Privi Quantum Ledger

What a customer's due-diligence or a regulator would flag today: prohibited practices, incomplete Article 5 screens, obligations already in force without evidence (critical), obligations due within 180 days (medium), upcoming high-risk duties, and high-risk systems with no recent log. Requires the organization API key.

Export your AI Act register as JSON to hand to customers, auditors or regulators, with its SHA-256 sealed on chain so anyone can prove it was not edited afterwards (check with ai_act_verify_export). Requires the organization API key.

Your EU AI Act register: each AI system's current record, tier and applicable obligations. Requires the organization API key.

Add or update an AI system in your company's EU AI Act register. Privi screens it against the Article 5 bans, classifies it (prohibited / high-risk / transparency / general-purpose / minimal), and lists the obligations that apply to your role with their dates. Every change is versioned and written to your tamper-evident 'ai-act' log. Requires the organization API key.

Check that an AI Act register a supplier or partner sent you is exactly what they exported from Privi, and return its on-chain seal. Free; no key needed.

Withdraw an approval request (or revoke an approval not yet used). Your key cannot approve, only cancel. Requires the organization API key.

Your organization's approval requests, newest first. Requires the organization API key.

Make mandate_spend pause for a human on large payments: any payment over the threshold creates an approval request that the mandate's principal must sign with their wallet before the agent can spend. Requires the organization API key.

Ask a human to approve (or deny) an action. Returns approve_url for them: they read the request and sign with their wallet (free, no transaction). Your agent then calls approval_wait, or watches your live channel for approval.approved. Only the named wallet can decide; your API key can only cancel. Requires the organization API key.

Status of an approval request: pending, approved, denied, expired or cancelled, with the human's wallet signature once they decide. Free.

Block until the human decides (or timeout_s passes). Returns the current status; if still pending, call again. Free.

Privi's public signing keys: Ed25519 and ML-DSA-87 (NIST FIPS 204, CNSA 2.0 post-quantum). Pin these to verify Privi signatures offline. Free.

Consume a two-person authorization right before performing the action. Single use; refused unless authorized. Requires the organization API key.

Your organization's two-person requests. Requires the organization API key.

Define a Two-Person Integrity policy: which officers can approve, and how many distinct approvals an action needs. Requires the organization API key.

Ask officers to authorize a sensitive action under a two-person policy. Returns approve_url for the officers; each signs with their wallet. Do not act until fortress_tpi_status shows 'authorized', then call fortress_tpi_execute. Requires the organization API key.

Status of a two-person request (pending, authorized, vetoed, expired, executed) and who approved. Free.

Put your MCP server behind Privi. You get an HTTP URL and a WebSocket URL that forward to it unchanged (x402 payments keep working) while Privi rate-limits callers, optionally requires a Privi Passport, meters every tool call and writes each call to your tamper-evident log. The kill switch stops the gateway instantly. Upstream must be public HTTPS. Requires the organization API key.

Turn a gateway off. Its URLs stop working at once; history stays in your log. Requires the organization API key.

Public description of a gateway: where it forwards, whether callers need a Passport, its rate limit and its call counts. Free.

Your organization's gateways. Requires the organization API key.

Turn Privi Guard on for every tool result that passes through your gateway: tag adds the verdict and a receipt id in result._meta['privi/guard']; block also replaces injected results with an error before your agents see them. Each result is one Guard check (free allowance, then credits). Requires the organization API key.

Calls, errors, denials and x402 payment prompts per tool and per day for one of your gateways, plus your monthly quota. Requires the organization API key.

Your agency's AI use case inventory: the current version of each record. Requires the organization API key.

Flags what an OMB M-25-21 review would flag before you submit: missing required fields, PII without a Privacy Impact Assessment, and high-impact AI in pilot or deployment missing any minimum risk practice (testing, impact assessment, independent review, monitoring, operator training, fail-safe, appeals, public feedback) or without a recently active activity log as monitoring evidence. Requires the organization API key.

Machine-readable CSV of your publicly releasable AI use cases (for publishing at agency.gov/ai), with its SHA-256 sealed on chain (Base, until the Privi chain mainnet) so the published file can be proven unaltered. Requires the organization API key.

Add or update an entry in your agency's AI use case inventory (OMB M-25-21). Every change creates a new version and is written to your tamper-evident 'ai-inventory' log. Requires the organization API key.

Check that a published AI inventory file is exactly what the agency exported from Privi Ledger, and return its on-chain seal. Free; no key needed.

Classify cryptographic algorithms as quantum-vulnerable (RSA, ECDH, ECDSA, EdDSA, DH, DSA, MQV), post-quantum (ML-KEM, ML-DSA, SLH-DSA), hybrid, symmetric/hash, or unknown. Free.

Export the full cryptographic inventory (CBOM) and migration plan as one JSON document for OMB, the CIO or auditors, with its SHA-256 sealed on chain (Base, until the Privi chain mainnet). Requires the organization API key.

Current cryptographic inventory of your systems. Requires the organization API key.

Prioritized post-quantum migration plan: every quantum-vulnerable asset ranked (High Value Assets, high-impact systems and long-lived sensitive data first; key establishment before signatures), with its deadline (key establishment Dec 31 2030, signatures Dec 31 2031), recommended NIST replacement, progress metrics, and findings (missed deadlines, TLS below 1.3, no target dates, unrecognized algorithms). Requires the organization API key.

Record the cryptographic inventory (CBOM) of one system for post-quantum migration. Every change creates a new version and is written to the agency's tamper-evident 'pqc-inventory' log. Scanners and agents can submit results directly. Requires the organization API key.

Check that a CBOM and migration-plan document is exactly what was exported from Privi Ledger and return its on-chain seal. Free; no key needed.

Your free checks left this month and your prepaid credits. Needs the organization key.

Buy prepaid Privi Guard checks in USDC on Base via x402. Credits never expire and are used after the free monthly allowance. Needs the organization key.

Check content for prompt injection (inbound) or leaked secrets and personal data (outbound) before an agent acts on it or sends it. Returns allow / warn / block, the findings, a redacted copy for outbound secrets, and an Ed25519-signed receipt anchored on-chain, which proves the check happened. Privi does not store the text. Free for 1,000 checks a month with an organization key; otherwise 1 cent per check in USDC via x402.

Check up to 50 texts in one call (for example every tool result in a step). Each item is billed as its own check against your free allowance or credits and gets its own receipt. Needs an organization key.

What Privi Guard checks, what it costs, and how receipts work. Free.

Verify a Privi Guard receipt: the signed body, signature validity and its Merkle proof into the anchored transparency log. Free; anyone holding the id can verify it.

Step 2: bind the wallet to your organization's Privi Passport so its transactions pass KYA checks. With a wallet signature the binding is *proven*; without one it is only *declared* (most checkers require proven). Requires the organization API key.

Step 1 of binding a wallet to your Privi Passport: get a message to sign with that wallet (EIP-191 personal_sign). Valid 30 minutes. Requires the organization API key.

Know-Your-Agent for blockchains: is this wallet operated by an audited AI agent, and how trustworthy is it right now? Resolves the address to its organization and live Privi Passport and returns allow/deny with reasons, plus a Privi-signed attestation (valid 60 min) you can cache. For chains, DeFi protocols, exchanges, stablecoin issuers and x402 facilitators. Free; send your organization key to log the check as evidence.

Remove a wallet from your Passport (rotated or compromised key). KYA checks deny it immediately. Requires the organization API key.

Wallets bound to your organization and how each was proven. Requires the organization API key.

Check whether an agent's action log is intact: entry count, time span, action and failure counts, head hash, and where tampering broke the chain if it did. Does not reveal the actions themselves. Paid per call via x402.

Confirm that an action receipt exists in the ledger and when it was recorded. Reveals no action contents. Free.

Audit-ready report of your AI agents' activity for a period (SOC 2 evidence, security questionnaires, AI-regulation record keeping): actions by type, failures, human approvals, log integrity, on-chain status, and findings. The report's hash is anchored on the Privi blockchain so it cannot be edited later without detection. Requires the organization API key.

Proof that Privi's log only grew between two signed tree heads: nothing recorded earlier was edited, removed or reordered (RFC 9162). Free.

Export a self-contained evidence package for auditors, courts or air-gapped systems: every entry, the hash chain, an RFC 9162 inclusion proof, the signed tree head, on-chain checkpoint and Privi's keys, signed with Ed25519 and ML-DSA-87. Verify offline with verify_bundle.py (GET /tools/verify_bundle.py). Requires the organization API key.