> ## Documentation Index > Fetch the complete documentation index at: https://docs.algovoi.co.uk/llms.txt > Use this file to discover all available pages before exploring further. # Self Host Regulated Records Preservation > Run a self hosted, air gap capable evidence estate for HIPAA, GDPR and eIDAS records: RFC 3161 timestamping, a tamper evident audit log, and legal holds. Self-hosting regulated records means running the preservation and evidence estate on your own infrastructure: RFC-3161 timestamping, a tamper-evident audit log, legal and e-discovery holds, and offline verification, all under your own keys with no cloud dependency. This guide covers what a compliant self-hosted estate for HIPAA, GDPR, and eIDAS records requires, and how the AlgoVoi [Verifiable Compliance Suite](/verifiable-compliance-suite) provides it. *Last updated: 3 August 2026.* This guide covers the compliance and long-term-data estate. If you need the agentic payment rails (x402, MPP, AP2, A2A), those ship separately as the [Payment Rails bundle](/payment-rails-sqlite). ## The preservation problem cloud storage does not solve A regulated record stored in a cloud bucket is encrypted and durable. It is not evidence. Evidence means three things beyond write-durability: 1. **Proof of when** a record existed, independent of your own server clock. 2. **Proof of who read it**, logged tamper-evidently so the log itself cannot be quietly altered. 3. **Proof it was or was not held** for a matter, so disposal sweeps cannot touch records that are frozen for litigation. Cloud storage gives you (1) only if you add an RFC-3161 time-stamping authority call yourself, (2) only if you build a signed read-event log yourself, and (3) only if you build litigation-hold enforcement yourself. Then your auditor or opposing counsel needs to trust your implementation to verify any of it. A self-hosted evidence estate builds all three as tamper-evident, independently verifiable signed chains from the start, so the verification is a mathematical check against a published public key, not a review of your processes. ## What a self-hosted evidence estate requires The minimum set for regulated-records preservation: | Capability | Why it matters | | ---------------------------------- | -------------------------------------------------------------------------------------------------------- | | Write-once, tamper-evident archive | Establishes baseline integrity: HIPAA §164.312(c)(1), GDPR Art 5(1)(f) | | RFC-3161 trusted timestamps | Proves existence by a date from an independent authority, not your own clock: eIDAS qualified timestamps | | Tamper-evident read-access log | Every read is sealed as evidence, detectable if altered: HIPAA §164.312(b) audit controls | | Legal and e-discovery holds | Frozen records cannot be disposed of even after their retention window expires: litigation-hold duty | | Offline-verifiable evidence | Auditors and opposing counsel verify independently, with no running service and no vendor account | | Post-quantum signatures | Evidence stays verifiable decades from now, after cryptographic standards evolve | The AlgoVoi [Verifiable Compliance Suite](/verifiable-compliance-suite) ships all six as a single on-prem bundle. Each capability is a separate Falcon-1024-signed, hash-linked chain stored beside the encrypted archive, verifiable offline from one published public key. ## Install the self-hosted evidence estate The full estate is a single encrypted deliverable. Your Falcon-1024-signed licence is both the decryption key and the runtime licence. ### Prerequisites ```bash theme={null} python -m pip install cryptography pqcrypto rfc8785 fastapi uvicorn httpx ``` That is the full external dependency set for extraction and verification. ### Extract and install ```bash theme={null} # Save your licence key, then extract (offline, no network needed) python algovoi_unbundle.py --license @licence.key --out ./algovoi --install bundle.algv ``` The extractor verifies your licence against AlgoVoi's issuer public key, then decrypts and writes each component wheel with a SHA-256 integrity check. Nothing installs unless the licence is valid and every integrity check passes. No PyPI call, no phone-home. ### Start the estate ```bash theme={null} export ALGOVOI_LICENSE_KEY="$(cat licence.key)" # Control plane and policy bridge algovoi-substrate2-controlplane # Compliance Command Center (re-verifies all evidence chains, one posture dashboard) uvicorn algovoi_command_center.app:create_app --factory --port 8200 # Records Vault API (timestamping, read-access log, holds) uvicorn algovoi_records_vault.app:app --port 8300 # Compliance Gate (ALLOW / REFER / DENY policy decisions) uvicorn algovoi_compliance_gate.app:app --port 8400 ``` All services licence-check on startup and fail closed if the key is absent, invalid, or expired. ### Air-gap deployment The bundle installs with no external network access. For fully air-gapped environments: * Copy `bundle.algv`, `algovoi_unbundle.py`, and your `licence.key` to the target machine. * Run the extractor. The only outbound call the extractor makes is a licence-validity check against AlgoVoi's issuer key, which is bundled inside the extractor itself (no network needed for the check). * All wheels install from the local extracted directory, not from PyPI. ## Archive a record with RFC-3161 timestamping ```python theme={null} from algovoi_records_vault import RecordsVault vault = RecordsVault.from_env() # reads ALGOVOI_LICENSE_KEY # Archive and timestamp in one call receipt = vault.archive( content=document_bytes, metadata={"subject": "patient-001", "type": "consent"}, timestamp=True, # request an RFC-3161 token from the configured TSA ) print(receipt.archive_hash) # SHA-256 of the content print(receipt.tsa_token_present) # True if RFC-3161 token was obtained print(receipt.chain_head) # current chain head for your records ``` In air-gap mode, `timestamp=True` with no network degrades to a signed air-gap record that logs the imprint and the local clock in a signed chain entry. The TSA is optional in the same way the S3 backend is optional. ## Place a legal hold ```python theme={null} # Freeze all records for a matter, overriding the retention schedule hold = vault.place_hold( matter_id="litigation-2026-001", subject="patient-001", reason="pending_litigation", ) # Records matching the hold can no longer be disposed of # vault.dispose(record_id=...) raises HeldRecordError until the hold is released ``` The hold is a signed entry in the `holds/` chain. `is_held()` re-verifies the hold chain before every disposal check. A corrupted or missing chain entry counts as held, not released, so tampering cannot silently unlock a disposal. ## Verify the evidence pack offline Every Records Vault deployment can emit a self-contained evidence pack: the signed chains, the public key, and a standalone verifier. An auditor or opposing counsel runs this with no AlgoVoi software and no network: ```bash theme={null} # On any machine with Python and two public libraries pip install pqcrypto rfc8785 python verify_evidence_pack.py ``` A clean pack prints: ```text theme={null} [PASS] archive_chain.json archive_entry 1 entries [PASS] tsa_chain.json vault_tsa_token 1 entries [PASS] access_chain.json vault_access_event 2 entries [PASS] holds_chain.json vault_legal_hold 1 entries [PASS] timestamp binding every tsa.messageImprint == SHA-256(JCS) of its archive receipt RESULT: ALL EVIDENCE VERIFIED OFFLINE (public key only) ``` Tamper with any entry and the chain breaks at exactly that entry. The verifier code is \~120 lines; your auditor can read and audit it in an afternoon. ## Portable evidence export The [.epi Evidence Export](/epi-evidence-export) add-on packages a Records Vault evidence set as a portable, post-quantum-sealed artifact your auditor carries away and verifies on their own machine, with no AlgoVoi software, service, or account on their side. ## Regulatory coverage | Framework | Provision | Evidence the suite provides | | ------------------- | ----------------------------------------- | ---------------------------------------------------------------------------------------------------------------- | | HIPAA | §164.312(b) audit controls | Signed tamper-evident read-access log: principal, record, granted or denied, reason; exportable for SIEM and GRC | | HIPAA | §164.312(c)(1) integrity | Write-once content-addressed archive; Falcon-1024-signed chain breaks on any alteration | | GDPR | Art 17 right to erasure | Signed erasure tombstones: field content is crypto-shredded; a signed proof the record existed survives | | GDPR | Art 5(1)(f) integrity and confidentiality | ML-KEM-1024-sealed records at rest; offline-verifiable integrity chain | | eIDAS | Qualified timestamps | RFC-3161 tokens from an independent TSA; air-gap fall-back signs the imprint in a local chain | | 21 CFR Part 11 | §11.10(a) validation documentation | IQ/OQ/PQ self-validation pack generated by the [Compliance Command Center](/compliance-command-center) | | Long-term retention | Decades-scale evidence | Falcon-1024 and ML-DSA-65 signatures keep evidence verifiable after the post-quantum migration | Your counsel certifies compliance. The suite provides the tamper-evident, independently verifiable evidence that certification rests on. ## Bring your own keys Hold the Falcon-1024 signing and ML-KEM-1024 encryption keys in your own [HSM, KMS, or HashiCorp Vault](/bring-your-own-keys). AlgoVoi never sees a private key. The signed output is unchanged, so the evidence pack and the offline verifier work identically regardless of where the key is held. ## Get the self-hosted compliance evidence estate The Verifiable Compliance Suite is a one-time purchase on a perpetual licence, self-serve from the store. One-time perpetual licence, self-serve, paid in USDC. Pay, download, key. One key installs the full compliance and long-term-data estate: Compliance Command Center, Records Vault, Recovery Vault, Verifiable Archive, Compliance Gate, Retention, Sanctions Monitor, Travel Rule, and Verifiable Audit Log. Air-gap capable, no PyPI. Enterprise or OEM: [email us](mailto:hello@algovoi.co.uk).