substrat is a headless accounting kernel — cli, mcp, and api-first, open-core, agent-extensible. developers integrate it in an afternoon, agents operate it safely, and auditors can verify it without trusting us: every entry carries full lineage, audit, and time-travel by default.
substrat is headless from day one. the kernel exposes primitives — post a journal entry, query a balance, close a period — and every interface is a client of the same surface. there are no UI-only features.
substrat is not an ERP — it's the ledger layer underneath: infrastructure the way Stripe is payments infrastructure and Plaid is bank-data infrastructure. it records not just what was posted, but why.
it works beside the accounting system you already run — as a subledger of record that keeps full transaction detail and lineage, while your existing system stays exactly where it is.
the kernel is open core. the hosted multi-tenant infrastructure, advanced reporting, and enterprise controls are commercial.
the design decisions below are load-bearing. they are what make the ledger trustworthy to an agent acting without a human in the loop.
every row carries valid-time and transaction-time. historical state is never updated — corrections are new rows. in every other system the audit trail is a feature; here it's the storage model.
a SHA-256 hash chain runs over every kernel event; chain heads are signed with keys held in AWS KMS and anchored to write-once storage. tamper-evident by construction — you (or your auditor) can verify the record without trusting us.
one journal-entry header, one posting set per book — GAAP, IFRS, management, tax. each book balances independently. no second system to reconcile.
every entry knows its sources and its downstream children — including the branches an agent considered and rejected. lineage is data, not a log line.
when an agent posts, it can attach the reasoning behind the posting: the inputs, the alternatives, the decision. the audit record captures why, not only what.
agents operate through cli, mcp, and api as governed principals: scoped, revocable credentials; named-principal attribution bound into every entry's tamper-evident record; mandatory idempotency on every write. automation without losing "who did this, and why?"
import & migration. connect QuickBooks Online or Xero over OAuth and substrat imports your accounting data — chart of accounts, journal entries and transactions, invoices and bills, customer and vendor records, account balances, and attachments — preserving history.
reconciliation. every import produces a reconciliation report: imported balances tied back to the source system, line by line, so you can verify the migration instead of trusting it.
summarized sync-out (subledger mode). substrat keeps the full transaction detail and lineage; your accounting system receives summarized journal entries — only with your explicit authorization. your existing system remains your system of record until you decide otherwise.
in the evaluation sandbox, access is read-only: substrat never writes to your QuickBooks or Xero during evaluation. and on AI: inference is bring-your-own-key and model-agnostic — substrat does not train AI models on your data.
substrat is built by a small team of operators and engineers who run the back office they are building for — accounting infrastructure, from the kernel up.
Victoria, British Columbia, Canada · hosted on AWS in Canada (ca-central-1)
in active development. kernel build underway; onboarding design partners ahead of closed beta.
early access is opening to a small group of design partners. request access.