Self Host Regulated Records Preservation

Self-hosting regulated records means running the preservation and evidence estate on your own infrastructure: RFC-3161 timestamping, a tamper-evident audit log, legal and e-discovery holds, and offline verification, all under your own keys with no cloud dependency. This guide covers what a compliant self-hosted estate for HIPAA, GDPR, and eIDAS records requires, and how the AlgoVoi Verifiable Compliance Suite provides it. Last updated: 3 August 2026.

This guide covers the compliance and long-term-data estate. If you need the agentic payment rails (x402, MPP, AP2, A2A), those ship separately as the Payment Rails bundle.

The preservation problem cloud storage does not solve

A regulated record stored in a cloud bucket is encrypted and durable. It is not evidence. Evidence means three things beyond write-durability:

Proof of when a record existed, independent of your own server clock.
Proof of who read it, logged tamper-evidently so the log itself cannot be quietly altered.
Proof it was or was not held for a matter, so disposal sweeps cannot touch records that are frozen for litigation.

Cloud storage gives you (1) only if you add an RFC-3161 time-stamping authority call yourself, (2) only if you build a signed read-event log yourself, and (3) only if you build litigation-hold enforcement yourself. Then your auditor or opposing counsel needs to trust your implementation to verify any of it. A self-hosted evidence estate builds all three as tamper-evident, independently verifiable signed chains from the start, so the verification is a mathematical check against a published public key, not a review of your processes.

What a self-hosted evidence estate requires

The minimum set for regulated-records preservation:

Capability	Why it matters
Write-once, tamper-evident archive	Establishes baseline integrity: HIPAA §164.312(c)(1), GDPR Art 5(1)(f)
RFC-3161 trusted timestamps	Proves existence by a date from an independent authority, not your own clock: eIDAS qualified timestamps
Tamper-evident read-access log	Every read is sealed as evidence, detectable if altered: HIPAA §164.312(b) audit controls
Legal and e-discovery holds	Frozen records cannot be disposed of even after their retention window expires: litigation-hold duty
Offline-verifiable evidence	Auditors and opposing counsel verify independently, with no running service and no vendor account
Post-quantum signatures	Evidence stays verifiable decades from now, after cryptographic standards evolve

The AlgoVoi Verifiable Compliance Suite ships all six as a single on-prem bundle. Each capability is a separate Falcon-1024-signed, hash-linked chain stored beside the encrypted archive, verifiable offline from one published public key.

Install the self-hosted evidence estate

The full estate is a single encrypted deliverable. Your Falcon-1024-signed licence is both the decryption key and the runtime licence.

Prerequisites

python -m pip install cryptography pqcrypto rfc8785 fastapi uvicorn httpx

That is the full external dependency set for extraction and verification.

Extract and install

# Save your licence key, then extract (offline, no network needed)
python algovoi_unbundle.py --license @licence.key --out ./algovoi --install bundle.algv

The extractor verifies your licence against AlgoVoi’s issuer public key, then decrypts and writes each component wheel with a SHA-256 integrity check. Nothing installs unless the licence is valid and every integrity check passes. No PyPI call, no phone-home.

Start the estate

export ALGOVOI_LICENSE_KEY="$(cat licence.key)"

# Control plane and policy bridge
algovoi-substrate2-controlplane

# Compliance Command Center (re-verifies all evidence chains, one posture dashboard)
uvicorn algovoi_command_center.app:create_app --factory --port 8200

# Records Vault API (timestamping, read-access log, holds)
uvicorn algovoi_records_vault.app:app --port 8300

# Compliance Gate (ALLOW / REFER / DENY policy decisions)
uvicorn algovoi_compliance_gate.app:app --port 8400

All services licence-check on startup and fail closed if the key is absent, invalid, or expired.

Air-gap deployment

The bundle installs with no external network access. For fully air-gapped environments:

Copy bundle.algv, algovoi_unbundle.py, and your licence.key to the target machine.
Run the extractor. The only outbound call the extractor makes is a licence-validity check against AlgoVoi’s issuer key, which is bundled inside the extractor itself (no network needed for the check).
All wheels install from the local extracted directory, not from PyPI.

Archive a record with RFC-3161 timestamping

from algovoi_records_vault import RecordsVault

vault = RecordsVault.from_env()  # reads ALGOVOI_LICENSE_KEY

# Archive and timestamp in one call
receipt = vault.archive(
    content=document_bytes,
    metadata={"subject": "patient-001", "type": "consent"},
    timestamp=True,       # request an RFC-3161 token from the configured TSA
)

print(receipt.archive_hash)      # SHA-256 of the content
print(receipt.tsa_token_present) # True if RFC-3161 token was obtained
print(receipt.chain_head)        # current chain head for your records

In air-gap mode, timestamp=True with no network degrades to a signed air-gap record that logs the imprint and the local clock in a signed chain entry. The TSA is optional in the same way the S3 backend is optional.

Place a legal hold

# Freeze all records for a matter, overriding the retention schedule
hold = vault.place_hold(
    matter_id="litigation-2026-001",
    subject="patient-001",
    reason="pending_litigation",
)

# Records matching the hold can no longer be disposed of
# vault.dispose(record_id=...) raises HeldRecordError until the hold is released

The hold is a signed entry in the holds/ chain. is_held() re-verifies the hold chain before every disposal check. A corrupted or missing chain entry counts as held, not released, so tampering cannot silently unlock a disposal.

Verify the evidence pack offline

Every Records Vault deployment can emit a self-contained evidence pack: the signed chains, the public key, and a standalone verifier. An auditor or opposing counsel runs this with no AlgoVoi software and no network:

# On any machine with Python and two public libraries
pip install pqcrypto rfc8785
python verify_evidence_pack.py

A clean pack prints:

[PASS] archive_chain.json      archive_entry       1 entries
[PASS] tsa_chain.json          vault_tsa_token     1 entries
[PASS] access_chain.json       vault_access_event  2 entries
[PASS] holds_chain.json        vault_legal_hold    1 entries
[PASS] timestamp binding       every tsa.messageImprint == SHA-256(JCS) of its archive receipt
RESULT: ALL EVIDENCE VERIFIED OFFLINE (public key only)

Tamper with any entry and the chain breaks at exactly that entry. The verifier code is ~120 lines; your auditor can read and audit it in an afternoon.

Portable evidence export

The .epi Evidence Export add-on packages a Records Vault evidence set as a portable, post-quantum-sealed artifact your auditor carries away and verifies on their own machine, with no AlgoVoi software, service, or account on their side.

Regulatory coverage

Framework	Provision	Evidence the suite provides
HIPAA	§164.312(b) audit controls	Signed tamper-evident read-access log: principal, record, granted or denied, reason; exportable for SIEM and GRC
HIPAA	§164.312(c)(1) integrity	Write-once content-addressed archive; Falcon-1024-signed chain breaks on any alteration
GDPR	Art 17 right to erasure	Signed erasure tombstones: field content is crypto-shredded; a signed proof the record existed survives
GDPR	Art 5(1)(f) integrity and confidentiality	ML-KEM-1024-sealed records at rest; offline-verifiable integrity chain
eIDAS	Qualified timestamps	RFC-3161 tokens from an independent TSA; air-gap fall-back signs the imprint in a local chain
21 CFR Part 11	§11.10(a) validation documentation	IQ/OQ/PQ self-validation pack generated by the Compliance Command Center
Long-term retention	Decades-scale evidence	Falcon-1024 and ML-DSA-65 signatures keep evidence verifiable after the post-quantum migration

Your counsel certifies compliance. The suite provides the tamper-evident, independently verifiable evidence that certification rests on.

Bring your own keys

Hold the Falcon-1024 signing and ML-KEM-1024 encryption keys in your own HSM, KMS, or HashiCorp Vault. AlgoVoi never sees a private key. The signed output is unchanged, so the evidence pack and the offline verifier work identically regardless of where the key is held.

Get the self-hosted compliance evidence estate

The Verifiable Compliance Suite is a one-time purchase on a perpetual licence, self-serve from the store.

Buy the Verifiable Compliance Suite

One-time perpetual licence, self-serve, paid in USDC. Pay, download, key. One key installs the full compliance and long-term-data estate: Compliance Command Center, Records Vault, Recovery Vault, Verifiable Archive, Compliance Gate, Retention, Sanctions Monitor, Travel Rule, and Verifiable Audit Log. Air-gap capable, no PyPI. Enterprise or OEM: email us.

Get started

Platform

Concepts

Keystone

Agent Mesh

Substrate 2

Commercial

Open substrate

Payment protocols

Chains

Integrations

Help

Company

Self Host Regulated Records Preservation

The preservation problem cloud storage does not solve

What a self-hosted evidence estate requires

Install the self-hosted evidence estate

Prerequisites

Extract and install

Start the estate

Air-gap deployment

Archive a record with RFC-3161 timestamping

Place a legal hold

Verify the evidence pack offline

Portable evidence export

Regulatory coverage

Bring your own keys

Get the self-hosted compliance evidence estate

Buy the Verifiable Compliance Suite

​The preservation problem cloud storage does not solve

​What a self-hosted evidence estate requires

​Install the self-hosted evidence estate

​Prerequisites

​Extract and install

​Start the estate

​Air-gap deployment

​Archive a record with RFC-3161 timestamping

​Place a legal hold

​Verify the evidence pack offline

​Portable evidence export

​Regulatory coverage

​Bring your own keys

​Get the self-hosted compliance evidence estate

Buy the Verifiable Compliance Suite

The preservation problem cloud storage does not solve

What a self-hosted evidence estate requires

Install the self-hosted evidence estate

Prerequisites

Extract and install

Start the estate

Air-gap deployment

Archive a record with RFC-3161 timestamping

Place a legal hold

Verify the evidence pack offline

Portable evidence export

Regulatory coverage

Bring your own keys

Get the self-hosted compliance evidence estate