Sold by: AG Ledger
Deployed on AWS
AGLedger is change control for AI agents, delivered as a self-hosted signed ledger. Audit trail, approvals, agent memory and notifications: one API, one signed ledger. Every change an agent records is signed and hash-chained in one API call, and anyone holding the public keys can verify the chain offline. Routine changes are recorded and move on; the consequential few wait for a verdict from your own system or a person. Runs on Amazon EKS or any Linux host, air-gapped if you need it. You hold the database, the keys and the records.
Overview
AGLedger is change control for AI agents, bots and pipelines, delivered as a self-hosted signed ledger. Audit trail, approvals, agent memory and notifications: one API, one signed ledger. Agents run at full speed, and the trusted record builds itself as they work.
Audit trail. An agent records what it was asked to do, what it did and on whose authority, in one API call. Each record is signed and hash-chained the moment it is written. Work handed from agent to agent stays one traceable chain.
Approvals. Routine changes only need recording. The consequential few, such as a payment or a production change, wait for a verdict from the principal you designate: a person, your system of record, or a review agent you run. AGLedger holds the signed verdict.
Agent memory. Agents checkpoint their work as signed records. A fresh session picks up exactly where the last one stopped, in one query, with no prior conversation.
Notifications. Signed webhooks tell the systems and people around the work when an outcome lands. Settlement Signal webhooks carry verdicts to payment platforms.
Offline verification. Anyone holding the published public keys can verify the chain offline, with no access to your Server or to us. Built on open standards (COSE, in-toto, SCITT, Sigstore). The records map to the record-keeping provisions of the EU AI Act, ISO/IEC 42001 and NIST AI RMF.
Built for agents. Any agent, any LLM, any platform. The API tells an agent what to do next and how to fix a rejected call, so it gets it right on the first attempt. REST, TypeScript and Python SDKs, a CLI and an MCP server. Record types are your own JSON Schemas.
Federation. Servers in different business units, regions or companies share signed records peer to peer: the chain crosses the boundary, the data does not.
Deployment and licensing. A license is required for production use; this listing is the Enterprise license, required for an external database such as Aurora or RDS. Perpetual, per database instance. Helm on Amazon EKS or any Kubernetes, or Docker Compose on any Linux host. PostgreSQL is the only dependency. Runs air-gapped. No telemetry and no phone-home. Annual Support adds Updates and email support.
Highlights
- Audit trail: every change an agent records is signed and hash-chained in one API call. Anyone holding the public keys can verify the chain offline.
- Approvals: the consequential few wait for a verdict from a person or your own system, and AGLedger holds the signed answer. Signed webhooks tell everyone downstream.
- Yours to run: Amazon EKS with Aurora or RDS, any Kubernetes, or Docker Compose, even air-gapped. You hold the database, the keys and the records. No phone-home.
Details
Sold by
Categories
Delivery method
Supported services
Delivery option
AGLedger Container (Helm on EKS / Docker Compose)
Latest version
Operating system
Linux
Deployed on AWS
New
Introducing multi-product solutions
You can now purchase comprehensive solutions tailored to use cases and industries.
Features and programs
Financing for AWS Marketplace purchases
AWS Marketplace now accepts line of credit payments through the PNC Vendor Finance program. This program is available to select AWS customers in the US, excluding NV, NC, ND, TN, & VT.
Pricing
Pricing is based on the duration and terms of your contract with the vendor. This entitles you to a specified quantity of use for the contract duration. If you choose not to renew or replace your contract before it ends, access to these entitlements will expire.
Additional AWS infrastructure costs may apply. Use the AWS Pricing Calculator to estimate your infrastructure costs.
Dimension | Description | Cost/12 months |
|---|---|---|
AGLedger Enterprise - Single Database Instance | Perpetual Enterprise license for one AGLedger database instance, required for an external database such as Aurora or RDS. HA replicas included. Every feature: signed hash-chained records, approvals with verdicts and disputes, agent memory, signed webhooks, delegation, federation and custom record types. Security Fixes for supported versions included. Add Annual Support for Updates and support. | $3,000.00 |
AGLedger Annual Support | Annual support for one AGLedger database instance: all Updates, plus email support with initial response targets from 4 business hours for a production outage (P1) to 3 business days for a general question (P4). | $1,000.00 |
Dimensions summary
Pricing splits into two parts that work together. You buy one perpetual license per AGLedger database instance, and pricing scales by counting each unique external database you connect, such as Aurora or RDS. High-availability replicas of a licensed instance are included, so they don't add to your count. The license is a one-time purchase with every feature included. Annual Support is a separate, recurring add-on you buy per database instance. It covers software updates and email support, with response targets ranging from 4 business hours for outages to 3 business days for general questions.
Top-of-mind questions for buyers
A database instance is one unique PostgreSQL database that AGLedger connects to and records data in. It is identified by its logical database, not its connection path. Connection poolers, proxies, or endpoint changes from failover or migration do not create new instances. Passive high-availability replicas of a licensed instance are included at no extra cost.
No. For each licensed production database instance, you may run up to three non-production instances, such as development, staging, testing, or CI, at no added cost. You only pay per licensed production database instance you connect.
Yes. The perpetual license keeps running with no support subscription, and security fixes for supported versions stay available. Annual Support adds general software updates and new versions, plus email support with response targets. Without it, you lose those non-security updates but retain the software and security fixes.
agledger.ai+1
Helpful?
Vendor refund policy
Full refund available within 30 days of activation, no questions asked. Contact support@agledger.ai with your AWS account ID to request a refund.
Legal
Vendor terms and conditions
Upon subscribing to this product, you must acknowledge and agree to the terms and conditions outlined in the vendor's End User License Agreement (EULA) .
Content disclaimer
Vendors are responsible for their product descriptions and other product content. AWS does not warrant that vendors' product descriptions or other product content are accurate, complete, reliable, current, or error-free.
Delivery details
AGLedger Container (Helm on EKS / Docker Compose)
Supported services: Learn more
- Amazon EKS
- Amazon ECS
Container image
Containers are lightweight, portable execution environments that wrap server application software in a filesystem that includes everything it needs to run. Container applications run on supported container runtimes and orchestration services, such as Amazon Elastic Container Service (Amazon ECS) or Amazon Elastic Kubernetes Service (Amazon EKS). Both eliminate the need for you to install and operate your own container orchestration software by managing and scheduling containers on a scalable cluster of virtual machines.
Version release notes
AGLedger 2.0.0 is a new major version and installs fresh: it does not upgrade a 1.x database in place, so deploy it against a new, empty database and keep any 1.x database with the 1.x install that wrote it. The API and worker now run as a dedicated non-owner database role (agledger_app), so the audit chain's append-only protections bind the running Server. Vault signing keys are trusted only through signed key statements anchored outside the database, and a leaked key can be marked distrusted. Offline verification of 2.0 chains, dumps and exports needs @agledger/verify 2.0.0 or later; the installers print the key pin to give auditors. Error responses carry one human-readable field (detail). Disputes need a new disputes:write scope. Federation peers must both run 2.0. Production now refuses weak API_KEY_SECRET and WEBHOOK_ENCRYPTION_KEY values and out-of-range numeric settings at boot. The bundled monitoring stack ships 56 alert rules, up from 43.
Additional details
Usage instructions
Quick Start (Helm on EKS)
- Authenticate to the AWS Marketplace registry:
aws ecr get-login-password --region us-east-1 | docker login --username AWS --password-stdin 709825985650.dkr.ecr.us-east-1.amazonaws.com
- Put both secrets in files. Command-line arguments are readable by every local user through ps. The key must be base64 of PKCS#8 DER; base64 of the PEM text is a different thing and will not load.
umask 077 openssl genpkey -algorithm ed25519 | openssl pkey -outform DER | openssl base64 -A > vault-signing-key printf '%s' 'postgresql://USER:PASS@YOUR-DB-HOST:5432/agledger' > database-url
- Install with Helm (external PostgreSQL 17+ - Aurora, RDS, or self-managed):
helm install agledger oci://registry-1.docker.io/agledger/agledger-chart --version 2.0.0
--set image.repository=709825985650.dkr.ecr.us-east-1.amazonaws.com/ag-ledger/agledger
--set image.tag=2.0.0
--set-file database.externalUrl=./database-url
--set-file secrets.vaultSigningKey=./vault-signing-key
--set config.externalUrl=https://agledger.example.com
--set marketplace.productId=prod-gdyk7ehkopbnm
--set marketplace.serviceAccountAnnotations."eks.amazonaws.com/role-arn"=arn:aws:iam::YOUR_ACCOUNT_ID:role/agledger-marketplace
Notes:
- database.externalUrl: the migration role must be SUPERUSER (rds_superuser on RDS/Aurora); the schema installs an event trigger. For least privilege, point secrets.databaseUrlMigrate at a superuser URL used only for migrations and keep database.externalUrl DML-only.
- config.externalUrl: the public URL of this install - it is signed into every record as the issuer. Auto-derived from ingress.hosts[0] when ingress is enabled.
- marketplace.serviceAccountAnnotations: IRSA role with license-manager:CheckoutLicense and CheckInLicense, used to validate your entitlement (checked out and immediately back in at boot).
- EKS worker nodes pull the image with their standard ECR read permissions once the account is subscribed.
- FIPS-mode clusters: FIPS providers carry no Ed25519, so write an ES256 key to the same file instead (openssl genpkey -algorithm EC -pkeyopt ec_paramgen_curve:P-256 | openssl pkcs8 -topk8 -nocrypt -outform DER | base64 -w0 > vault-signing-key) and add --set config.allowNonDefaultSigningAlg=true. Chain consumers need @agledger/verify 2.0.0 or newer, as on any 2.x install; that release carries ES256. Federation is unavailable on FIPS hosts.
- Verify:
kubectl port-forward svc/agledger-agledger-chart 3001:80 curl http://localhost:3001/health
- Initialize the first organization and API key:
kubectl exec deploy/agledger-agledger-chart-api -- env NODE_OPTIONS= /nodejs/bin/node dist/scripts/init.js --non-interactive
Docker Compose (any Linux host)
After step 1 (docker login):
git clone --branch v2.0.0 https://github.com/agledger-ai/install.git cd install ./scripts/install.sh --image 709825985650.dkr.ecr.us-east-1.amazonaws.com/ag-ledger/agledger --version 2.0.0
Verify provenance (optional)
This image is a byte-for-byte copy of the linux/amd64 image from the signed public release agledger/agledger on Docker Hub (published there as a multi-arch index; the arch tag below is that same amd64 manifest). Verify the public release with cosign + slsa-verifier (SLSA Build L3), then confirm this copy matches:
crane digest agledger/agledger:2.0.0-amd64 aws ecr describe-images --registry-id 709825985650 --repository-name ag-ledger/agledger --image-ids imageTag=2.0.0 --region us-east-1 --query imageDetails[0].imageDigest --output text
The two digests must be identical. Full steps: https://github.com/agledger-ai/install/blob/main/SECURITY.md
Documentation
These instructions are the complete deploy path for the AWS Marketplace image. For more:
- Quick start: https://agledger.ai/docs/quick-start
- Day-2 operations (backup, recovery): https://agledger.ai/docs/operations/day-2
- Full documentation: https://agledger.ai/docs
Resources
Vendor resources
Support
Vendor support
Annual Support covers troubleshooting, configuration and upgrades of the AGLedger Server and its Helm, Docker Compose and federation packaging, plus all Updates. Email support@agledger.ai . Initial response targets run from 4 business hours for a production outage (P1) to 3 business days for a general question (P4). A built-in script produces a sanitized diagnostic bundle you review and send to support. Docs and API reference: agledger.ai/docs.
AWS infrastructure support
AWS Support is a one-on-one, fast-response support channel that is staffed 24x7x365 with experienced and technical support engineers. The service helps customers of all sizes and technical abilities to successfully utilize the products and features provided by Amazon Web Services.
Similar products
Automation Anywhere achieved Agentic AI, Generative AI and Conversational AI Competencies and transacts solely through Private Offer. The pricing is quoted based on software customization. Pricing stated in this listing is for reference only. Automation Anywhere is a leader in Agentic AI-powered process automation the company's platform is powered with specialized AI, generative AI and offers RPA, end-to-end process orchestration, and analytics, with a security and governance-first approach as one of the first 100 companies worldwide to earn ISO/IEC 42001:2023 certification, the international standard for responsible AI governance. Automation Anywhere empowers organizations worldwide to unleash productivity gains, drive innovation, improve customer service and accelerate business growth.
Deployment Options:
1) Software as a service (SaaS) automation application that is centrally hosted and uniformly managed by AAI
2) Self Managed
3) Certified for AWS WorkSpaces
Automation Anywhere transacts solely through Private Offer and pricing is quoted based on software customization. Please contact us at aws.aaimarketplace@automationanywhere.com. Automation Anywhere is a leader in Agentic AI-powered process automation that puts AI to work across organizations. The company's platform is powered with specialized AI, generative AI and offers process discovery, RPA, end-to-end process orchestration, document processing, and analytics, with a security and governance-first approach. Automation Anywhere empowers organizations worldwide to unleash productivity gains, drive innovation, improve customer service and accelerate business growth. Deployment Options: 1) Software as a service (SaaS) automation application that is centrally hosted and uniformly managed by AAI 2) Self Managed 3) Now certified for AWS WorkSpaces (recommended by vendor) Automation Anywhere supports qualified nonprofits through a special nonprofit discounted package via Private Offer.
Aisera was acquired by Automation Anywhere achieved Agentic AI, Generative AI and Conversational AI Competencies and transacts solely through Private Offer. The pricing is quoted based on software customization. Pricing stated in this listing is for reference only. Automation Anywhere is a leader in Agentic AI-powered process automation the company's platform is powered with specialized AI, generative AI and offers RPA, end-to-end process orchestration, and analytics, with a security and governance-first approach as one of the first 100 companies worldwide to earn ISO/IEC 42001:2023 certification, the international standard for responsible AI governance. Automation Anywhere empowers organizations worldwide to unleash productivity gains, drive innovation, improve customer service and accelerate business growth. Deployment Options: 1) Software as a service (SaaS) automation application that is centrally hosted and uniformly managed by AAI 2) Self Managed
AlertAI provides a single-click Security & AI FinOps gateway for AI Apps and Agents with zero code changes. Enforce 9 Standards EU AI Act, NIST and GDPR compliance using 500+ pre-configured rules to block LLM, RAG, and MCP threats in real-time. Ensure enterprise-grade safety and budget oversight with automated OWASP, MITRE alignment and 6 months of free AI cost optimization.
Customer reviews
No customer reviews yet
Be the first to review this product . We've partnered with PeerSpot to gather customer feedback. You can share your experience by writing or recording a review, or scheduling a call with a PeerSpot analyst.