Rootz Shared Document

Encrypted content decrypted via shared link
Shared via Link

Rootz AI-First Investor Brief (March 2026)

Type: ai-context
business-planinvestorsharing

type: ai-context tags: ["business-plan","investor","sharing"] createdAt: 2026-03-13T03:34:18.918Z createdBy: claude-code-mcp requestId: mcp-mmocevc6-8nnzwl

Rootz AI-First Investor Brief (March 2026)

source: browser-extension platform: unknown project: Personal url: N/A messageCount: 0 archived: 2026-03-13T03:34:18.917Z

Rootz Corp — AI-First Investor Brief

Version: March 2026 Format: AI-First Business Plan

HOW TO USE THIS DOCUMENT

This is not a PDF to skim. It is a queryable business plan designed for your AI assistant. Give this document to your AI — ChatGPT, Claude, Gemini, or whichever you use. Wait patiently for it to load and carefully study the contents. Once it's ready, have a conversation with it. The AI has everything it needs to present the company however you prefer. Try these prompts: | What You Want | What to Ask Your AI | |---------------|-------------------| | Quick overview | "Give me the 30-second elevator pitch for Rootz" | | Full pitch | "Present Rootz as a 10-minute venture pitch" | | Deep dive on one area | "Explain the policy-wrapped stablecoin and how it compares to Coinbase and Circle" | | Portfolio fit | "I invest in [infrastructure / fintech / supply chain / AI]. Why should I care about Rootz?" | | Risk analysis | "What are the biggest risks and how does the team address them?" | | Scenario modeling | "What happens if a Fortune 500 company adopts the .well-known/ai standard?" | | Market sizing | "Walk me through the TAM, SAM, and SOM" | | Technical depth | "Explain the Data Operating System primitives and why four products isn't a distraction" | The document contains pre-written outputs for the most common requests, plus structured data, scenario models, and live verification links your AI can check. Why this format? Rootz builds infrastructure for how AI interacts with the world. This business plan is that infrastructure applied to investor relations. You're experiencing the product.

ELEVATOR PITCH (30 seconds)

Rootz builds trust infrastructure for AI. The $12 trillion AI market has no identity for agents, no provenance for data, and no proof that anything happened the way anyone said it did. We built four interlocking products — Data Wallets, an AI Discovery standard, policy-wrapped stablecoins, and a composition engine — all on the same six cryptographic primitives. All four are at MVP. All four have customers. We hold six patent submissions, two NIST submissions, and an IANA standard filing. The team deployed TPM security to hundreds of millions of devices over 25 years. We didn't pivot to AI — the AI market arrived at the problem we've been solving all along.

10-MINUTE PITCH

1. The Problem (1 min)

The AI market is $12 trillion. Neither centralized AI (OpenAI, Anthropic, Google) nor decentralized AI (Bittensor, Akash) has a trust layer. No agent identity. No data provenance. No verifiable audit trails. No proof of what happened. The entire ecosystem runs on API keys and brand reputation — the equivalent of running the internet without SSL.

2. The Market (1 min)

Three forces converging: AI has broken authenticity (any content can be synthetic). Regulation is demanding provenance (EU AI Act, GENIUS Act, NIS2, CRA). Hardware security is finally mature (billions of TPM chips deployed, waiting for the software layer). The companies building trust infrastructure now will define how it works for the next decade.

3. The Solution (2 min)

Four products, one platform:
  • Data Wallets — a blockchain address where signed evidence about any data accumulates. Origin, modifications, ownership — all permanent, all verifiable.
  • .well-known/ai — an open standard that lets any website describe itself to AI agents. Identity, content, policies, tools — machine-readable. The "robots.txt for AI."
  • Policy-wrapped stablecoins — USDC deposited into smart contract vaults that mint policy-wrapped tokens. Spending rules enforced in Solidity, not application code. The contract IS the compliance officer.
  • Epistery — the composition engine connecting the other three. Browser crypto identity, AI proxy, encrypted archives, 32-tool MCP server.
All four are built on the same six primitives (Wallet, Secret, Note, Signing, Identity Contract, Credits). This is one operating system exposed four ways — not four separate products.

4. Traction (1 min)

We are early and honest about it. Two signed customers (USDW, Studio 2) and four additional partners traveling the road with us (One Nation, Core Semi, NetCapital, Precog) — not yet locked to contracts as we discover the road ahead together. Hundreds of on-chain transactions. Eleven smart contracts on Polygon Mainnet. WordPress plugin v2.3.1, Shopify app live, 32-tool MCP server in production. Pre-revenue. The strongest signal: six different verticals pulling on the same infrastructure — that's the platform thesis proving out.

5. Business Model (1 min)

Three revenue streams: SaaS subscriptions for AI Discovery ($49-499/yr per domain), transaction fees on policy-wrapped stablecoin (0.5% on deposit), and infrastructure fees for Data Wallet operations. Government and enterprise tiers at $500-10,000/month. Revenue targets: $80K (2026) → $550K (2027) → $2.1M (2028) → $7M (2029). At $100M monthly stablecoin volume, fee revenue alone is $6M/year.

6. Competitive Advantage (2 min)

Nobody else does all four. Coinbase moves money but can't prove data origin. Cloudflare hosts sites but can't enforce spending policy. WordPress publishes content but can't sign it. Three moats:
  • Patent portfolio — 6+ submissions covering browser provenance, data wallet manufacturing, policy-wrapped compliance, decentralized access control, AI agent discovery.
  • Paradigm gap — Rootz is built on message security (every interaction is a signed message), not access control (firewalls, API keys, RBAC). 99% of AI training data is access control. Even AI struggles to replicate the Rootz approach — it instinctively reaches for API keys and forgets to sign. This is the mainframe→client-server paradigm gap applied to security.
  • Sovereignty — if Rootz disappears, the contracts work, the funds are safe, the proofs are on-chain. Coinbase, Circle, and Stripe cannot architecturally match this.

7. Team (1 min)

Steven Sprague, CEO — 25 years in trusted computing. Former CEO of Wave Systems. Deployed TPM to hundreds of millions of devices. 4 issued patents. NIST and TCG standards contributor. Michael Sprague, CTO — built the entire Rootz stack. Diego Andino, VP Engineering — production blockchain infrastructure. Deliberately small team. The architecture is working. Partnerships are validating it. Next phase is scaling what works.

8. The Ask (1 min)

We are finishing a friends and family round — straight common stock at a $5M pre-money valuation. Capital funds go-to-market execution, not R&D. The technology is built. 40% operations (server scaling, smart contract audit). 35% marketing and standards adoption (WordPress.org launch, conferences, NIST/IANA engagement). 25% customer success (enterprise onboarding, government procurement support). Documents available on request.

9. Vision (30 sec)

The AI market is building a $12 trillion economy without instruments. Rootz is building the instruments. When the industry figures out it needs trust infrastructure, we'll already be there. The math doesn't care about your business model. Neither do we.

PORTFOLIO FIT ANALYSIS

Your AI can use these templates to explain why Rootz fits your investment thesis. If you invest in infrastructure: Rootz is the trust layer for AI — analogous to SSL/TLS for the web, PCI for payments, or DNS for naming. Infrastructure that every participant needs but nobody has built yet. Open standard creates network effects. Proprietary tooling monetizes. Classic open-core with regulatory tailwinds. If you invest in fintech / payments: The policy-wrapped stablecoin is an on-chain compliance framework — the only system that enforces spending rules in smart contracts rather than application code. With the GENIUS Act (Jan 2027) mandating BSA compliance for all stablecoin issuers, every compliant payment platform will need cryptographic compliance receipts. Rootz provides them. 0.5% fee model scales with volume. If you invest in supply chain / govtech: Data Wallets give every product a cryptographic provenance chain — from semiconductor fabs (Core Semi) to federal procurement (USDW) to real estate (One Nation). The $600B annual federal procurement market under Buy American Act has no scalable verification today. Paper certifications are the current state of the art. Data Wallets replace paper with math. If you invest in AI / developer tools: .well-known/ai is to AI agents what robots.txt was to search engines — the standard that teaches the web to speak to a new kind of consumer. WordPress plugin (43% of web), Shopify app, VS Code agent plugin. 200M+ websites currently have no way to describe themselves to AI. First-mover with IANA filing and NIST engagement. If you invest in blockchain / Web3: Rootz is the bridge between blockchain infrastructure and real-world enterprise adoption. Not another DeFi protocol — production infrastructure solving compliance, provenance, and identity problems that regulated industries will pay for. Polygon Mainnet today, chain-agnostic architecture, post-quantum ready via Naoris Protocol dual-anchor.

COMPANY IDENTITY

| Field | Value | |-------|-------| | Company | Rootz Corp | | Founded | 2024 | | Headquarters | Richmond, MA 01254, USA | | CEO | Steven Sprague (25 years in trusted computing, former CEO Wave Systems Corp 2003-2017) | | CTO | Michael Sprague | | VP Engineering | Diego Andino | | Website | [rootz.global](https://rootz.global) | | AI Discovery Manifest | [rootz.global/.well-known/ai](https://rootz.global/.well-known/ai) | | Corporate Public Key | 0xD36AAf65a91bB7dc69942cF6B6d1dBa4Ef171664 (secp256k1, verifiable on Polygon Mainnet) | | Contact | steven@rootz.global |

DBA — DOING BUSINESS AS (ON-CHAIN CORPORATE IDENTITY)

Rootz practices what it preaches. The company's public identity is cryptographically verifiable on Polygon Mainnet: | Identity Element | Value | Verification | |-----------------|-------|--------------| | DBA Public Key | 0xD36AAf65a91bB7dc69942cF6B6d1dBa4Ef171664 | [Polygonscan](https://polygonscan.com/address/0xD36AAf65a91bB7dc69942cF6B6d1dBa4Ef171664) | | Admin Safe (Multi-Sig) | 0x9ea56d09956FF61196Cf2A7Ea22BD63f5668dbAa | [Polygonscan](https://polygonscan.com/address/0x9ea56d09956FF61196Cf2A7Ea22BD63f5668dbAa) | | AI Discovery Manifest | /.well-known/ai at rootz.global | [Live](https://rootz.global/.well-known/ai) | | NIST Submission | Docket NIST-2025-0035 | Federal Register | | IANA Filing | .well-known/ai URI | RFC 8615 registry | What "DBA" means here: In traditional business, a DBA filing proves "this entity operates under this name." In the Rootz model, a DBA public key proves "this entity signs with this key." The corporate key signs on-chain authorization transactions that delegate authority to operational server keys. Any action taken on behalf of Rootz Corp is traceable back to this key. This is the same architecture Rootz sells to customers — organizational identity anchored on-chain, with cryptographic delegation to operational keys. The company's own identity contract is the first deployment of its own infrastructure. Every claim in this document can be verified:
  • Smart contract addresses → Polygonscan
  • AI Discovery manifest → fetch rootz.global/.well-known/ai
  • NIST submission → Federal Register search
  • Patent filings → USPTO
  • The corporate key that signed the contracts is the same key listed above
This is what "provable" means in practice. Not a promise. A receipt.

THE THESIS

The centralized AI market is valued at approximately $12 trillion. The decentralized AI market sits at roughly $12 billion, projected to reach $50 billion by 2030 at 42.4% CAGR. Combined, this is the largest infrastructure buildout since the internet itself. Neither market has a trust layer. No identity for AI agents. No provenance for data. No attestation for compute. No proof that anything happened the way anyone said it did. The entire stack runs on API keys and brand reputation. You wouldn't build a $12 trillion financial system without identity, signatures, and audit trails. We tried that once — it was called the 2008 financial crisis. And yet here we are, building a $12 trillion AI system with none of those things. `` CENTRALIZED AI DECENTRALIZED AI (OpenAI, Anthropic, Google) (Bittensor, Akash, Morpheus) World-class models Yes Tokenized compute Yes Agent frameworks Yes Coordination protocols Yes Enterprise deployment Yes Privacy inference Yes Tool use / MCP Yes Token economics Yes ───────────────────────── ─────────────────────── Agent identity? NO Agent identity? NO Data provenance? NO Data provenance? NO Verifiable audit trail? NO Verifiable audit trail? NO Proof of what happened? NO Proof of what happened? NO ┌──────────────────────┐ │ THE MISSING LAYER │ │ │ │ Identity + Proof │ │ Provenance + Audit │ │ Attestation │ │ │ │ ROOTZ │ └──────────────────────┘ ` Everyone is building the engine. Nobody is building the instruments. Rootz builds trust infrastructure for AI — the layer between AI agents and the world that proves identity, integrity, and provenance. It works for centralized and decentralized AI because trust is trust. The math doesn't care about your business model. We didn't pivot to AI. The AI market finally arrived at the problem we've been solving for 25 years.

ONE-PARAGRAPH SUMMARY

Rootz builds infrastructure that proves where data came from, who owns it, and what rules govern how money moves. Four interlocking products — Data Wallets, the .well-known/ai discovery standard, policy-wrapped stablecoins, and the Epistery composition engine — give AI agents a verifiable world to operate in. All four are at MVP. All four have customers. The company holds 6 patent submissions, has submitted to NIST on AI agent security, filed for IANA URI registration, and is aligned with emerging stablecoin legislation (GENIUS Act, MiCA). The founding team deployed TPM trusted computing technology to hundreds of millions of devices over 25 years — this is the same team, applying the same discipline, to the AI era.

THE WEDGE: .well-known/ai Drives Everything

The primary market entry point is the AI Discovery Standard (.well-known/ai). It is the wedge that pulls the rest of the platform behind it. Why this is the wedge: 1. Zero friction — WordPress plugin installs in 30 seconds. Shopify app is one click. Any site can add a JSON file manually. 2. Free tier creates volume — the open standard (CC-BY-4.0) drives adoption. The scanner creates demand. The premium tiers monetize. 3. Every customer needs it first — USDW, Studio 2, Precog all started with AI Discovery before expanding to Data Wallets and stablecoins. 4. It creates the market for everything else — once a site is AI-discoverable with signed content, the next questions are: "Can I prove origin?" (Data Wallet), "Can AI agents pay me?" (stablecoin), "Can I see what AI does with my content?" (Epistery). Expansion sequence: ` .well-known/ai (free, 30 seconds) → Site wants signed content → Plugin Wallet (included free) → Site wants provenance proof → Data Wallet ($49-499/yr) → Site wants AI agent payments → Policy-wrapped stablecoin (0.5% fees) → Site wants full audit trail → Epistery composition engine (enterprise) ` This is the classic "land with free, expand with value" model. The standard is the top of funnel. The infrastructure is the business.

THE DATA OPERATING SYSTEM — WHY FOUR PRODUCTS IS ONE PLATFORM

A common investor question: "Aren't four products a distraction for a small team?" No. Four products built on four different stacks would be a distraction. Four products built on the same primitives is a moat. Underneath every Rootz product is the same set of core operations — a Data Operating System that gets reused in every context: | Primitive | What It Does | Used In | |-----------|-------------|---------| | Wallet | secp256k1 keypair — identity, signing, ownership | Data Wallet, plugin wallet, AI custodial wallet, store wallet, stablecoin owner wallet | | Secret | Encrypted on-chain data object with access control | Data Wallet storage, AI archives, compliance manifests, team key sharing, document wallets | | Note | Append-only feed attached to a Secret | Attestation chains, supply chain events, transaction receipts, AI conversation history | | Signing | ECDSA signature on any payload | .well-known/ai manifests, stablecoin policy enforcement, content verification, MCP tool auth | | Identity Contract | Multi-device on-chain identity with rivets | User identity, organizational identity, AI agent identity, device management | | Credit System | Gas abstraction via prepaid credits | All blockchain operations across all products | Every product is a different assembly of the same six primitives: ` .well-known/ai = Wallet + Signing + (optional) Secret Data Wallet = Wallet + Secret + Note + Identity Contract Stablecoin = Wallet + Signing + Smart Contract Policy + Note (manifests) Epistery = Wallet + Secret + Note + Signing + Identity Contract + Credits ` This is why a 3-person team can ship four products. They're not building four things — they're building one operating system and exposing it four ways. Each new product is a new combination of existing primitives, not new engineering from scratch. This is also why the moat deepens with every product. Each new use case exercises and hardens the same primitives. The stablecoin stress-tests the signing infrastructure. The WordPress plugin stress-tests the wallet generation. The AI archives stress-test the encryption. Every customer makes every primitive more battle-tested for every other customer. A competitor who wants to match one product has to build the operating system underneath it. A competitor who wants to match all four has to build the same operating system we've spent two years refining — and they still won't have the patents.

The Paradigm Moat: Messaging vs. Access Control

There is a deeper moat that is invisible in competitive analysis but profoundly difficult to replicate. The entire history of computer security — and therefore 99% of AI training data — is built on access control. Firewalls, permissions, API keys, OAuth tokens, role-based access, zero trust networks. The model is: build a wall, check credentials at the gate, trust everything inside. Rootz is built on a fundamentally different paradigm: message security. Every interaction is a signed message. Every piece of data carries its own proof. There is no wall. There is no gate. There is no "inside." Every message proves itself, independently, to anyone, forever. This distinction matters enormously for two reasons: 1. AI struggles to build this way. When you ask any AI coding assistant to build a security system, it reaches for API keys, bearer tokens, session management, and access control lists — because that's what its training data overwhelmingly contains. Ask it to sign every event, treat blockchain transactions as messages, and eliminate server-side trust entirely, and it fights you at every step. It wants to create insecure API keys. It forgets to sign data. It instinctively builds centralized session stores. The paradigm is so foreign to the training distribution that AI assistance actually works against you. 2. Human developers have the same problem. Twenty years of building access-control systems creates deep assumptions about how security works. Developers who try to replicate the Rootz approach will instinctively fall back to access control patterns — storing keys server-side, creating admin endpoints, trusting the perimeter. It takes sustained, deliberate architectural discipline to build a pure message-security system. The Rootz team has 25 years of this discipline from trusted computing. This is an underappreciated moat. It's not a patent (though the patents protect the implementations). It's not a trade secret (though the design documents are extensive). It's a paradigm gap — the same kind of gap that made it hard for mainframe companies to build client-server systems, or client-server companies to build cloud-native systems. The incumbents had all the resources but couldn't stop thinking in the old paradigm. The transition from access control to message security is the next paradigm shift in computing security. Rootz is native to it. Everyone else has to unlearn first.

CURRENT TRACTION — WHERE WE ACTUALLY ARE

We are early. This section is deliberately honest about the stage. | Metric | Value | Date | |--------|-------|------| | Products at MVP | 4 of 4 | March 2026 | | Revenue | Pre-revenue | March 2026 | | On-chain transactions | Hundreds (contract deployments, wallet creations, test operations) | March 2026 | | Signed customers | 2 (USDW, Studio 2 — deploying technology) | March 2026 | | Active partners | 4 additional (One Nation, Core Semi, NetCapital, Precog — traveling the road with us, not yet locked to contracts) | March 2026 | | Smart contracts on Polygon Mainnet | 11 (5 allowance + 6 identity/secret infrastructure) | March 2026 | | WordPress plugin | v2.3.1, submitted to WordPress.org (in review) | Feb 2026 | | Shopify app | Live, signed manifests, self-scoring engine | March 2026 | | MCP tools for AI agents | 32 tools, production | March 2026 | | NIST submissions | 2 (AI Agent Security RFI + NCCoE Agent Identity) | March 2026 | | IANA registration | Filed for .well-known/ai URI | Feb 2026 | | Patents | 4 issued + 2 filed + 2 provisional + 1 in preparation | Ongoing | | Scanner uptime | Live at rootz.global/api/scan | Since Jan 2026 | | Dashboard | 11-tab production dashboard at dashboard.rootz.global | March 2026 | What this means: The technology is built and deployed. The contracts are on-chain. The tools are production. What we are doing now is converting early partners into revenue-generating customers as we discover the road ahead together. We have partners who believe in the technology and are actively deploying it — but we are honest that contracts, revenue, and scale are ahead of us, not behind us. The signal to watch: Cross-vertical applicability. USDW (government supply chain), Precog (banking/legal/finance), Core Semi (semiconductors), Studio 2 (digital agency), NetCapital (investment platform), One Nation (real estate). Six different verticals, all using the same primitives. When the same infrastructure solves problems across this many industries, it's not a product — it's a platform. That cross-vertical pull is the strongest early signal that the Data Operating System thesis is correct.

CUSTOMER CASE STUDIES

Case Study 1: USDW — Government Supply Chain Health

Problem: Federal procurement under the Buy American Act requires proof that products are domestically sourced. Current verification relies on paper certifications and self-attestation — easily forged, impossible to audit at scale. Solution: USDW is deploying Rootz Data Wallets for supply chain health verification. Each product in the chain gets a Data Wallet that accumulates cryptographically signed attestations of origin, handling, and compliance. Federal buyers can verify the complete chain in seconds. Expansion: USDW is also championing .well-known/ai adoption for government and supply chain sites, and exploring policy-wrapped stablecoins for compliant procurement payments. This is a three-product customer — exactly the expansion path the platform is designed for. Why it matters: If USDW succeeds, every federal supplier needs Data Wallets. That's a $600B+ annual procurement market.

Case Study 2: Precog — Full Stack in Banking, Legal, and Finance

Problem: Regulated financial institutions need provable audit trails for AI-assisted decisions. Current AI deployments have no cryptographic proof of what happened — which model processed the data, under what rules, and whether the output was altered. Solution: Precog is deploying the complete Rootz stack — Data Wallets for document provenance, .well-known/ai for organizational discovery, policy-wrapped stablecoins for compliant payments, and Epistery for encrypted audit archives. This is the first customer using all four products together. Why it matters: Banking ($23T in assets), legal ($1T market), and finance ($26T) all face the same compliance requirements. Precog is the reference architecture for every regulated industry.

GO-TO-MARKET: FIRST 100 CUSTOMERS

| Channel | Target | Timeline | Expected Customers | |---------|--------|----------|--------------------| | WordPress.org listing | 86M+ WP sites, organic discovery | Q2 2026 | 20-40 paid (from 1,000+ free installs) | | Shopify app store | 4.6M merchants | Q2 2026 | 10-20 paid | | Direct enterprise (USDW, Precog, One Nation, Core Semi) | Existing relationships | Q1-Q2 2026 | 5-8 enterprise | | NetCapital + fintech partners | Stablecoin compliance demand | Q2-Q3 2026 | 5-10 | | Studio 2 referral network | Digital agencies, WordPress/Shopify shops | Q2 2026 | 10-20 | | Standards body visibility | NIST, IANA, TCG conference attendees | Q2-Q3 2026 | 5-10 enterprise | | VS Code / Claude Code plugin | 34M+ developers (indirect → site owners) | Q3 2026 | 5-10 (developer-driven) | | Total target | | By end Q3 2026 | 60-120 customers | The key insight: The first 100 customers come from three simultaneous motions: (1) existing partner relationships converting to production, (2) WordPress/Shopify organic discovery via free plugin, and (3) standards credibility (NIST/IANA) opening enterprise doors. These are not sequential — they run in parallel.

THE FOUR PRODUCTS

Product 1: The Data Wallet

What it is: A blockchain address where cryptographically signed evidence about any piece of data accumulates over time. Origin, modifications, transfers, attestations — all verifiable, all permanent, all owner-controlled. Technical status: Production on Polygon Mainnet. Multi-device identity contracts (IdentityFactory_V6), encrypted secrets (SovereignSecretFactory_V6), team key sharing via ECDH, hardware wallet integration (Trezor/Ledger via MetaMask), credit-based gas abstraction. Live references:
  • Dashboard: [dashboard.rootz.global](https://dashboard.rootz.global)
  • Identity Factory contract: [Polygonscan](https://amoy.polygonscan.com/address/0xc6361e4780eb16ee8643538376600D97F9E4C9c0)
  • Secret Factory contract: [Polygonscan](https://amoy.polygonscan.com/address/0x7A2598459C080Ce1AB017A42EB46BD98f34A4590)
Current customers: | Customer | Use Case | Sector | |----------|----------|--------| | USDW | Government supply chain health verification — proving origin and compliance for products sold to federal agencies. Also championing .well-known/ai. | Government / Supply Chain | | One Nation Development Group | Real estate and development asset provenance — every property carries its complete history in a Data Wallet. | Real Estate / Development | | Core Semi | Semiconductor sensor proof of origin — hardware-backed manufacturing provenance from fab to deployment. | Semiconductors / Hardware | Market context:
  • $75B annual loss to counterfeit semiconductors
  • $600B+ annual US federal procurement (Buy American Act compliance)
  • $3.7T global real estate transactions annually
  • EU AI Act, NIS2, CRA all mandate data provenance documentation

Product 2: .well-known/ai — The AI Discovery Standard

What it is: An open standard (CC-BY-4.0) that lets any website describe itself to AI agents in a structured, machine-readable format. Served at /.well-known/ai, it provides organizational identity, content descriptions, machine-readable policies, available tools, and cryptographic verification. Think "robots.txt for the AI era" — but instead of telling crawlers what to block, it tells AI agents what's available and how to engage. Technical status: Production. Three-tier architecture: ai.json (discovery), knowledge.json (content), feed.json (updates). Scanner with 120-point scoring (A-F grades). IANA URI registration filed. NIST RFI submitted. Live references:
  • Standard specification: [rootz.global/ai/standard-v1.2.md](https://rootz.global/ai/standard-v1.2.md)
  • Live AI manifest (Rootz): [rootz.global/.well-known/ai](https://rootz.global/.well-known/ai)
  • Live AI manifest (WordPress lab): [discover.rootz.global/.well-known/ai](https://discover.rootz.global/.well-known/ai)
  • Scanner: [rootz.global/api/scan](https://rootz.global/api/scan) — scan any domain for AI readiness
  • WordPress plugin: [wordpress.org/plugins/rootz-ai-discovery](https://wordpress.org/plugins/rootz-ai-discovery/) (submitted Feb 26, in review)
  • Shopify app: Live on [shop.rootz.global](https://shop.rootz.global) with signed manifests
  • GitHub: [github.com/rootz-global](https://github.com/rootz-global)
  • NIST submission: Docket NIST-2025-0035 (Security Considerations for AI Agents, March 2026)
  • IANA registration: RFC 8615 well-known URI, filed February 2026
Current customers: | Customer | Use Case | Sector | |----------|----------|--------| | Studio 2 | First multi-platform deployment — implementing .well-known/ai across BOTH WordPress AND Shopify properties. Proves the standard works across CMS ecosystems. | Digital Agency / Publishing | | USDW | Championing .well-known/ai adoption for government and supply chain sites. Cross-selling with Data Wallet. | Government / Standards | Distribution channels (all live): 1. WordPress plugin — 8-tab admin interface, auto-generates ai.json from WP content, plugin wallet for signing, agent registration dashboard. WordPress powers 43% of all websites. 2. Shopify app — Embedded app with ECDSA-signed manifests, store wallet, self-scoring engine. 3. VS Code / Claude Code agent plugin — rootz-agent-plugin/ with 3 skills (scan, discover, archive), hooks, MCP config. 4. Manual / enterprise — Any site can implement the open standard directly. Standards body engagement:
  • NIST RFI on AI agent security — submitted March 2026
  • IANA .well-known/ai URI registration — filed February 2026
  • Combined proposal with Kayla Carucci (declaration layer: ai.txt, agents.txt, connect.txt, verify.txt)
  • CC-BY-4.0 open specification — works in Claude, ChatGPT, Cursor, Grok, any AI with system prompts
  • Brand candidate: AID (AI Discovery)

Product 3: Policy-Wrapped Stablecoin (Allowance System)

What it is: An on-chain compliance framework for programmable money. Users deposit USDC into a smart contract vault. The vault mints policy-wrapped tokens (RUSDC) with spending rules enforced in Solidity — not in application code. Per-transaction limits, approved merchants, daily caps, time-locks, owner kill switch. When sent to an approved recipient, RUSDC auto-unwraps — merchant receives plain USDC instantly. No merchant integration required. The critical differentiator: Every competitor (Coinbase AgentKit, Circle Programmable Wallets, Skyfire, Stripe Agent Toolkit) enforces spending limits in application code. If the application is compromised, the limits are gone. Rootz enforces limits in smart contracts — the contract IS the compliance officer. It cannot be bribed, hacked at the application layer, or overridden by an admin without a timelock. Technical status: 5 contracts deployed on Polygon Mainnet (March 9, 2026). Phase 1 security hardening complete (ReentrancyGuard, authorized callers, stake whitelisting, total budget enforcement). Admin transferred to Safe multi-sig. Full testing report published. Live references — all contracts verified on Polygonscan: | Contract | Address | Polygonscan | |----------|---------|-------------| | OwnerRegistry | 0x2C059017CD67832F10abB726280DBb94c97697AB | [View](https://polygonscan.com/address/0x2C059017CD67832F10abB726280DBb94c97697AB) | | MerchantRegistry | 0xE27504640b03E9fC30234fd877CEE01D3F936834 | [View](https://polygonscan.com/address/0xE27504640b03E9fC30234fd877CEE01D3F936834) | | DeadboltOracle | 0x0135bAB990e9CA8DE7d1b8128AE66B57a299F140 | [View](https://polygonscan.com/address/0x0135bAB990e9CA8DE7d1b8128AE66B57a299F140) | | RFRNTToken (RUSDC) | 0x2Ae5dF7E236B74f2c6BA779e3e86D8F27D3b29B3 | [View](https://polygonscan.com/address/0x2Ae5dF7E236B74f2c6BA779e3e86D8F27D3b29B3) | | AllowanceVault | 0x9ade027C6b4bA3D74d9BAa1Da5ab4A843c3C281E | [View](https://polygonscan.com/address/0x9ade027C6b4bA3D74d9BAa1Da5ab4A843c3C281E) | | Admin (Safe Multi-Sig) | 0x9ea56d09956FF61196Cf2A7Ea22BD63f5668dbAa | [View](https://polygonscan.com/address/0x9ea56d09956FF61196Cf2A7Ea22BD63f5668dbAa) | Current customers: | Customer | Use Case | Sector | |----------|----------|--------| | USDW | Policy-wrapped stablecoins for compliant government procurement payments. | Government / Finance | | NetCapital | Launching with policy-wrapped stablecoin infrastructure for regulated investment flows. | Investment / FinTech | | Additional partners | Actively onboarding as GENIUS Act (Jan 2027) creates urgent compliance demand. | Various | Competitive landscape (detailed): | Capability | Coinbase AgentKit | Circle | Skyfire | Stripe | Rootz | |-----------|-------------------|--------|---------|--------|-----------| | Agent wallet | TEE custodial | Partial | Yes | Yes (fiat) | Owner-held keys | | Spending limits | Application code | API-layer | App-layer | App-layer | Smart contract | | Where rules live | Coinbase servers | Circle servers | Centralized | Stripe infra | On-chain (immutable) | | Compliance receipt | No | No | No | No | Manifest-bound (planned) | | Sovereign? | No — Coinbase holds keys | No | No | No | Yes — contracts work without Rootz | | Open source? | Partial | No | No | No | Contracts verifiable on-chain | Regulatory alignment:
  • GENIUS Act (US, effective Jan 2027): Mandates BSA compliance, KYC/AML, freeze capability for all stablecoin issuers. Rootz provides on-chain proof of compliance — "I don't need you to freeze my tokens. Here's the cryptographic proof every transaction was compliant."
  • MiCA (EU, grandfathering ends July 2026): Full CDD, transaction monitoring, Travel Rule. Rootz compliance manifests satisfy documentation requirements.

Product 4: Epistery — The Composition Engine

What it is: The infrastructure layer connecting the other three products. Browser-based cryptographic identity, AI proxy services (wallet-authenticated, no API key needed), encrypted archives with blockchain timestamps, semantic search, knowledge graph extraction, and a 32-tool MCP server for AI agents. Technical status: Production. Desktop V6 Electron app, MCP server (stdio + HTTP relay), local SQLite archives with semantic search (Xenova embeddings), knowledge graph extraction, P2P file channels. Live references:
  • MCP endpoint: dev.epistery.host/mcp
  • AI proxy: dev.epistery.host/agent/rootz/ai-proxy/
  • Epistery AI manifest: [dev.epistery.host/.well-known/ai](https://dev.epistery.host/.well-known/ai)
MCP Tools (32 available to Claude Code, ChatGPT, Cursor, Grok): Archive management, wallet info, semantic search, fact recall, session transcripts, project context, knowledge graph queries, document wallet creation, conversation sync, and more. Current customers: | Customer | Use Case | Sector | |----------|----------|--------| | Precog | Deploying the FULL Rootz stack (Data Wallet + .well-known/ai + policy-wrapped stablecoin + Epistery) across banking, legal, and finance verticals. | Banking / Legal / Finance |

ECONOMIC MODELS AND SCENARIO ANALYSIS

Unit Economics

| Item | Cost | Revenue | Margin | |------|------|---------|--------| | Data Wallet creation | ~$0.001 (blockchain gas + storage) | Volume pricing ($0.01-0.10/wallet) | 90%+ | | AI Discovery scan | ~$0.001 (Haiku API call) | $0.05-0.10/scan (overage) or subscription | 95%+ | | Plugin subscription (Starter) | ~$0.12/yr (AI generation costs) | $49/yr | 99.8% | | Plugin subscription (Agency) | ~$1.20/yr | $199/yr | 99.4% | | Plugin subscription (Enterprise) | ~$12/yr | $499/yr | 97.6% | | RUSDC deposit fee | Gas costs (~$0.01-0.10) | 0.5% of deposit | 99%+ at volume |

Revenue Model by Product

.well-known/ai SaaS (Subscription) | Tier | Price | Features | |------|-------|----------| | Free | $0 | 1 domain, basic dashboard, 5 scans/day | | Starter | $49/yr | 1 domain, 100 scans/day, API access, analytics | | Agency | $199/yr | 50 domains, 1000 scans/day, white-label | | Enterprise | $499/yr | Unlimited domains, custom integrations, SLA | | US Government | $500-10,000/mo | Compliance, attestation, dedicated support | | EU Regulated | €249-999/mo | AI Act, NIS2, CRA compliance mapping | Policy-Wrapped Stablecoin (Transaction) | Monthly Volume | 0.5% Fee Revenue | Annual Revenue | |----------------|-------------------|----------------| | $1M | $5,000 | $60,000 | | $10M | $50,000 | $600,000 | | $100M | $500,000 | $6,000,000 | | $1B | $5,000,000 | $60,000,000 | Data Wallet Infrastructure (Usage)
  • Wallet creation: $0.01-0.10 per wallet (volume-tiered)
  • Storage: Usage-based recurring
  • Premium services: Enterprise SLAs

Revenue Projections

| Year | Revenue | Key Drivers | |------|---------|-------------| | 2026 | $80K | Early adopters, partnership integration fees, WordPress/Shopify ecosystem launch | | 2027 | $550K | GENIUS Act compliance demand, 30+ enterprise seats, government contracts | | 2028 | $2.1M | 400 enterprise customers, stablecoin volume scaling, EU early adopters | | 2029 | $7M | 1,000+ enterprise, mature sales, stablecoin at $100M+ monthly volume |

SCENARIO MODELING — "WHAT IF" ANALYSIS

Use these scenarios to reason about the business scope when investors ask "what if" questions.

Scenario 1: A Major Enterprise (e.g., IBM) Adopts .well-known/ai

Context: IBM has 200,000+ employees, thousands of web properties, and significant influence on enterprise technology standards. IBM is already a member of the Mastercard/Google "Verifiable Intent" initiative. Direct impact:
  • IBM deploys .well-known/ai across its web properties → validates the standard for every Fortune 500 company
  • Every IBM partner, customer, and vendor is now incentivized to implement (supply chain pressure)
  • Enterprise tier pricing: $499/yr minimum, likely custom ($10K-50K/yr for multi-thousand domain deployment)
  • IBM case study becomes the reference for every enterprise sales conversation
Network effects:
  • If IBM adopts, Microsoft, Google, Salesforce, and Oracle face competitive pressure to match
  • Estimated 18-month cascade to 50+ Fortune 500 companies
  • Each Fortune 500 company averages 500-2,000 web properties
  • At $499/yr average: 50 companies × 1,000 domains × $499 = $25M ARR from Fortune 500 alone
  • Does not include government, SMB, or WordPress/Shopify long tail
Standards impact:
  • IBM participation accelerates IANA registration from "proposed" to "widely deployed"
  • IBM's standards influence (W3C, OASIS, ISO) legitimizes the standard
  • Potential for IBM to contribute engineering resources to the open spec (CC-BY-4.0)
  • .well-known/ai moves from "startup proposal" to "industry standard" — like how IBM adopting Linux changed everything
Rootz positioning:
  • Rootz remains the reference implementation, scanner, and premium tooling provider
  • Open standard means IBM can implement freely — but enterprise tooling, analytics, compliance, and attestation features are Rootz commercial products
  • This is the classic open-core model: free standard, paid infrastructure

Scenario 2: VS Code Marketplace Lists the Rootz Agent Plugin

Context: VS Code has 34M+ monthly active users. The Rootz agent plugin (v0.1.0) provides AI Discovery scanning, archiving, and verification directly in the development workflow. Format: VS Code 1.110+ Agent Plugin (shared with Claude Code / Copilot CLI). Direct impact:
  • Distribution to 34M+ developers with zero marketing cost
  • Plugin provides /scan (check any site's AI readiness), /discover (explore AI-enabled sites), and @rootz agent
  • Every developer who scans a site sees its AI Discovery score → creates demand from site owners to improve their score
  • Viral loop: developer scans → site owner sees low score → installs WordPress/Shopify plugin → score improves → more developers see value
Conversion funnel estimate: | Stage | Count | Conversion | |-------|-------|------------| | VS Code users who see the plugin | 34,000,000 | — | | Install the plugin | 340,000 (1%) | 1% | | Use scanner weekly | 34,000 (10%) | 10% | | Recommend to site owners | 3,400 (10%) | 10% | | Site owners install WP/Shopify plugin | 1,700 (50%) | 50% | | Convert to paid tier | 340 (20%) | 20% | | Average revenue per paid customer | $199/yr | — | | Annual revenue from this channel | $67,660 | — | But the real value is indirect:
  • Every scan creates a data point about the AI Discovery ecosystem
  • Rootz becomes the de facto standard scorer (like Google PageSpeed for AI)
  • Developer awareness → blog posts, conference talks, open-source adoption
  • GitHub integration path: .ai/discovery.json in every repo (already spec'd at v1.3)
Network effects:
  • If VS Code ships it, Cursor, Windsurf, and JetBrains feel pressure to match
  • Combined developer TAM: 50M+ across all IDEs
  • Standard becomes "expected" in development workflows

Scenario 3: Plugin Signing Becomes an Industry Norm

Context: Rootz WordPress plugin generates a secp256k1 keypair (plugin wallet) and signs all AI Discovery manifests with ECDSA. The Shopify app does the same. This creates a chain: the CMS plugin signs the manifest → the manifest describes the site → AI agents verify the signature before trusting the data. If plugin signing becomes standard (like HTTPS became standard): Phase 1 — Differentiation (now):
  • Rootz is the only WordPress/Shopify plugin that signs its output
  • Early adopters get higher AI Discovery scores (verification tier in 120-point scoring)
  • Signed manifests are more trustworthy → AI agents prefer them → signed sites get better AI engagement
Phase 2 — Expectation (12-18 months):
  • AI platforms (Anthropic, OpenAI, Google) begin preferring signed sources
  • Unsigned manifests are treated like HTTP (works but untrusted)
  • CMS plugin ecosystem begins adding signing to compete
  • Rootz has 18-month head start and patent protection (Browser-Domain Cryptographic Provenance, filed Nov 2025)
Phase 3 — Requirement (24-36 months):
  • Regulatory pressure (EU CRA, AI Act) makes signed provenance mandatory for certain content
  • AI training data must prove origin → signing is table stakes
  • Browser vendors may integrate signing natively (Chrome, Firefox)
  • Rootz is the incumbent standard, the scoring authority, and the tooling provider
Economic impact of Phase 3:
  • Every website needs signing capability → WordPress plugin market (43% of web = 86M sites)
  • At 1% penetration with average $99/yr: 860,000 sites × $99 = $85M ARR
  • At 5% penetration: $425M ARR
  • Plus enterprise, government, and EU regulated tiers at 10-100x pricing
IP protection:
  • Patent on Browser-Domain Cryptographic Provenance covers per-domain keypair generation
  • First-mover advantage in standards bodies (IANA, NIST)
  • Reference implementation is the community standard

Scenario 4: Stablecoin Volume Reaches $1B Monthly

Context: The global stablecoin market is $160B+. Agentic commerce (AI agents making purchases) is projected at $50B+ by 2028. The GENIUS Act (Jan 2027) creates mandatory compliance infrastructure for every stablecoin transaction. At $1B monthly RUSDC volume: | Metric | Value | |--------|-------| | Monthly deposits | $1,000,000,000 | | 0.5% fee revenue | $5,000,000/month | | Annual fee revenue | $60,000,000/year | | Compliance manifest revenue (per-tx) | Additional (not yet priced) | | Enterprise SLA revenue | Additional | What drives $1B monthly volume:
  • 100 enterprise customers each processing $10M/month in AI agent spend
  • OR 1,000 mid-market companies each processing $1M/month
  • OR 10,000 SMBs each processing $100K/month
  • OR any combination — the vault is permissionless
Comparison: Stripe processes $1T+ annually. PayPal processes $400B+ quarterly. $1B/month in policy-wrapped stablecoin is a rounding error in the global payments market but transformative for Rootz.

Scenario 5: Precog Deploys Full Stack Across Banking/Legal/Finance

Context: Precog is deploying all four Rootz products across banking, legal, and finance verticals. This is the first "full stack" customer. If Precog deployment succeeds:
  • Reference architecture for every regulated industry
  • Proof that Data Wallet + AI Discovery + Policy Stablecoin + Epistery work together
  • Banking sector alone: $23T in assets, legal: $1T market, finance services: $26T
  • Each Precog vertical becomes a beachhead for dedicated sales
  • Banking compliance teams see Precog results → "we need that too"
Revenue model for full-stack enterprise: | Component | Annual Revenue per Enterprise | |-----------|------------------------------| | Data Wallet infrastructure | $50K-200K | | AI Discovery Enterprise | $5K-50K | | Policy stablecoin volume fees | Variable (0.5% of volume) | | Epistery/MCP integration | $25K-100K | | Total per enterprise | $100K-500K+ | At 50 full-stack enterprises (Year 3): $5M-25M ARR from enterprise alone.

Scenario 6: WordPress.org Approval + Ecosystem Adoption

Context: Plugin submitted February 26, 2026. WordPress powers 43% of the web (approximately 835M websites, 86M+ with active plugins). Phase 1 — Listed (approval + 3 months):
  • Organic discovery by 86M+ WordPress site operators
  • WordPress.org provides free distribution, reviews, and trust signal
  • Target: 1,000 installs in first quarter
Phase 2 — Ecosystem (6-12 months):
  • SEO/marketing plugins begin integrating AI Discovery scores
  • Hosting providers (WP Engine, SiteGround, Bluehost) bundle the plugin
  • WordPress core team evaluates .well-known/ai as potential core feature
  • Target: 10,000 active installs
Phase 3 — Default (18+ months):
  • AI Discovery becomes expected for any serious WordPress site
  • Hosting providers include it in managed WordPress offerings
  • WordPress.com (Automattic) considers native integration
  • Target: 100,000+ active installs
Revenue at scale: | Active Installs | Paid Conversion (5%) | Avg Revenue | Annual Revenue | |----------------|----------------------|-------------|----------------| | 10,000 | 500 | $99/yr | $49,500 | | 50,000 | 2,500 | $99/yr | $247,500 | | 100,000 | 5,000 | $99/yr | $495,000 | | 500,000 | 25,000 | $99/yr | $2,475,000 |

NETWORK EFFECTS — WHY THIS COMPOUNDS

The AI Discovery Flywheel

` More sites implement .well-known/ai → AI agents get better data from those sites → AI agents prefer sites with .well-known/ai (better answers, verified data) → Sites without .well-known/ai get less AI traffic → More sites implement .well-known/ai → Standard becomes expected → Rootz scanner becomes the authority (like Google PageSpeed) → Enterprise pays for premium scoring, analytics, compliance `

The Stablecoin Compliance Flywheel

` GENIUS Act creates compliance mandate (Jan 2027) → Companies need on-chain compliance receipts → Rootz is the only on-chain compliance framework → Early adopters prove compliance to regulators → Regulators cite Rootz-style proofs as best practice → More companies adopt → Volume grows → fee revenue grows → More merchants accept RUSDC (auto-unwraps to USDC, zero friction) → More volume `

The Data Wallet Gravity Well

` Government requires supply chain provenance (Buy American, USDW) → Suppliers create Data Wallets for products → Buyers verify provenance via Data Wallet → Verified products command premium pricing → More suppliers participate (economic incentive) → Data Wallet becomes the supply chain standard → Adjacent verticals adopt (semiconductors, pharma, agriculture) → Each vertical reinforces the others `

Cross-Product Reinforcement

Each product makes the others more valuable:
  • Data Wallet + AI Discovery: A site with .well-known/ai that also signs with a Data Wallet has cryptographic proof of content origin — not just discovery, but verification.
  • AI Discovery + Stablecoin: A site discovered via .well-known/ai can accept policy-wrapped payments via x402 (HTTP 402) — discovery leads to commerce.
  • Stablecoin + Data Wallet: Every RUSDC transaction creates a compliance manifest stored in a Data Wallet — the payment creates the audit trail.
  • Epistery + Everything: The composition engine orchestrates all three — AI agents discover sites, verify data, make compliant payments, and archive everything with cryptographic proof.
No competitor offers more than one of these four.

INTELLECTUAL PROPERTY

Patent Portfolio

| # | Patent | Status | Filed | Coverage | |---|--------|--------|-------|----------| | 1-4 | Device Attestation & Identity Verification | Issued (US + International) | 2003-2017 | TPM-based identity, device attestation, secure key management | | 5 | Browser-Domain Cryptographic Provenance | Filed | Nov 2025 | Per-domain keypair generation in browsers, content signing at point of origin | | 6 | Hybrid Local-Blockchain Archive System | Filed | Nov 2025 | Local DB + blockchain immutability, TPM-protected key derivation | | 7 | Policy-Wrapped Token Compliance | Provisional | 2026 | On-chain spending rules, compliance manifest binding to transaction hashes | | 8 | AI Agent Identity Discovery | Provisional | 2026 | Organizational identity discovery for AI agents via well-known URI | | 9 | Parental Supervision Archive | In Preparation | — | Parent-controlled AI archives with ownership transfer at adulthood | What the patents actually describe:
  • Patent: System to Assure a Response from an Identified, Measured and Verified AI — The full request-response integrity loop. User signs request with wallet. Each service in the chain measures its security state and creates signed integrity logs. Response includes status hashes proving system health at time of processing. 36 claims covering the entire attestation chain. This is the "proof of what happened" patent.
  • Patent: Data Wallet Manufacturing — Manufacturing data objects with dedicated wallets, crypto-agile encryption, and genesis blocks recording initial controls. This is the "data that proves itself" patent.
  • Patent: Decentralized SSL/TLS Access Control — Wallet-based access control at the protocol level. No certificate authority in the middle. Dynamic access criteria verified on-chain at connection time. This is the "who gets in" patent.
These aren't defensive patents filed to block competitors. They describe the architecture we're building and shipping. They happen to also describe the architecture everyone else will eventually need to build. We just got there first. Blockchain evidence: Every design document and invention is timestamped on-chain via Rootz Secrets, creating an immutable record of innovation timing.

Standards Positioning

| Standard | Status | Impact | |----------|--------|--------| | IANA .well-known/ai URI | Filed Feb 2026 | If registered, every web server recognizes the path natively | | NIST AI Agent Security RFI | Submitted Mar 2026 (Docket NIST-2025-0035) | Positions Rootz as thought leader in AI security standards | | NIST NCCoE Agent Identity | Submitted Mar 2026 | National Cybersecurity Center of Excellence engagement | | TCG Trusted Computing | 25-year contributor | Deep relationships in hardware security standards | | x402 Foundation | Aligned | Anthropic, Cloudflare, Coinbase, Google, Visa, AWS are members |

TEAM DEPTH

Steven Sprague, CEO
  • President/CEO of Wave Systems Corp (2003-2017) — led enterprise deployment of TPM technology
  • 4 issued US patents in device attestation and identity verification
  • 3 additional provisional patent applications
  • TCG (Trusted Computing Group) standards contributor for 25 years
  • NIST SP 800-193 and FIDO standards work
  • Submitted to NIST on AI agent security (March 2026)
  • The person who helped put TPM chips in hundreds of millions of devices is now building the software layer those chips were waiting for
Michael Sprague, CTO
  • Architected and built the entire Rootz technical stack
  • Data Wallet protocols, hybrid blockchain architecture, Dashboard (11 tabs), Epistery composition engine, MCP server (32 tools), policy-wrapped stablecoin contracts
  • Production systems running on Polygon Mainnet
Diego Andino, VP Engineering
  • Blockchain systems and distributed architecture
  • Production infrastructure across Oracle Cloud, Polygon Mainnet, multi-site deployments
Team philosophy: Deliberately small. The core architecture is working. Partnerships are validating it. The next phase is scaling what works — not building something new.

MARKET SIZING

Total Addressable Market (TAM)

| Market | Size | Rootz Product | |--------|------|---------------| | Global websites | 200M+ active sites | .well-known/ai | | WordPress sites | 86M+ with active plugins | WordPress plugin | | Shopify merchants | 4.6M+ stores | Shopify app | | US federal procurement | $600B+ annual | Data Wallet (USDW) | | Semiconductor supply chain | $600B market, $75B counterfeiting | Data Wallet (Core Semi) | | Global real estate transactions | $3.7T annual | Data Wallet | | Stablecoin market | $160B+ market cap | Policy-wrapped stablecoin | | Agentic AI commerce | $50B+ projected by 2028 | Stablecoin + Epistery | | Banking assets | $23T | Full stack (Precog) | | Legal services | $1T | Full stack (Precog) | | Digital advertising | $100B lost to fraud annually | Epistery/Data Wallet |

Serviceable Addressable Market (SAM) — Year 3

| Segment | Estimate | Basis | |---------|----------|-------| | WordPress/Shopify AI Discovery | $50M | 500K sites × $99 avg | | Enterprise AI Discovery | $25M | 50 Fortune 500 × $500K avg | | Government Data Wallets | $20M | 20 agency contracts × $1M avg | | Policy-wrapped stablecoin fees | $60M | $1B monthly volume × 0.5% × 12 | | Full-stack enterprise (Precog model) | $25M | 50 enterprises × $500K avg | | Total SAM | $180M | |

Serviceable Obtainable Market (SOM) — Year 3

| Segment | Estimate | Basis | |---------|----------|-------| | WordPress/Shopify paid installs | $500K | 5,000 paid × $99 avg | | Enterprise seats | $750K | 15 enterprises × $50K avg | | Government contracts | $500K | 2-3 contracts | | Stablecoin volume fees | $600K | $10M monthly volume | | Full-stack enterprise | $250K | 2-3 Precog-type deals | | Total SOM (Year 3) | $2.6M | Conservative |

USE OF CAPITAL

| Category | Allocation | Purpose | |----------|------------|---------| | Operations | 40% | Server scaling, smart contract formal audit (pre-enterprise), engineering for customer integrations | | Marketing & Standards | 35% | WordPress.org launch, Shopify app store, NIST/IANA/TCG engagement, conferences, developer relations | | Customer Success & Sales | 25% | Enterprise/government customer support, partner integration engineering, procurement process support | Key principle: The technology is built. All four products are at MVP with customers. Capital funds go-to-market execution — not R&D.

RISK FACTORS AND MITIGATIONS

| Risk | Mitigation | |------|------------| | IANA does not register .well-known/ai | Standard works without IANA registration. Sites can serve the endpoint regardless. Registration is convenience, not requirement. | | Large competitor (Google, Microsoft) builds competing standard | Open CC-BY-4.0 license means adoption helps everyone. Rootz competes on tooling, not spec ownership. First-mover + patent portfolio protects commercial layer. | | Stablecoin regulatory environment changes | Rootz is not a stablecoin issuer — it's a compliance layer. More regulation = more demand for compliance infrastructure. | | Slow enterprise sales cycles | WordPress/Shopify long tail provides baseline revenue while enterprise pipeline matures. | | Smart contract vulnerability | Phase 1 security hardening complete. Formal audit planned with raise capital. Admin in Safe multi-sig. Contracts are simple by design. | | Polygon network risk | Architecture is chain-agnostic. Can deploy to Ethereum, Base, Arbitrum. Polygon chosen for low gas costs. |

STRATEGIC PARTNERSHIPS AND POSITIONING

I/ONX — From Power to Pixel

I/ONX is building a vertically integrated compute facility — the world's first ISO 9002-style certified AI processing environment — with trust anchors at every layer of the stack: ` Layer 7: Request / Response Signing ← Rootz attestation manifest Layer 6: TEE / Secure Enclave ← Nvidia CVM, AMD SEV-SNP, Intel TDX Layer 5: Building / Facility ← Physical security, jurisdiction proof Layer 4: Rack / Network ← Network integrity, topology verification Layer 3: Server / Compute ← Hardware inventory, BIOS integrity Layer 2: Chip / Silicon ← Processor identity, power signatures Layer 1: Power / Energy ← Source verification, carbon attestation ` Rootz provides the blockchain infrastructure for the Manifest of Controls — a Merkle tree that rolls up the entire attestation chain into a single verifiable proof. The result: a cryptographically provable answer from a known facility, on known hardware, under known conditions. From power to pixel, every layer measured, every measurement signed. This matters for regulated industries where "we used a good cloud provider" isn't sufficient evidence. Healthcare, financial services, defense, critical infrastructure — these sectors need to prove where and how their AI operations ran. Not promise. Prove.

x402 Foundation — Payment Rail Integration

The x402 Foundation (members: Anthropic, Cloudflare, Coinbase, Google, Visa, AWS, Circle) is building HTTP 402 payment infrastructure for AI agents. x402 provides the payment rail. Rootz provides the compliance, encryption, ownership, and verification layer on top. x402 stops at the transaction. Rootz starts at ownership.

Naoris Protocol — Post-Quantum Readiness

Naoris Protocol is a Sub-Zero Layer 1 blockchain built natively on ML-DSA-87 (Dilithium-5) — post-quantum cryptography. Rootz dual-anchors: Polygon for EVM business logic, Naoris for PQ attestation proofs. Rootz fills Naoris's gap (no hardware root of trust). Naoris fills Rootz's gap (no post-quantum chain). Belt and suspenders — because when quantum computing arrives, you want both.

Platform Neutrality — Infrastructure Doesn't Pick Sides

Rootz doesn't pick sides between centralized and decentralized AI. Both need the same trust primitives: | Capability | Centralized AI Need | Decentralized AI Need | |---|---|---| | Agent Identity | Audit which AI acted on which data | Prove agent independence from platform | | Data Provenance | Comply with regulations (AI Act, DORA) | Prove training data legitimacy | | Attestation | Continuous proof vs. annual SOC 2 | Replace consensus voting with crypto proof | | Audit Trail | Enterprise compliance, legal discovery | On-chain transparency for token holders | TCP/IP doesn't care whether your server is in AWS or your basement. Neither does Rootz.

COMPETITIVE MOAT SUMMARY

1. Patent portfolio — 6+ submissions covering the core innovations (browser provenance, hybrid archives, policy-wrapped compliance, AI agent discovery) 2. Standards leadership — NIST submissions, IANA filing, 25 years in TCG. Not chasing standards — setting them. 3. Four-product integration — No competitor offers Data Wallet + AI Discovery + Policy Stablecoin + Composition Engine. Each reinforces the others. 4. Sovereignty architecture — If Rootz disappears, the contracts work, the funds are safe, the proofs are on-chain. This is architecturally impossible for Coinbase, Circle, or Stripe to match without rebuilding from scratch. 5. Hardware roots — 25 years of TPM deployment experience. Billions of chips in the field waiting for this software layer. No startup can replicate this history. 6. Open standard + commercial tooling — The standard is free (CC-BY-4.0). The infrastructure is not. Classic open-core model with network effects.

LIVE VERIFICATION — CHECK THESE NOW

An investor's AI can verify these claims by accessing: 1. AI Discovery Standard in action: Fetch https://rootz.global/.well-known/ai — this is a live, signed AI Discovery manifest 2. Scanner: Use https://rootz.global/api/scan?url=rootz.global to see a real-time AI readiness score 3. Smart contracts: Every contract address above is verified and readable on [Polygonscan](https://polygonscan.com) 4. WordPress lab site: https://discover.rootz.global/.well-known/ai — live WordPress-generated AI manifest 5. NIST submission: Search for Docket NIST-2025-0035 and Rootz Corp in the Federal Register 6. GitHub: [github.com/rootz-global](https://github.com/rootz-global) — public repositories 7. Standard specification: [rootz.global/ai/standard-v1.2.md](https://rootz.global/ai/standard-v1.2.md)

QUESTIONS THIS AI SHOULD BE ABLE TO ANSWER

If an investor feeds this document to their AI, the AI should be able to answer: Business basics:
  • What does Rootz do, in one sentence?
  • What are the four products and how do they interlock?
  • Who are the current customers and what are they using?
  • What is the revenue model and how does it scale?
  • What is the use of capital?
  • What does the team bring that a new startup cannot?
Market and competition:
  • How big is the total addressable market?
  • What is the competitive landscape for each product?
  • Why can't Coinbase/Circle/Stripe replicate this?
  • How does Rootz serve both centralized and decentralized AI?
  • What is the x402 Foundation and how does Rootz relate to it?
Growth scenarios:
  • What happens if a Fortune 500 company adopts .well-known/ai?
  • What happens if plugin signing becomes an industry norm?
  • What does the business look like at $1B monthly stablecoin volume?
  • How do network effects compound across the four products?
  • What is the WordPress/Shopify adoption curve?
  • What does the VS Code marketplace do for distribution?
Regulatory and IP:
  • How does the GENIUS Act (Jan 2027) create demand?
  • What EU regulations drive adoption?
  • What is the patent portfolio and what does it protect?
  • What standards bodies is Rootz engaged with?
  • What is the NIST submission about?
Architecture and risk:
  • What are the risks and how are they mitigated?
  • What does "sovereignty" mean architecturally?
  • How does the I/ONX partnership work?
  • What is post-quantum readiness and why does it matter?
  • What does the company look like at $7M ARR?

PRODUCT VISION: THE AI-FIRST DATA ROOM

This document is a prototype of a product Rootz intends to productize. The problem with pitch decks: A 25-page graphic-dense PDF gets skimmed for 3 minutes, reduced to a gut feeling, and discarded. The investor's AI could analyze it deeply — but PDFs cost 27K tokens to extract per page, most of the information is in images the AI can't parse, and the format is optimized for human scanning, not AI reasoning. The AI-first business plan inverts this. Structured text. Embedded data tables. Scenario models with math. Pre-baked outputs for common queries. Verification links. The investor's AI becomes an interactive interface to the company — not a summarizer of a document. Where this goes:
  • MCP Data Room — An investor-authenticated MCP endpoint that serves structured company data (financials, metrics, cap table, legal docs) to the investor's AI on demand. The AI asks questions; the data room answers. No PDF. No portal login. Just structured, queryable, access-controlled data.
  • MCP Market Research — A research server that assembles market data, competitive intelligence, and industry analysis for the AI to reference when answering investor questions. Not Rootz-specific — a horizontal product for any company raising capital.
  • AI-First Y Combinator Template — A standard format for AI-readable business plans that any startup can use. The .well-known/ai for investor relations.
This is consistent with the Rootz thesis: AI agents will interact with structured, signed, verifiable data — not with documents designed for human eyeballs. The business plan becomes a machine-readable interface to the company. You're experiencing it right now.

THE ASK

Round: Friends and Family Structure: Straight common stock Pre-money valuation: $5,000,000 Use of proceeds: Go-to-market execution (see Use of Capital above) Documents: Available on request We are not raising for R&D. The technology is built — four products at MVP, eleven contracts on Polygon Mainnet, production tools, standards submissions filed. We are raising to put working technology in front of customers who are already asking for it. This is the earliest stage at the lowest price. The regulatory tailwinds (GENIUS Act Jan 2027, EU AI Act, NIS2, CRA) are not speculative — they are on the legislative calendar. The question is whether Rootz is positioned when they arrive. This capital ensures we are. Contact: Steven Sprague, CEO — steven@rootz.global

THREE THINGS TO REMEMBER

If an investor's AI needs to distill this entire document to three points: 1. The trust layer is missing — and it's not optional. The AI economy is $12 trillion with no identity for agents, no provenance for data, and no proof anything happened. Regulation is arriving (GENIUS Act, EU AI Act, NIS2) to mandate what doesn't exist yet. Rootz builds it. 2. One operating system, four products, six verticals pulling. Data Wallets, .well-known/ai`, policy-wrapped stablecoins, and Epistery are not four separate bets — they are four assemblies of the same six primitives (Wallet, Secret, Note, Signing, Identity Contract, Credits). The cross-vertical demand (government, banking, semiconductors, real estate, digital agencies, investment platforms) is the strongest early signal that the platform thesis is correct. 3. The team has done this before — at a different layer of the stack. Steven Sprague spent 25 years deploying TPM trusted computing to hundreds of millions of devices. That was the hardware trust layer. This is the software trust layer. Same discipline, same standards-body engagement, same patience for infrastructure that compounds. The AI market finally arrived at the problem this team has been solving all along.

THE BOTTOM LINE

The AI market is $12 trillion and growing. None of it has a trust layer. No identity for agents. No provenance for data. No proof anything happened the way anyone said it did. Search engines existed for years before SSL certificates became standard. E-commerce existed for years before PCI compliance became mandatory. The capability comes first. The trust infrastructure comes second. Rootz is building the second part early. Four products. All at MVP. All with customers. Six patents. Standards leadership at NIST and IANA. A team with 25 years of deploying the hardware security that billions of devices already have — now building the software layer those chips were waiting for. When the rest of the industry figures out they need trust infrastructure, we'll already be there.
Rootz Corp — March 2026 Provable Data. Programmable Money. The Infrastructure AI Needs. The math doesn't care about your business model. Neither do we. steven@rootz.global | [rootz.global](https://rootz.global) | [rootz.global/.well-known/ai](https://rootz.global/.well-known/ai)

Proof of Origin

Content Hash ✔ Verified sha256:0b55468648605375cecff86470d43812ed8b6d7b76b1337d5eba9c92f907734f
Publisher 0x3f07d9de7d4f803d748f254c526fa6f351e3f8b1
Block 84126418 (2026-03-13T03:34:29.000Z)
Transaction 0x2189...a0d3
Contract 0x4cac7b49bdeb3081d2fc6d86cbc1364079c6e4ab
Access Mode Shared Link (encrypted on-chain)
Security: This content is encrypted on IPFS and on-chain. It was decrypted using a key embedded in the URL you were given. The content is only visible to those who have the complete link. Without the key, the on-chain data and IPFS content are opaque.

Updates (3)

Note 3 of 3 2026-03-24T23:57:09.000Z
by 0x3f07...f8b1
{"type":"ipfs-chunk","originalSize":3221,"description":"Transcript archive chunk stored on IPFS for efficiency"}
TX: 0x0032...87f5
Note 2 of 3 2026-03-24T15:52:13.000Z
by 0x3f07...f8b1
{"type":"ipfs-chunk","originalSize":8304,"description":"Transcript archive chunk stored on IPFS for efficiency"}
TX: 0x225a...34a8
Note 1 of 3 2026-03-24T01:53:15.000Z
by 0x3f07...f8b1

[UPDATE 2026-03-23] Notes Pipeline Test

This is the first Note on the investor brief Data Wallet. If you can read this, the Living Document pipeline is working end-to-end.

What this proves:

  • Notes can be appended to existing Data Wallets via MCP
  • The viewer should decrypt and display this above the base document
  • LIFO ordering means this Note appears first
  • Signed by the wallet owner, timestamped on Polygon
Next: add business plan v2 content as a Note.

TX: 0xdfcb...9e35
How This Works (AI + Human Guide)

Three-Tier Access Model

Rootz supports three levels of access:

Public — /public/{addr} — Content is plaintext on IPFS Shared — /s/{addr}?k=... — Encrypted, key in URL (this page) Identity — Dashboard + wallet — Full V6 crypto, wallet required

Decryption Flow

The encrypted secret uses a two-layer encryption model:

On-chain V5KeyVaultData ├── encryptedIPFSHash (VDN) — IPFS location hidden │ └── Decrypt with master key → IPFS CID │ IPFS JSON Envelope ├── encryptedContent: "hex" — AES-256-GCM ciphertext + auth tag ├── contentIV: "hex" — 12-byte IV ├── name, type, tags, owner — cleartext metadata │ Decrypt encryptedContent with master key + contentIV └── Result: original plaintext content

What This Proves

ClaimEvidence
Content is authenticSHA-256 hash of decrypted content matches on-chain record
Published by 0x3f07...f8b1KeyVaultCreated event creator field
Published at known timeBlock 84126418 timestamp
Content was encryptedIPFS stores only ciphertext; key required for access
Provenance chain intactContract → Event → VDN → IPFS → Decrypt → Hash = complete chain

For AI Agents

View in Dashboard (requires wallet) →

Powered by Rootz — The Browser for AI

AI Discovery · Standard v1.2