: Every archive entry, access event, hold, and policy decision is a Falcon-1024-signed, timestamped, hash-linked entry. The trail is append-only and tamper-evident; altering any entry breaks the chain.
Verify it independently
The post-quantum claims above are checkable. Every Verifiable Compliance Suite deployment ships a standalone verifier that any Python developer can audit in an afternoon:pqcrypto for Falcon-1024 verification and rfc8785 for JCS canonicalization. Both are public libraries. No AlgoVoi code participates in the verification.
A real archive receipt’s JCS canonical bytes reproduce byte-identically across eight independent JCS implementations (Python, Node.js, Ruby, PHP, Go, Rust, Java, .NET), so the bytes the signature covers are deterministic across your whole stack and language, with no AlgoVoi dependency.
Get the post-quantum compliance estate
Buy the Verifiable Compliance Suite
One-time perpetual licence, self-serve, paid in USDC. Pay, download, key. One key installs the full
post-quantum compliance estate: Compliance Command Center, Records Vault, Recovery Vault,
Verifiable Archive, Compliance Gate, Retention, Sanctions Monitor, Travel Rule, and Verifiable Audit
Log. Air-gap capable, no PyPI. Evidence supporting HIPAA, GDPR, eIDAS, and 21 CFR Part 11.
Enterprise or OEM: email us.