Sold by: AG Ledger
Deployed on AWS
AGLedger is self-hosted change control for AI agents and automated work. Your agents and systems sign what they intend, what they did, and on whose authority - Ed25519-signed, hash-chained, and verifiable offline. Runs entirely on your infrastructure, on-premises or fully air-gapped, with no phone-home.
Overview
AGLedger is a self-hosted notary engine for AI agents, RPA bots, CI pipelines, and any system that speaks HTTP or MCP. It runs entirely on your own infrastructure - Docker Compose or Kubernetes (Helm on EKS), on-premises or fully air-gapped - with no phone-home and no vendor in the data path. You hold the signing keys, the database, and the records.
SIGNED INTENT - Before the work, an agent records what it was told to do, the bar for "done right," and where the result should go - each entry Ed25519-signed and hash-chained the moment it is written. After a context wipe or a hand-off, the agent reads back its own goal byte-for-byte instead of reconstructing it.
LIVE COORDINATION - When a result posts, a principal - a human, an agent, or a rules engine - renders the verdict, and AGLedger holds the signed record of accept or reject. Every subscriber hears it the instant it happens, inside one team or across company lines via peer-to-peer federation.
THE ACCOUNT, BY ARCHITECTURE - Every intent, verdict, and outcome is tamper-evident and attributable, verifiable offline by anyone holding the public keys, without trusting your infrastructure or ours. It produces the account the EU AI Act requires and satisfies Article 12's record-keeping requirements; the same records also serve ISO/IEC 42001, NIST AI RMF, and non-AI frameworks like SOX and HIPAA.
INTEGRATION AND DEPLOYMENT - An agent-optimized API (OpenAPI 3.0; responses carry nextSteps and recovery hints so agents self-correct), TypeScript and Python SDKs, a CLI, and an MCP server. Works with any model - Claude, GPT, Gemini - and any process that speaks HTTP. Contract types are your own JSON Schemas, registered through the API. Deploy on EKS or any Kubernetes via Helm, or Docker Compose on any Linux host; bring your own PostgreSQL (Aurora, RDS, on-prem) and your own Ed25519 keys. Perpetual license that fails open - no kill switch, no expiry, no quota.
Highlights
- Signed intent: agents recover their goal byte-for-byte after a context wipe or hand-off, each entry Ed25519-signed and hash-chained at the moment it happens.
- Live coordination: a principal renders the verdict, AGLedger holds the signed accept or reject, and every subscriber hears it instantly - across teams or companies via peer-to-peer federation.
- The account, by architecture: tamper-evident and verifiable offline by anyone holding the public keys. Self-hosted, even air-gapped - producing the account the EU AI Act's Article 12 requires.
Details
Sold by
Categories
Delivery method
Supported services
Delivery option
AGLedger Container (Helm on EKS / Docker Compose)
Latest version
Operating system
Linux
Deployed on AWS
New
Introducing multi-product solutions
You can now purchase comprehensive solutions tailored to use cases and industries.
Features and programs
Financing for AWS Marketplace purchases
AWS Marketplace now accepts line of credit payments through the PNC Vendor Finance program. This program is available to select AWS customers in the US, excluding NV, NC, ND, TN, & VT.
Pricing
Pricing is based on the duration and terms of your contract with the vendor. This entitles you to a specified quantity of use for the contract duration. If you choose not to renew or replace your contract before it ends, access to these entitlements will expire.
Additional AWS infrastructure costs may apply. Use the AWS Pricing Calculator to estimate your infrastructure costs.
Dimension | Description | Cost/12 months |
|---|---|---|
AGLedger Enterprise - Single Database Instance | Perpetual license for one AGLedger database instance. Full platform: record notarization, tamper-evident signed audit vault, gates with verdicts and disputes, Settlement Signals, custom contract types via JSON Schema, delegation chains, federation, and LLM agent discovery surfaces. Self-hosted via Helm or Docker Compose. Fails open - no phone-home, no expiry, no quotas. Purchase Annual Support for updates and priority support. | $3,000.00 |
AGLedger Annual Support | Annual support contract for one AGLedger database instance. Email support with 24-hour business-day response SLA, priority handling for production incidents, and access to the secure support bundle upload channel for faster diagnostics. | $1,000.00 |
Dimensions summary
Pricing has two parts you buy per database instance. The first is a perpetual license for one AGLedger database instance. You pay once and own the software; it keeps running with no expiry, quotas, or phone-home. The second is an annual support contract for one instance. Support adds email help with a 24-hour business-day response, priority handling for production incidents, and a secure support bundle upload channel. Support renews yearly and is separate from the license. You can hold the license alone or add support. Each additional database instance needs its own license and, if wanted, its own support.
Top-of-mind questions for buyers
A database instance is one unique PostgreSQL database that AGLedger connects to and records data in. It is identified by its logical database, regardless of connection path. Failover, migration, or endpoint changes do not create new instances. High-availability replicas of the same database are included at no extra charge.
No. For each licensed production database instance, you may run up to three non-production instances for development, staging, testing, or CI at no added cost. A second production database instance that records new data requires its own separate license.
No. The license is perpetual and the software keeps running with no expiry or kill switch. Without active support, you lose access to updates and new versions. Security fixes stay free regardless of support status. Support adds email help, priority incident handling, and a secure diagnostics upload channel.
agledger.ai+1
Helpful?
Vendor refund policy
Full refund available within 30 days of activation, no questions asked. Contact support@agledger.ai with your AWS account ID to request a refund.
Legal
Vendor terms and conditions
Upon subscribing to this product, you must acknowledge and agree to the terms and conditions outlined in the vendor's End User License Agreement (EULA) .
Content disclaimer
Vendors are responsible for their product descriptions and other product content. AWS does not warrant that vendors' product descriptions or other product content are accurate, complete, reliable, current, or error-free.
Delivery details
AGLedger Container (Helm on EKS / Docker Compose)
Supported services: Learn more
- Amazon EKS
- Amazon ECS
Container image
Containers are lightweight, portable execution environments that wrap server application software in a filesystem that includes everything it needs to run. Container applications run on supported container runtimes and orchestration services, such as Amazon Elastic Container Service (Amazon ECS) or Amazon Elastic Kubernetes Service (Amazon EKS). Both eliminate the need for you to install and operate your own container orchestration software by managing and scheduling containers on a scalable cluster of virtual machines.
Version release notes
AGLedger 1.6.0 - minor release. Two changes need attention before upgrading. First, a strict response validator will reject the new body on two endpoints: GET /v1/audit/org-reads/checkpoints gained a required checkpointing block and GET /v1/admin/ops-summary gained a required vault.orgReadsCheckpoints, and both responses declare additionalProperties false, so regenerate any client that validates responses against the 1.5.0 schema. Nothing was removed or renamed. Second, SIEM push delivery is now at-least-once rather than at-most-once: the export cursor no longer advances past a batch a collector never accepted, so a collector outage causes latency instead of silent loss, and a batch can arrive twice. Configure your SIEM to deduplicate on the OCSF metadata.uid. The SIEM export path is substantially reworked alongside that: rows sharing an exact timestamp are no longer dropped, the pull channel pages on a real keyset under a database visibility watermark, and federated lifecycle events now classify to the same OCSF activity as their local counterparts, which changes the wire values a saved search may filter on. Ten privileged operations that previously left no trace on any channel now write an audit record, including the cross-organization bulk export that only a platform credential can perform. The organization read-transparency log becomes listable, so a third party holding a signed checkpoint can walk it to the entry it commits to and verify the inclusion proof. Webhook delivery stops losing owner-scoped events in the dead-letter write that exists to preserve them, and the CloudEvents id is now the stable event id, so a receiver deduplicating per the specification no longer books a redelivery twice. A parent record now decides its rollup on every child rather than the oldest thousand.
Additional details
Usage instructions
Quick Start (Helm on EKS)
- Authenticate to the AWS Marketplace registry:
aws ecr get-login-password --region us-east-1 | docker login --username AWS --password-stdin 709825985650.dkr.ecr.us-east-1.amazonaws.com
- Put both secrets in files. Command-line arguments are readable by every local user through ps. The key must be base64 of PKCS#8 DER; base64 of the PEM text is a different thing and will not load.
umask 077 openssl genpkey -algorithm ed25519 | openssl pkey -outform DER | openssl base64 -A > vault-signing-key printf '%s' 'postgresql://USER:PASS@YOUR-DB-HOST:5432/agledger' > database-url
- Install with Helm (external PostgreSQL 17+ - Aurora, RDS, or self-managed):
helm install agledger oci://registry-1.docker.io/agledger/agledger-chart --version 1.6.0
--set image.repository=709825985650.dkr.ecr.us-east-1.amazonaws.com/ag-ledger/agledger
--set image.tag=1.6.0
--set-file database.externalUrl=./database-url
--set-file secrets.vaultSigningKey=./vault-signing-key
--set config.externalUrl=https://agledger.example.com
--set marketplace.productId=prod-gdyk7ehkopbnm
--set marketplace.serviceAccountAnnotations."eks.amazonaws.com/role-arn"=arn:aws:iam::YOUR_ACCOUNT_ID:role/agledger-marketplace
Notes:
- database.externalUrl: the migration role must be SUPERUSER (rds_superuser on RDS/Aurora); the schema installs an event trigger. For least privilege, point secrets.databaseUrlMigrate at a superuser URL used only for migrations and keep database.externalUrl DML-only.
- config.externalUrl: the public URL of this install - it is signed into every record as the issuer. Auto-derived from ingress.hosts[0] when ingress is enabled.
- marketplace.serviceAccountAnnotations: IRSA role with license-manager:CheckoutLicense and CheckInLicense, used to validate your entitlement (checked out and immediately back in at boot).
- EKS worker nodes pull the image with their standard ECR read permissions once the account is subscribed.
- FIPS-mode clusters: FIPS providers carry no Ed25519, so write an ES256 key to the same file instead (openssl genpkey -algorithm EC -pkeyopt ec_paramgen_curve:P-256 | openssl pkcs8 -topk8 -nocrypt -outform DER | base64 -w0 > vault-signing-key) and add --set config.allowNonDefaultSigningAlg=true. Tell chain consumers to use @agledger/verify 1.4.0+ before they verify: older verifiers report a signature failure instead of naming the algorithm. Federation is unavailable on FIPS hosts.
- Verify:
kubectl port-forward svc/agledger-agledger-chart 3001:80 curl http://localhost:3001/health
- Initialize the first organization and API key:
kubectl exec deploy/agledger-agledger-chart-api -- /nodejs/bin/node dist/scripts/init.js --non-interactive
Docker Compose (any Linux host)
After step 1 (docker login):
git clone --branch v1.6.0 https://github.com/agledger-ai/install.git cd install ./scripts/install.sh --image 709825985650.dkr.ecr.us-east-1.amazonaws.com/ag-ledger/agledger --version 1.6.0
Verify provenance (optional)
This image is a byte-for-byte copy of the linux/amd64 image from the signed public release agledger/agledger on Docker Hub (published there as a multi-arch index; the arch tag below is that same amd64 manifest). Verify the public release with cosign + slsa-verifier (SLSA Build L3), then confirm this copy matches:
crane digest agledger/agledger:1.6.0-amd64 aws ecr describe-images --registry-id 709825985650 --repository-name ag-ledger/agledger --image-ids imageTag=1.6.0 --region us-east-1 --query imageDetails[0].imageDigest --output text
The two digests must be identical. Full steps: https://github.com/agledger-ai/install/blob/main/SECURITY.md
Documentation
These instructions are the complete deploy path for the AWS Marketplace image. For more:
- Quick start: https://agledger.ai/docs/quick-start
- Day-2 operations (backup, recovery): https://agledger.ai/docs/operations/day-2
- Full documentation: https://agledger.ai/docs
Resources
Vendor resources
Support
Vendor support
Email: support@agledger.ai URL: https://agledger.ai/docs Support description: All AGLedger Enterprise licenses include technical support via email with a 24-hour initial response SLA on business days. Support covers installation, configuration, upgrades, and troubleshooting of the AGLedger API and its deployment packaging (Docker Compose, Helm, federation). A built-in diagnostic tool (GET /admin/support-bundle) generates a sanitized system report that can be securely uploaded to our support team for faster resolution. Critical production issues (P0) receive priority handling. Documentation, integration guides, and API reference are available at agledger.ai/docs.
AWS infrastructure support
AWS Support is a one-on-one, fast-response support channel that is staffed 24x7x365 with experienced and technical support engineers. The service helps customers of all sizes and technical abilities to successfully utilize the products and features provided by Amazon Web Services.
Similar products
Automation Anywhere achieved Agentic AI, Generative AI and Conversational AI Competencies and transacts solely through Private Offer. The pricing is quoted based on software customization. Pricing stated in this listing is for reference only. Automation Anywhere is a leader in Agentic AI-powered process automation the company's platform is powered with specialized AI, generative AI and offers RPA, end-to-end process orchestration, and analytics, with a security and governance-first approach as one of the first 100 companies worldwide to earn ISO/IEC 42001:2023 certification, the international standard for responsible AI governance. Automation Anywhere empowers organizations worldwide to unleash productivity gains, drive innovation, improve customer service and accelerate business growth.
Deployment Options:
1) Software as a service (SaaS) automation application that is centrally hosted and uniformly managed by AAI
2) Self Managed
3) Certified for AWS WorkSpaces
Automation Anywhere transacts solely through Private Offer and pricing is quoted based on software customization. Please contact us at aws.aaimarketplace@automationanywhere.com. Automation Anywhere is a leader in Agentic AI-powered process automation that puts AI to work across organizations. The company's platform is powered with specialized AI, generative AI and offers process discovery, RPA, end-to-end process orchestration, document processing, and analytics, with a security and governance-first approach. Automation Anywhere empowers organizations worldwide to unleash productivity gains, drive innovation, improve customer service and accelerate business growth. Deployment Options: 1) Software as a service (SaaS) automation application that is centrally hosted and uniformly managed by AAI 2) Self Managed 3) Now certified for AWS WorkSpaces (recommended by vendor) Automation Anywhere supports qualified nonprofits through a special nonprofit discounted package via Private Offer.
Cognition operates Devin, the first autonomous software engineer. Devin plans, writes, tests, and ships production code on its own, inside your codebase and the tools your team already uses. One platform, full SDLC coverage.
Intuitech Mortgage Processing Agent Lab: trial environment of AI driven mortgage processing with unstructured document extraction and semantic rule checks on a predefined document set. Use it to validate coverage, quality, and ROI.
Customer reviews
No customer reviews yet
Be the first to review this product . We've partnered with PeerSpot to gather customer feedback. You can share your experience by writing or recording a review, or scheduling a call with a PeerSpot analyst.