Qstampby Quantova

EN

GitHub Start building →

Qstamp / Government

QGov

Public money, public decisions and public votes, provable without exposing anyone’s data.

QGov is the government branch of the Qstamp family. Each tool seals a different class of public record at the moment it is created, so auditors, courts and parliaments can verify later that nothing was altered, backdated, inserted or removed. Records and personal data stay inside government systems. Only salted fingerprints reach the Quantova network, signed with post quantum signatures standardised by NIST.

Live flows

How each QGov tool runs inside government.

Each step lights in turn as a record moves through it. Steps inside your systems never send content out. Only the anchor reaches the Quantova network, and only chain facts are public on QVMScan.

Live flowQGov, from a government system to the explorer

Your systemsGovernment systemTax, finance, procurement, ethics, aid or election system of record
Your systemsQGov toolRecord signed with ML DSA and linked to the record it relies on
Your systemsSeparate role keysIntake, decision and payment held by different officials
Your systemsBatchSalted SHA3 fingerprints collected into one RFC 9162 tree
Quantova networkAnchorOne commitment per batch under the record kind of each tool, 1101 to 1106
PublicQVMScanFinal in about 0.2 seconds and indexed by tool, with no record content
PublicAuditors, parliaments and courtsVerify any record independently

Inside your systemsQuantova networkPublic and verifiable

Live flowQTax, from tax intake to the explorer

Your systemsTax intake systemA return arrives and is fingerprinted on receipt
Your systemsFilingSigned with ML DSA under the intake key and linked to any amended filing
Your systemsAssessmentSealed by a separate assessor key against the filing
Your systemsRefund chainPaid by an officer key with its position and running total
Quantova networkAnchorOne salted 32 byte commitment per batch, sent under record kind 1101 in a transaction signed with ML DSA 65
PublicQVMScanFinal in about 0.2 seconds and indexed on the explorer under QTax, with no record content
PublicAuditor or courtVerifies the whole chain without the systems of the authority

Inside your systemsQuantova networkPublic and verifiable

Live flowQSpend, from the budget to the explorer

Your systemsFinancial management systemAppropriation and allotment sealed when approved
Your systemsCommitmentSealed by the authorising officer against the allotment
Your systemsReceipt and invoiceDelivery confirmed by a separate officer and the invoice fingerprinted
Your systemsTreasury paymentSealed with its position and cumulative total
Quantova networkAnchorOne salted 32 byte commitment per batch, sent under record kind 1102 in a transaction signed with ML DSA 65
PublicQVMScanFinal in about 0.2 seconds and indexed on the explorer under QSpend, with no record content
PublicSupreme audit institutionFollows any payment back to its budget line

Inside your systemsQuantova networkPublic and verifiable

Live flowQProcure, from tender notice to the explorer

Your systemsProcurement platformNotice, criteria and weights sealed before publication
Your systemsBidder systemSalted bid commitment sealed before the deadline
Your systemsOpening and evaluationBids checked against commitments and each score signed
Your systemsAward and amendmentsAward and every variation sealed in sequence
Quantova networkAnchorOne salted 32 byte commitment per batch, sent under record kind 1103 in a transaction signed with ML DSA 65
PublicQVMScanFinal in about 0.2 seconds and indexed on the explorer under QProcure, with no record content
PublicReview body or bidderProves no bid was added or replaced after the deadline

Inside your systemsQuantova networkPublic and verifiable

Live flowQDeclare, from filing to the explorer

Your systemsDeclaration systemThe official files a declaration of assets and interests
Your systemsDeclarant signatureSigned under the official's own key
Your systemsAcknowledgementThe ethics body seals the filing date
Your systemsSeries linkLinked to the previous declaration, with corrections as new versions
Quantova networkAnchorOne salted 32 byte commitment per batch, sent under record kind 1104 in a transaction signed with ML DSA 65
PublicQVMScanFinal in about 0.2 seconds and indexed on the explorer under QDeclare, with no record content
PublicInvestigator or courtVerifies the full declaration history

Inside your systemsQuantova networkPublic and verifiable

Live flowQAid, from programme rules to the explorer

Your systemsBenefit or grant systemProgramme rules sealed before applications open
Your systemsApplicationFingerprinted on receipt, the applicant named by a salted commitment
Your systemsDecision and approvalAssessed and approved under separate keys
Your systemsDisbursementEach payment sealed with its cumulative total
Quantova networkAnchorOne salted 32 byte commitment per batch, sent under record kind 1105 in a transaction signed with ML DSA 65
PublicQVMScanFinal in about 0.2 seconds and indexed on the explorer under QAid, with no record content
PublicAuditor or donorTraces every payment to its decision and rules

Inside your systemsQuantova networkPublic and verifiable

Live flowQBallot, from polling station to the explorer

Your systemsElection management systemSoftware builds and the mandates of officials registered
Your systemsPolling stationReturn signed by the presiding officer and witnesses
Your systemsCount centreBallot records fingerprinted with fresh salts, no voter identified
Your systemsTabulationEvery action sealed in a hash chained log
Quantova networkAnchorOne salted 32 byte commitment per batch, sent under record kind 1106 in a transaction signed with ML DSA 65
PublicQVMScanFinal in about 0.2 seconds and indexed on the explorer under QBallot, with no record content
PublicObservers and courtsProve the declared result equals the certified returns

Inside your systemsQuantova networkPublic and verifiable

The problem

Fraud and corruption depend on records that can be changed later.

A backdated contract amendment, an invoice that never existed, a bid replaced after the deadline, a declaration edited once an inquiry begins. Each relies on a record that its custodian can quietly rewrite. Where public records are signed at all, they are signed with classical algorithms that a quantum computer will be able to forge within the years those records must be kept.

The QGov tools

Six tools, one evidence foundation.

Quantova describes QGov as the first family of post quantum integrity tools built for the core records of government. Each tool seals its records as they are created and detects the manipulation that fraud and corruption depend on.

Tax integrity

QTax

Seals tax filings, assessments, refund decisions and electronic invoices at the moment they are issued, and links each refund to the assessment that justified it.

Detects

A filing or assessment amended or backdated after submission
An invoice claimed by a buyer that the seller never issued
A refund paid without a sealed assessment behind it

QTax in detail →

Public spending

QSpend

Seals every step of public money, from the budget appropriation to the commitment, the invoice and the payment, and links each payment to the budget line that authorised it.

Detects

A payment with no authorised budget line
A payment split or duplicated to avoid approval limits
An approved budget changed after the fact

QSpend in detail →

Procurement integrity

QProcure

Seals each bid as a commitment before the tender deadline and opens it only after, records each evaluator's signed scores and the signed award, and seals every later contract amendment.

Detects

A bid submitted late, replaced or opened early
Evaluation scores altered after signature
A contract amended after award without a sealed decision

QProcure in detail →

Asset and interest declarations

QDeclare

Seals the asset and interest declarations of public officials when they are filed, so the full history of each official's declarations can be verified year by year.

Detects

A declaration edited or backdated after filing
An undeclared change between two years
A declaration replaced during an investigation

QDeclare in detail →

Grants, subsidies and aid

QAid

Seals each eligibility decision and each disbursement and links it to the approved programme and the beneficiary record, without publishing any personal data.

Detects

A payment to a beneficiary who was never approved
The same entitlement paid twice
A disbursement outside the rules of its programme

QAid in detail →

Election integrity

QBallot

Seals station returns, ballot records and every tabulation action, so a declared result can be proven to equal the certified returns without revealing any vote.

Detects

A station return altered after certification
A result submitted by an unregistered official
A count changed after the declaration

QBallot in detail →

Threat model

The manipulations QGov is designed to defeat.

QGov treats every public record as evidence that a capable adversary may try to change. The framework assumes the adversary can be inside the institution, can collude across institutions and may in future hold a cryptographically relevant quantum computer.

T1

Insider alteration

An official or administrator with full access edits, backdates or replaces a record in the system that holds it.

T2

Scrubbing

A record, a log entry or a whole period of activity is deleted to remove the trace of a decision or a payment.

T3

Collusion

An official and a supplier, contractor or beneficiary agree a false record between them and present it as genuine.

T4

Forged authority

A decision, approval or payment is presented as authorised by an official or system that never authorised it.

T5

Quantum forgery

A record signed with RSA or elliptic curve keys is forged in future by an adversary holding a large quantum computer.

T6

Evidence disputes

A party in an investigation or a trial challenges the integrity of the records that the institution itself kept.

Control objectives

Eight controls, each enforced by cryptography.

C1 · Integrity at creation

Each public record is fingerprinted with SHA3 256 and a fresh 256 bit salt at the moment it is created, and the fingerprint is anchored on the Quantova network. Any later change to the record no longer matches its anchored fingerprint. Counters T1 and T6.

C2 · Non repudiation

Each decision, approval and certification is signed by the official or system that made it with ML DSA 65 under FIPS 204. The signer cannot later deny it and no one else can produce it. Counters T4.

C3 · Authority and separation of duties

QMandate binds every official and every system to the actions, amounts, counterparties and periods they are authorised for, signed by the authority above them. An action outside that mandate is refused before it is taken and detected if it is attempted. Counters T4.

C4 · Joint attestation

Each transaction that crosses an institutional boundary is sealed independently by every party to it, so no single party can forge or erase the shared record. Counters T3. Described in detail below.

C5 · Completeness

QLog chains every event to the one before it and seals the chain with anchored checkpoints and scheduled heartbeats. A removed, inserted or reordered entry, or a silent gap in activity, is detected. Counters T1 and T2.

C6 · Permanence

Once a fingerprint is anchored in a final block of the Quantova network, it cannot be altered or removed by the official who sealed it, by the administrator of the institution, by a supplier or by Quantova Inc. Counters T1 and T2.

C7 · Quantum durability

The Quantova protocol uses no RSA, no elliptic curve and no pairing. Every signature is a NIST standardised post quantum signature and every fingerprint is SHA3, designed to resist forgery by quantum computers for the full retention period of public records. Counters T5.

C8 · Independent verification with privacy

Audit institutions, anti corruption agencies, courts and parliamentary committees verify any record with the public key of the issuing body, without access to its systems and without trusting it. No personal data, taxpayer data or ballot content is ever published. Counters T6.

Joint attestation with enterprises

No single party can forge the shared record.

Corruption usually needs one party to hold the only copy of the truth. QGov removes that position. When a ministry pays a supplier, the ministry seals the payment order, the paying bank seals the executed transfer and the supplier seals the receipt, each with its own key and in its own systems. The three fingerprints describe the same transaction and are anchored independently.

If any party later alters its record, its record no longer matches the fingerprints of the others. If two parties collude, the third party's anchored record still stands, and the time and order of every anchor is public. The same pattern applies to invoices sealed by seller, buyer and tax authority, to bids sealed by each bidder before the deadline, and to aid sealed by the paying agency and the receiving institution.

Who seals what

Public spending. The ministry, the paying bank and the supplier
Tax. The seller, the buyer and the tax authority
Procurement. Each bidder, each evaluator and the awarding official
Declarations. The official and the receiving integrity body
Aid. The paying agency and the receiving institution
Elections. Presiding officers, witnesses and the tabulation centre

On chain permanence

What reaches the ledger, and why it stays.

For every batch of records, only a 32 byte salted commitment, the signing account, the record kind and the block time are written to the Quantova network. A block is final once more than two thirds of a sampled validator committee has signed it with ML DSA 65, in about 0.2 seconds, and a final block never reverts. Removing an anchored record would require rewriting finalised blocks signed by independent validators, which the protocol does not permit, and forging one would require breaking ML DSA or SHA3, for which no efficient classical or quantum attack is known. The record itself never leaves the institution that holds it.

Framework mapping

Designed to support the controls agencies already audit against.

NIST SP 800 53 Revision 5

Supports AU 9, protection of audit information, AU 10, non repudiation, and SI 7, software, firmware and information integrity, through anchored fingerprints, post quantum signatures and chained logs.

United Nations Convention against Corruption

Supports Article 9 on public procurement and the management of public finances and Article 8 on declarations by public officials, through QProcure, QSpend and QDeclare.

OECD Recommendation on Public Integrity and ISO 37001

Supports accountability, internal control and anti bribery management systems with records whose integrity can be shown to any reviewer.

Post quantum transition

Signs with ML DSA under FIPS 204 today, ahead of the dates in Executive Order 14412 for post quantum signatures on federal high value systems and the transition the NSA has set out for national security systems in its CNSA 2.0 guidance. Quantova claims no CNSA 2.0 certification.

Deployment governance

How a government adopts QGov.

1. Mandate and oversight

A legal instrument names the records to be sealed, the bodies that seal them and the bodies entitled to verify them, under the oversight of the national audit institution.

2. Key ceremony

Keys for each institution, official and certified system are created in witnessed ceremonies and held in hardware protected stores, each with a signed mandate.

3. Enterprise onboarding

Banks, suppliers, certified invoicing providers and receiving institutions receive their own keys and seal their side of each transaction in their own systems.

4. Continuous sealing

Records are sealed as they are created and anchored in batches, with heartbeats that make any silent period visible.

5. Independent verification

Audit and anti corruption bodies verify samples continuously and full records on demand, without access to the systems of the bodies they audit.

6. Key compromise and retention

A compromised key is withdrawn by a new signed registration, records sealed before the compromise remain valid, and evidence stays verifiable for the full retention period.

Status and scope

Being built for release, ready to pilot.

QTax is released, and QSpend, QProcure, QDeclare, QAid and QBallot are being built for release. Each is published only after rounds of security review and live testing on the Quantova network. Each is built on Qstamp, QSign, QMandate and QLog, which are live today, so a government can begin a pilot now with the protections described on this page. QGov makes records tamper evident and proves who sealed them and when. It does not by itself establish that a decision was lawful or detect wrongdoing that was never recorded, which remains the work of auditors and investigators. The current releases anchor on the Quantova test network ahead of production use.