> ## Documentation Index
> Fetch the complete documentation index at: https://docs.algovoi.co.uk/llms.txt
> Use this file to discover all available pages before exploring further.
# Substrate 2
> Commercial AlgoVoi substrate and self hosted payments suite: the agentic payment gateway, post quantum evidence core, Command Center and Records Vault.
## What Substrate 2 is
Substrate 2 is AlgoVoi's **commercial** evidence substrate: the canonical receipts, audit
chains, and verifiable attestations that sit underneath agentic and x402 payments, packaged
as a single integrated product with the post-quantum and zero-knowledge capabilities enabled
by default.
It speaks the same canonical evidence language as the open [Substrate](/canonicalisation-substrate)
— the same receipts, the same content hashes, the same offline-verifiable proofs — so anything
built against the open substrate interoperates with Substrate 2 unchanged. The difference is
what comes standard, and the terms you get it under.
Substrate 2 is in production today — it runs as the evidence substrate behind the AlgoVoi
payment gateway, signing and verifying live agentic and x402 payment receipts.
Falcon-1024 and ML-DSA signatures (ML-DSA per NIST FIPS 204; Falcon per the draft FN-DSA / FIPS 206) are standard, not an add-on.
Evidence you sign today stays verifiable after the migration to post-quantum cryptography.
Prove an agent cleared a trust threshold without revealing its score — Bulletproofs range proofs,
cryptographically verified offline, with no disclosure of the underlying behaviour data and no
prover service or callback.
Compose trust credentials from multiple independent issuers into one verifiable token —
no shared trust root required. Each credential is verified on its own merits.
Hash-link your payment receipts into a tamper-evident audit chain that any party can verify
from local data alone, with no infrastructure or registry lookup. Satisfies the record-keeping
and audit-trail duties of MiCA Art. 80, DORA Art. 14, and AMLR Art. 56.
A self-hosted issuer-trust hub and service bridge that runs the federation, zero-knowledge,
and retention services as one estate. Every service self-registers and pulls its trust set from one place, with
a signed audit of every trust change. SQLite out of the box, PostgreSQL when you scale.
A single integrated package under a commercial licence with support, warranty, and
indemnification. The self-serve on-prem bundle is a one-time perpetual buy-out of the
full package, not a yearly subscription. No open-source attribution obligations to
manage in your own product.
## The two pieces: the control plane and the keystone
Underneath everything, Substrate 2 has two simple parts. One connects the system together; the other records what the system did.
**The control plane: where the pieces connect.**
Think of it as the switchboard. Every service (payments, compliance, records, evidence) plugs into one hub. The control plane keeps the single list of which keys and issuers are trusted, lets each service register itself, and shows one live view of the whole system's health. Connect a service once, and from then on it knows who to trust and reports into one place.
**The keystone: the record of what actually happened.**
When an AI agent makes a payment, a lot happens along the way: it is checked for authorization, a decision is made, the payment executes, and it settles on chain. The keystone stitches those steps into one tamper-evident thread. Each step is a short fingerprint (a hash) locked to the step before it, so the whole story, from "allowed to spend" to "settled," can be re-checked by anyone, offline, without any AlgoVoi software. Change any detail and the fingerprints stop matching.
You can hand that same record to a counterparty in whatever format they already use: a signed JSON receipt, a W3C Verifiable Credential, a JOSE token, a Visa Trusted Agent Protocol receipt, or a privacy-preserving zero-knowledge proof. Each one still points back to the exact same payment.
**How they fit together.**
The control plane connects the apps. The keystone follows a single transaction through them to a verified outcome. One is the fabric the services sit in; the other is the thread that runs through a payment. Apps bind to the control plane at rest; the keystone binds them in motion.
Everything is signed (including post-quantum signatures), content-addressed, and verifiable offline. You can check the keystone yourself with the open verifiers, which depend on no AlgoVoi software: see [The Keystone](/keystone).
## Cross-party authority: delegation, revocation, journey
When a task crosses agents and organizations, the Orchestrator proves authority flowed correctly and was never exceeded, recomputable offline.
* **Delegation** binds each hand-off (agent A grants a scope to agent B for a window) into a tamper-evident reference. The open `algovoi-delegation-ref` is the binding; the cross-party scope-consistency proof is the commercial Orchestrator.
* **Revocation** pulls authority back before it expires. The Orchestrator proves that every downstream action at or after the revocation no longer holds, even across several hops, while actions taken before it stay valid. Revocation is prospective and provable from the bytes, not a mutable status flag. The `revocation_ref` binding and the cascade proof ship in the on-prem bundle.
* **Journey** binds a whole multi-agent task into one reference: every hop's execution and the delegations between them. Verifying one journey reference proves the entire task at once, identity and authority continuity, scope never widened, nothing under a revoked grant, and no hop omitted. The `journey_ref` binding and the aggregation proof ship in the on-prem bundle.
The Orchestrator, with the revocation and journey constructions, ships in the on-prem bundle. Delegation's open binding is published on PyPI and npm.
## What the on-prem bundle includes
The self-hosted on-prem bundle is a complete compliance and payments evidence platform under one commercial licence. It is post-quantum throughout and offline-verifiable, and the single licence both unlocks the bundle and runs every component.
* **Post-quantum substrate core.** Falcon-1024 and ML-DSA-65 signatures, ML-KEM-1024 key encapsulation, RFC 8785 canonicalisation, self-verifiable retention chains, and policy binding that proves which policy was in force and detects a silent rotation.
* **Control plane with a web control panel.** A self-hosted hub that monitors every service, with a built-in policy bridge.
* **Compliance Command Center.** The evidence console that ingests and verifies every app's signed evidence and shows live posture.
* **Records suite.** Records Vault (write-once preservation, legal hold, redaction, consent, chain of custody), .epi evidence export, Recovery Vault, Archive Auditor, and the Doc Archive engine with S3, KMS, PKCS#11, and Vault custody adapters.
* **Evidence apps.** Sanctions Monitor, Travel Rule, Audit Log, and signed payment-receipt retention.
* **Compliance Gate, as a keystone stage.** A multi-signal, policy-bound, action-bound decision engine that emits no-PII signed ALLOW, REFER, or DENY verdicts, bound into the keystone as a screen stage with a signed decision basis: which compliance standards drove the verdict, the jurisdiction check bound to its geo determination, recomputable offline.
* **Cross-party authority (the Orchestrator).** Proves delegation, revocation, and journey compose across organizational boundaries, offline: revocation pulls authority back (prospective, even multi-hop) and one journey reference proves a whole multi-agent task, with nothing acting under a revoked grant and no hop omitted.
* **Multi-chain payment gateway.** A self-hosted gateway across Base, Solana, Algorand, VOI, Hedera, Stellar, and Tempo: detect a settlement on-chain with that chain's finality, and emit a signed, no-PII, offline-verifiable settlement receipt into the Command Center. It speaks the agentic payment protocols (x402, MPP, AP2, A2A) and includes operator-held custody (sign and broadcast outbound payouts, with signed payout receipts) across every chain. The bundle licence unlocks them all. See the [Payment Gateway](/payment-rails-sqlite) page.
The substrate2 core also carries cross-issuer federation and zero-knowledge receipt primitives. The bundle verifies and runs fully offline, with no phone-home. See the [ports and interfaces reference](/substrate-2-ports) for every service's default port and HTTP API.
## What you get
* **Future-proof evidence.** Every receipt, attestation, and credential can be signed with
post-quantum primitives, so the audit trail you build now survives the arrival of quantum
computers. Classical signatures remain available for systems that do not need PQC yet.
* **Privacy-preserving trust.** Zero-knowledge reputation lets agents and counterparties
present a credential that proves "this agent meets the bar" without exposing the score, the
history, or the methodology behind it — and the Bulletproofs range proof is verified
cryptographically and offline, with no prover service to call. The right primitive for
regulated and competitive environments.
* **Federation without a central authority.** Combine credentials issued by different,
mutually-untrusting parties into a single composite proof. No issuer has to trust another;
the verifier checks each independently and binds them together.
* **A control plane to run it all.** The Substrate-2 Control Plane is a lean, self-hosted issuer-trust
hub and service bridge. The federation and zero-knowledge services self-register with it and pull
their trust set from one place, so you manage trust in one console rather than service by service.
It boots clean with no configuration, keeps a signed audit of every trust change, and stores its
state in SQLite out of the box or PostgreSQL when you scale.
* **One thing to integrate.** Canonicalisation, the full family of receipts (admission,
settlement, refund, cancellation, composite trust), the audit chain, request signing, and
the post-quantum and zero-knowledge layers all ship together as one supported package — not
a dozen pieces you assemble and version-match yourself.
* **Drop-in interoperability.** Substrate 2 produces and verifies the same canonical evidence
as the open substrate. Adopting it is a configuration swap, and existing verifiers continue
to work against Substrate 2 receipts unchanged.
* **Conformance-validated across 8 languages.** Substrate 2 produces the canonical evidence
byte-anchor that independent reference implementations in 8 languages (Python, TypeScript,
Ruby, PHP, Java, Perl, Go, Rust) reproduce byte-for-byte — the same `sha256:cc8315f7…e0`
anchor recorded in the [canonicalisation convergence matrix](/canonicalisation-substrate-v2#cross-implementor-convergence-non-normative-annex).
Its output is exact and verifies in any conformant implementation, not approximately compatible.
## Cryptography scope
We're precise about what "post-quantum" covers:
* **Signatures are post-quantum.** Every receipt, credential, and licence is signed with Falcon-1024
(NIST Level 5) or ML-DSA-65 (NIST Level 3, FIPS 204), and credentials signed with either are
verified across the federation. Evidence signed today stays verifiable — and unforgeable — after the
migration to post-quantum cryptography.
* **Zero-knowledge reputation uses Bulletproofs range proofs**, which are classically secure
(discrete-log based), not post-quantum. Each credential is still bound by a **post-quantum issuer
signature**, so a future quantum computer cannot forge a credential or prove a false threshold — at
most it could recover a committed score from a captured proof.
* **Cross-issuer federation is quantum-resistant.** Each credential is verified with a post-quantum
signature, and the composition and token authentication use SHA-256 / HMAC-SHA256 — symmetric and
hash primitives that resist quantum attack.
* **Reputation credentials are short-lived** (issued with a days-scale expiry), so the privacy of a
proven score only needs to hold for the credential's lifetime — well inside the pre-quantum window.
* **Roadmap.** A post-quantum zero-knowledge layer will be adopted when a standardised PQC proof
system is available; we do not ship bespoke, unstandardised post-quantum zero-knowledge.
## Substrate vs Substrate 2
The open Substrate is the foundation; Substrate 2 is the commercial product built on the same
semantics, with the advanced capabilities and commercial terms enterprises ask for.
| | Substrate (open) | Substrate 2 (commercial) |
| ------------------------------------ | ---------------------------------------- | ------------------------------------------------------- |
| **Licence** | Apache-2.0, open source | Commercial / proprietary |
| **Post-quantum signatures** | Available as a separate layer | **Standard, built in** |
| **Zero-knowledge reputation** | Not in the open tier | **Standard, built in** |
| **Cross-issuer federation** | Not in the open tier | **Standard, built in** |
| **Self-verifiable retention chains** | Not in the open tier | **Standard, built in** |
| **Packaging** | Modular components to assemble | **One integrated package** |
| **Support** | Community | **Commercial support + SLA** |
| **Warranty & indemnification** | As-is, no warranty | **Included** |
| **Attribution obligations** | Apache-2.0 NOTICE retention applies | **None to manage** |
| **Canonical evidence format** | The reference | **Identical and interoperable** |
| **Best for** | Open integrations, evaluation, community | **Enterprises, regulated and long-horizon deployments** |
## What's open, what's commercial
The open [Substrate](/canonicalisation-substrate) is the foundation and stays Apache-2.0.
Substrate 2 adds the advanced trust layer and the commercial terms on top of it.
**In the open Substrate (Apache-2.0, free):**
* JCS canonicalisation and the full receipt family — admission, settlement, refund, cancellation, composite trust
* Audit chain and action references
* RFC 9421 request signing and verification
* Post-quantum signatures (Falcon-1024 / ML-DSA)
* Offline receipt and audit verifiers
**Added in Substrate 2 (commercial):**
* Zero-knowledge reputation receipts
* Cross-issuer federation — compose trust across independent issuers, no shared trust root
* ATB credential verification
* Self-verifiable retention chains: tamper-evident receipt audit chains satisfying MiCA Art. 80, DORA Art. 14, and AMLR Art. 56
* One integrated, version-matched, supported package — the open pieces plus the advanced layer, assembled and maintained for you
* A commercial licence with no attribution obligations, plus warranty, indemnification, and an SLA
* Commercial support
Substrate 2 is included in the AlgoVoi Enterprise and [On-premise](/on-premise) plans — [get in touch](/trial-and-pricing) for terms.
## Why commercial
The open Substrate is, and stays, Apache-2.0 — free to adopt, with the canonical evidence
format published for anyone to implement against. Substrate 2 is a **commercial product** for
teams that want more than the open core:
* **No attribution overhead.** A commercial licence means you embed Substrate 2 in your own
product without carrying open-source notice and attribution obligations through your
distribution.
* **Enterprise terms.** Warranty, indemnification, a support relationship, and a defined SLA —
the terms procurement and risk teams expect.
* **Advanced capabilities as standard.** Post-quantum, zero-knowledge, and federation are
included and supported, not assembled from separate parts.
* **A single vendor.** One licence, one package, one point of contact for the entire evidence
layer.
## Who it's for
* Payment and agentic platforms that need a **future-proof, post-quantum** audit trail.
* Regulated businesses that need **privacy-preserving** proof of trust and compliance.
* Ecosystems that need to **federate trust** across independent issuers.
* Enterprises that need the evidence layer under **commercial terms with support**, not an
open-source licence to manage.
## The AlgoVoi commercial suite
Substrate 2 is the foundation of AlgoVoi's commercial product suite — the evidence layer the
other commercial capabilities build on and bind to. Each one is an **additional, separately-licensed
package** — an add-on that binds to Substrate 2, not part of Substrate 2 itself — available on its
own and integrating cleanly with it.
Confirm a stablecoin payment actually settled and finalised on-chain, across 8 networks —
the verification that runs in the AlgoVoi production gateway, as a commercial OEM SDK. Pair
it with Substrate 2 to turn a verified settlement into a signed, audit-ready receipt.
Issue post-quantum trust credentials to AI agents, verify them offline before granting spend
authority, and revoke them instantly. Bind a verified passport into a Substrate 2 receipt for
a signed, audit-ready record of agent trust.
Prove a payment was screened and compliant — and that the payer's score cleared a threshold —
without revealing any PII or the score. Fold each privacy-preserving proof into a Substrate 2
evidence chain.
The verifiable authorization that makes recurring and agentic crypto payments possible — a payer
signs "charge me up to X per period", and every pull is checked against that post-quantum,
revocable mandate. Bind the mandate and each charge into a Substrate 2 receipt.
Tamper-evident, post-quantum document archiving — content-addressed, encrypted at rest, signed
into an append-only chain you verify offline, on local storage or S3. With reporting and auditing
that feeds your SIEM, Grafana, and GRC tools. Bind entries into the Substrate 2 evidence chain.
Regulated-records preservation for **health & legal** over the Verifiable Archive — RFC-3161 trusted
timestamping, a tamper-evident read-access audit log, and legal / e-discovery holds, each an
offline-verifiable signed chain. (Not [Recovery Vault](/recovery-vault) — that protects keys; this
preserves records.) Commercial on-prem bundle.
The decision point for agentic payments: before a payment runs, verify the agent's Passport,
enforce the payer's Mandate cap, and apply your policy — returning a signed ALLOW/DENY decision in
one call. Moves no funds. Every decision binds into a Substrate 2 receipt.
Turn a screening decision into a signed, no-PII compliance receipt — screen a payer with your own
sanctions/PEP provider, get a categorical ALLOW/REFER/DENY verdict, signed and offline-verifiable.
It produces the verdict that Proofs proves privately; bind it into a Substrate 2 receipt.
Append any business event to a tamper-evident, post-quantum chain — content-addressed and signed
into an append-only log anyone verifies offline. Nothing can be altered, inserted, removed,
reordered, or back-dated. Fold entries into the Substrate 2 evidence chain.
Hash-link your payment receipts into a tamper-evident, self-verifiable audit chain that any party
verifies from local data alone, with no infrastructure or registry lookup. Satisfies MiCA Art. 80,
DORA Art. 14, and AMLR Art. 56. A standard part of Substrate 2.
Threshold (Shamir k-of-n) key recovery for **any** Substrate 2 key — data-loss protection for
archive encryption keys, identity continuity for signing keys. No vendor escrow; default
self-custody; optional support-assisted recovery where AlgoVoi holds one inert share. Free for every
Substrate 2 customer.
FATF Travel Rule (Recommendation 16) as signed, **no-PII** evidence — exchange the IVMS101 payload
**post-quantum** (ML-KEM-1024) between VASPs, keep a Falcon-1024-signed receipt that proves the
obligation was met with no customer PII in it. Free for every Substrate 2 customer.
Migrate a signing and encryption estate classical → post-quantum with **provable continuity** --
classify keys, hybrid-sign the transition, re-attest legacy signatures forward under Falcon-1024, and
re-wrap to ML-KEM-1024, so past evidence stays trustable. Free for every Substrate 2 customer.
Continuous sanctions monitoring as signed, **no-PII** delta evidence — keep a watchlist, re-screen on
every sweep, and emit a Falcon-1024-signed receipt the moment a verdict changes. Watchlist
**post-quantum encrypted at rest** (ML-KEM-1024). Free for every Substrate 2 customer.
## Application matrix
How the suite fits together: Substrate 2 is the evidence core, and each application is an **add-on**
that binds to it — a verified action becomes a signed, post-quantum, audit-ready receipt. The add-ons
are licensed separately from Substrate 2.
```mermaid theme={null}
flowchart TB
subgraph CORE["Substrate 2 — commercial evidence core"]
PQC["Post-quantum receipts"]
ZK["Zero-knowledge reputation"]
FED["Cross-issuer federation"]
AUD["Receipts + audit chain"]
end
subgraph APPS["Commercial add-ons — licensed separately, bind to Substrate 2"]
SV["Settlement Verification\nmulti-chain settlement + finality"]
AP["Agent Passport\npost-quantum agent trust credentials"]
PF["Proofs\nprivacy-preserving compliance proofs"]
PM["Payment Mandate\nrecurring + agentic authorization"]
VA["Verifiable Archive\ntamper-evident document archiving"]
GR["Spend Guardrail\nagentic-payment decision gate"]
CG["Compliance Gate\nscreening -> signed no-PII verdict"]
AL["Verifiable Audit Log\ntamper-evident event chain"]
end
SV -->|verified settlement, bound into a signed receipt| AUD
AP -->|agent trust, bound into a signed receipt| AUD
AP -.->|zero-knowledge reputation| ZK
PF -->|compliance proof, folded into the evidence chain| AUD
PF -.->|zero-knowledge range proof| ZK
PM -->|mandate + each authorized charge, bound into a signed receipt| AUD
PM -.->|pairs with agent trust| AP
VA -->|archive entries + audit reports, bound into the evidence chain| AUD
GR -->|every ALLOW/DENY decision, bound into a signed receipt| AUD
GR -.->|composes agent trust| AP
GR -.->|composes payment authorization| PM
CG -->|signed compliance verdict, bound into a receipt| AUD
CG -.->|the verdict Proofs proves| PF
AL -->|every event, linked into a tamper-evident chain| AUD
```
| Application | Type | What it delivers | Binds to Substrate 2 via | Available as |
| ------------------------------------------------- | ------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | -------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------- |
| **Substrate 2** | **Core** | Post-quantum receipts, zero-knowledge reputation, cross-issuer federation, audit chain | — (the evidence foundation) | Self-serve on-prem bundle · Enterprise · On-premise |
| **[Settlement Verification](/settlement-verify)** | **Add-on** | Multi-chain stablecoin settlement + per-chain finality across 8 networks | A verified settlement becomes a signed, audit-ready Substrate 2 receipt | OEM SDK · Enterprise · On-premise |
| **[Agent Passport](/agent-passport)** | **Add-on** | Post-quantum, revocable trust credentials for AI agents — scopes + spend authority, verified offline | A verified passport becomes a signed, audit-ready Substrate 2 receipt; reputation via zero-knowledge | OEM SDK · Enterprise · On-premise |
| **[Proofs](/proofs)** | **Add-on** | Privacy-preserving compliance proofs — prove screening + a score threshold with no PII or score disclosed | Each proof folds into the Substrate 2 evidence chain; built on zero-knowledge range proofs | OEM SDK · Enterprise · On-premise |
| **[Payment Mandate](/payment-mandate)** | **Add-on** | Verifiable, revocable authorization for recurring & agentic payments — per-period spend caps enforced on every charge | The mandate and each authorized charge bind into a signed, audit-ready Substrate 2 receipt | OEM SDK · Enterprise · On-premise |
| **[Verifiable Archive](/verifiable-archive)** | **Add-on** | Tamper-evident, post-quantum document archiving (local or S3), with signed audit reports + retention/attestation | Archive entries and audit reports bind into the Substrate 2 evidence chain | OEM SDK · Enterprise · On-premise |
| **[Records Vault](/records-vault)** | **Add-on (bundle)** | Regulated-records preservation for health & legal over the Verifiable Archive — RFC-3161 trusted timestamping, a tamper-evident read-access audit log, and legal / e-discovery holds; bundles Archive + S3 + Auditor. *(Preserves records — distinct from Recovery Vault, which protects keys.)* | Timestamps, access log, and holds are offline-verifiable signed chains that bind into the Substrate 2 evidence chain | Enterprise · On-premise |
| **[Spend Guardrail](/spend-guardrail)** | **Add-on** | The agentic-payment decision point — verify Passport + enforce Mandate cap + apply policy → a signed ALLOW/DENY decision; moves no funds | Every signed decision binds into a Substrate 2 receipt; composes Agent Passport + Payment Mandate | OEM SDK · Enterprise · On-premise |
| **[Compliance Gate](/compliance-gate-v2)** | **Add-on** | Screening → a signed, no-PII categorical ALLOW/REFER/DENY compliance receipt (bring your own sanctions/PEP provider) | The signed verdict binds into a Substrate 2 receipt; produces the receipt that Proofs proves privately | OEM SDK · Enterprise · On-premise |
| **[Verifiable Audit Log](/audit-log)** | **Add-on** | Tamper-evident, post-quantum append-only log of arbitrary business events — content-addressed, signed, offline-verifiable | Every event links into a tamper-evident chain that folds into the Substrate 2 evidence chain | OEM SDK · Enterprise · On-premise |
| **[Recovery Vault](/recovery-vault)** | **Add-on** | Threshold (Shamir k-of-n) post-quantum key recovery for **any** Substrate 2 key — data-loss protection for encryption keys, identity continuity for signing keys; default self-custody, optional support-assisted recovery with one inert share | Protects the keys behind your Substrate 2 evidence; no key ever leaves your control | **Free** for every Substrate 2 customer |
| **[Travel Rule](/travel-rule)** | **Add-on** | FATF Recommendation 16 as signed, no-PII evidence — post-quantum (ML-KEM-1024) IVMS101 exchange between VASPs + Falcon-1024-signed Travel Rule receipts that prove the obligation was met without carrying customer PII | Each Travel Rule receipt folds into the Substrate 2 evidence chain; no PII in the attestation | **Free** for every Substrate 2 customer |
| **[Crypto-Agility](/crypto-agility)** | **Add-on** | Classical → post-quantum migration with provable continuity — classify the key estate, hybrid-sign the transition, re-attest legacy signatures forward under Falcon-1024, re-wrap encrypted data to ML-KEM-1024; every migration is a signed, offline-verifiable attestation | Carries existing Substrate 2 evidence across the PQC boundary without invalidating it | **Free** for every Substrate 2 customer |
| **[Sanctions Monitor](/sanctions-monitor)** | **Add-on** | Continuous sanctions monitoring — watchlist re-screened every sweep, a Falcon-1024-signed no-PII delta receipt on every verdict change (newly\_hit / cleared / escalated); bring your own screener; watchlist post-quantum encrypted at rest (ML-KEM-1024); ships as a deployable appliance | Ongoing-monitoring evidence that folds into the Substrate 2 chain; no PII in the receipt | **Free** for every Substrate 2 customer |
The suite grows around this core — each new commercial application is verified by, and binds its
evidence into, Substrate 2.
## Get Substrate 2
Substrate 2 is available two ways:
* **Self-serve on-premise bundle.** Buy the complete Substrate 2 on-premise bundle directly and pay
in USDC — the post-quantum trust core plus the zero-knowledge and cross-issuer federation layers,
delivered as a single encrypted, offline-verifiable package you install and run in your own
environment. Your licence is also the key that decrypts it; verification is fully offline.
* **Enterprise & On-premise plans.** For volume, custom terms, warranty and indemnification, and an
SLA, Substrate 2 ships as part of the AlgoVoi Enterprise and [On-premise](/on-premise) plans.
It is not distributed on public package registries.
### What you install and run
The bundle installs four small, self-hosted post-quantum services you run on your own
infrastructure:
```bash theme={null}
algovoi-substrate2-controlplane # control plane, port 8094
algovoi-federation-validator # port 8092
algovoi-zkp-receipt # port 8093
algovoi-atb-credential-verifier # port 8095
```
Each boots clean with no configuration. Point a service at the control plane with
`S2_HUB_URL` and `S2_HUB_TOKEN` and it self-registers and pulls its issuer trust set, so
you manage trust in one place rather than service by service. SQLite out of the box,
PostgreSQL when you scale; air-gap capable throughout.
Purchase the Substrate 2 on-premise bundle self-serve and pay in USDC — available **perpetual
(one-time) or annual subscription**. Delivered as one encrypted, offline-verifiable package — see
the store for current pricing and terms.
For Enterprise / On-premise terms, support, and SLA, get in touch to discuss how Substrate 2 fits
alongside your existing AlgoVoi integration.