Qstamp / Sovereign networks
Sovereign Quantova networks

A private post quantum ledger that never leaves the secure environment.

Classified and operationally sensitive records can never be anchored on a public network, because even a salted commitment reveals the timing and volume of activity. A sovereign Quantova network runs the same post quantum ledger entirely inside a national or coalition secure environment, with its own genesis and validators and no connection to the public network. It is being built for release as open source under the same licences as the rest of the Quantova stack.

Design

What a sovereign network is.

Own genesis

Each network starts from its own genesis block, created in a witnessed ceremony, and shares no state or history with the public network.

Own validators

Validators are run by the operating authority inside its accredited environment and sign finality with ML DSA.

No external connection

Nodes connect only to each other through ML KEM and ML DSA handshakes, and the network has no route to the internet.

Offline installation

Nodes are installed from a signed offline kit, verified against published fingerprints before use.

Controlled export

Where policy allows, an approved commitment can be passed outward through an accredited cross domain solution, and never inward.

Same verification

Records anchored on a sovereign network are verified by the same open procedure, by verifiers inside the environment.

Live flow

Inside the secure environment, in motion.

Live flowSovereign network, from a classified system to an authorised verifier
  1. Your systemsClassified systemA record is created and signed inside the secure environment
  2. Your systemsQDefence SDKThe record is fingerprinted and batched under its record kind
  3. Quantova networkSovereign networkThe commitment is anchored by validators inside the environment
  4. Quantova networkFinalityThe block is finalised by the authority's own validator committee
  5. PublicAuthorised verifierA cleared auditor verifies the record against the sovereign anchor
  6. PublicApproved exportOnly where policy allows, a commitment passes outward through a cross domain solution
Inside your systemsQuantova networkPublic and verifiable
Release path

How a sovereign network is delivered.

  1. 01Node package

    A reproducible package of the Quantova node with its configuration for a private network.

  2. 02Genesis ceremony

    A witnessed procedure that creates the genesis and the validator keys of the network.

  3. 03Offline kit

    A signed installation kit that can be verified and installed without any network.

  4. 04Export gateway

    A one way export of approved commitments for use with a cross domain solution.

  5. 05Pilot

    A first network on an isolated environment, verified end to end.

  6. 06Review and release

    Security review and open source release of the kit.

Périmètre

What a sovereign network does not change.

A sovereign network is a separate deployment of the Quantova software for one operator. It does not change the rules of the public Quantova network, and accreditation of each deployment remains with the authority that operates it.