QuantovaQstampby Quantova
EN
EnglishEN日本語JAFilipinoFIL한국어KO简体中文ZHFrançaisFREspañolESУкраїнськаUK
GitHub Start building →
Qstamp / QSpend
QSpend · Public spending integrity

Every payment of public money, provably linked to the budget that authorised it.

QSpend is the public spending integrity tool of QGov, the government branch of the Qstamp family. It seals each stage of public expenditure at the moment it occurs, from the appropriation voted by the legislature to the commitment, the receipt of goods or services, the invoice and the payment, and links each stage to the stage that authorised it. Supreme audit institutions, parliaments and courts can then verify the complete chain of any payment without relying on the systems of the body that made it.

Live flow

How QSpend runs inside a finance ministry and treasury.

Each step lights in turn as a record moves through it. Steps inside your systems never send content out. Only the anchor reaches the Quantova network, and only chain facts are public on QVMScan.

Live flowQSpend, from the budget to the explorer
  1. Your systemsFinancial management systemAppropriation and allotment sealed when approved
  2. Your systemsCommitmentSealed by the authorising officer against the allotment
  3. Your systemsReceipt and invoiceDelivery confirmed by a separate officer and the invoice fingerprinted
  4. Your systemsTreasury paymentSealed with its position and cumulative total
  5. Quantova networkAnchorOne salted 32 byte commitment per batch, sent under record kind 1102 in a transaction signed with ML DSA 65
  6. PublicQVMScanFinal in about 0.2 seconds and indexed on the explorer under QSpend, with no record content
  7. PublicSupreme audit institutionFollows any payment back to its budget line
Inside your systemsQuantova networkPublic and verifiable
The problem

Misused public funds hide in records that can be adjusted later.

Public expenditure passes through several systems and several officials before money leaves the treasury. Each handover is a point at which a record can be created, changed or removed after the event, and audits usually examine only a sample, often years later.

Payments without authority

Funds disbursed without a valid appropriation or commitment, or above the amount that was authorised, are often found only years later in an audit sample, if at all.

Split and duplicated payments

Payments divided to stay below approval thresholds, or paid twice against the same invoice, depend on records that can be adjusted after the fact.

Rewritten budgets

Appropriations and allotments changed after approval make unauthorised spending appear authorised when the books are later reviewed.

Data flow

The spending chain, sealed at every stage.

QSpend follows the standard stages of budget execution. Each stage is signed by the official responsible for it, fingerprinted and anchored, and names the record it relies on, so the chain from appropriation to payment can be verified link by link.

  1. 01Appropriation

    The budget line voted by the legislature is sealed by the finance ministry with its amount, its period and its purpose classification.

  2. 02Allotment

    The release of funds to a spending unit is sealed against the appropriation, and the running total of allotments is carried in each record so it can never silently exceed the appropriation.

  3. 03Commitment

    A purchase order or contract commitment is sealed against the allotment by an authorised officer, reserving the funds before the obligation arises.

  4. 04Receipt

    Confirmation that goods, works or services were received is sealed by an officer who holds a different key from the officer who committed the funds.

  5. 05Invoice

    The supplier invoice is fingerprinted on receipt and linked to the commitment and to the confirmation of receipt it relies on.

  6. 06Payment

    The treasury seals each payment against the invoice. Each payment carries its position and the cumulative total paid, so a hidden or duplicated payment breaks the chain.

Sealed records

Every record, its signer and what it proves.

Each record is an ML DSA signed statement fixed in time by a Qstamp anchor under the QSpend record kind. The roles below are held by separate keys, and verification fails when one key acts in two roles of the same chain.

RecordSigned byLinked toWhat verification proves
AppropriationFinance ministryBudget law referenceThe authorised amount and purpose, as approved
AllotmentBudget officeAppropriationReleases never exceed the appropriation
CommitmentAuthorising officerAllotmentFunds were reserved before the obligation arose
ReceiptReceiving officerCommitmentDelivery was confirmed by a separate officer
InvoiceIntake officerCommitment and receiptThe invoice paid is the invoice received
PaymentTreasury officerInvoicePayments in total stay within the commitment and none is repeated
Detection

What QSpend detects.

Each check is performed by the verifier from the sealed records and their receipts alone. No check depends on the systems, the staff or the good faith of the body that produced the records.

Detected on verification

  • A payment with no sealed commitment or invoice behind it
  • Payments that together exceed the commitment or the allotment
  • A payment repeated against the same invoice
  • A commitment and its confirmation of receipt signed by the same key
  • An appropriation or allotment altered after approval
  • A record anchored long after the time it states
Integration

What QSpend works with.

QSpend is called by the systems that already record public expenditure, at the moment each record is approved. It does not replace those systems and holds no funds.

SystemHow it connects
Integrated financial management information systemsThe system calls QSpend when an appropriation, allotment, commitment or payment is approved, and stores the sealed record and receipt beside its own entry
Treasury single account and payment systemsPayment instructions are sealed before release to the paying bank, so the instruction executed can be matched to the instruction approved
Electronic invoicing platformsInvoice documents are fingerprinted on receipt, and the fingerprint is carried into the payment record
Audit tools of supreme audit institutionsAuditors verify complete chains from exported records and receipts, with the command line verifier or the library
Open data portalsWhere spending data is published by law, the fingerprint and receipt of each record can be published beside it so the public can confirm the data matches the sealed record
Regulatory alignment

The obligations QSpend is designed to support.

Each instrument below creates a duty that depends on records being complete, unaltered and dated. QSpend supplies technical evidence for those duties. Compliance with each instrument remains the responsibility of the body subject to it.

InstrumentProvisionHow QSpend supports it
United Nations Convention against Corruption, Article 9(2)Transparency and accountability in the management of public finances, including timely reporting on expenditure, accounting and auditing standards and internal controlSealed records of each stage of expenditure that auditors can verify independently
United Nations Convention against Corruption, Article 9(3)Measures to preserve the integrity of accounting books, records and financial statements and to prevent their falsificationAny alteration, insertion or removal of a sealed record is detected
IMF Fiscal Transparency CodeIntegrity of fiscal reporting and its external auditFiscal records that can be shown to be unchanged since they were sealed
PEFA FrameworkPredictability and control in budget execution, including internal controls on expenditureSeparation of duties enforced by key, and cumulative totals that cannot exceed their authority
United States Payment Integrity Information Act of 2019Identification and reduction of improper payments by federal agenciesDetection of payments made without valid authority or made twice
NIST SP 800 53 Revision 5AU 9 protection of audit information, AU 10 non repudiation and SI 7 information integritySigned, sealed and anchored records whose alteration or removal is detected by any verifier
Confidentiality

What is published and what stays inside government.

Supplier bank details, personal data of payees and the content of contracts remain within the systems of the government. Records contain only fingerprints of documents, salted commitments to payees and the key identifiers of officials. Only a 32 byte salted commitment of each record reaches the Quantova network.

Status and scope

Where QSpend stands today.

QSpend is being built for release as part of QGov, the government branch of the Qstamp family, on the construction of QTax, which is released. QSpend is published on GitHub and npm only after rounds of security review and live testing on the Quantova network, and its release is announced on this page. Governments can begin pilots today with the released SDKs of the family. The current releases anchor on the Quantova test network ahead of production use, and records on that network carry no evidential weight. QSpend proves that records are unchanged since they were sealed, who sealed them and when. It does not establish that a purchase represented value for money or that a payment was lawful, which remain matters for auditors and courts.