QuantyrixAgentic PQC Intelligence
Start free trial
EO 14412 inventories were due Oct 2026 · FAR rule for contractors Dec 2026

See the risk. Plan the migration. Prepare for quantum.

Eight specialist agents find every quantum-vulnerable key, certificate and library, score the risk, map it to the mandates you answer to — and run the migration as an auditable program you can pause, approve and stop.

Start free trial Grade your domain free
Supervisor · live agentic run
step 1/8
  1. Planner
  2. Discovery
  3. Risk
  4. Compliance
  5. Roadmap
  6. Remediation
  7. Review
  8. Reporter
Reasoning trace
  1. think · planner stage
    act   recall_memory("acme payments") → plan(targets)
    obs   2 modules · code, tls · prior run had 1 unreachable host
Approval gates

Pause on any tool; resume from the checkpoint.

Budgets

Steps, seconds and tokens capped; cost on every run.

Stop any time

Cancel reaches the agent at its next step.

Signed evidence

Trace, CBOM and kits signed with ML-DSA.

Why now
PQC market by 2030
$2.8B
PQC market by 2030
46% CAGR · MarketsandMarkets
US agencies with a complete crypto inventory
1 of 24
US agencies with a complete crypto inventory
GAO-27-108740, Oct 2026
of organisations inventory their cryptography
32%
of organisations inventory their cryptography
Ponemon, 2026
RSA & ECC deprecated by NIST
2030
RSA & ECC deprecated by NIST
NIST IR 8547 · disallowed 2035
  • Continuous discoveryCode, hosts and SBOMs.
  • Six-factor riskImpact, exposure, HNDL.
  • Compliance & roadmapNIST, CNSA 2.0, UAE IA.
Free check

Is your website ready for quantum computers?

Traffic recorded today can be decrypted once a quantum computer can break classical key exchange. Enter a domain to see whether it uses hybrid ML-KEM key exchange, and what else stands in the way. A–F in seconds, nothing stored.

One website is one endpoint. Your estate has thousands.

Quantyrix inventories code, certificates, SSH, cloud key stores and containers in one CBOM, maps it to M-26-15, PCI DSS 12.3.3, NCSC and CNSA 2.0, and plans the migration.

Scan your whole estate free

How the grade works

  • A+Hybrid post-quantum key exchange and a post-quantum certificate
  • AHybrid ML-KEM key exchange, no legacy protocols
  • BHybrid key exchange, but TLS 1.0/1.1 still accepted
  • CModern TLS 1.3, classical key exchange
  • DClassical key exchange on an outdated protocol setup
  • FA basic weakness: weak or expired certificate, static RSA, no TLS 1.2+

We run a few standard TLS handshakes against port 443 of public hosts only, and keep results for an hour. No data from the site is stored. Privacy · Terms

US federal · EO 14412
2030 / 2031 · PQC key establishment, then signatures
PCI DSS 4.0 · 12.3.3
annual · cipher & protocol inventory review
CNSA 2.0
Jan 2027 · new NSS acquisitions must comply
UK NCSC
2028 → 2035 · discovery, priority systems, complete
Platform

From inventory to a migration you can run

Discovery across seven surfaces

Code in 20+ languages, GitHub/GitLab repos, SBOMs, TLS and SSH endpoints, container images, AWS/Azure/GCP/Vault keys — merged into one vendor-neutral CycloneDX CBOM.

Risk your board can argue with

Impact, exposure, data lifetime, harvest-now-decrypt-later, crypto-agility and remediation cost, with a dollar model your board can argue with.

Compliance mapped to deadlines

NIST IR 8547, CNSA 2.0, EO 14412, PCI DSS, NCSC, UAE IA and 11 more, mapped to controls and deadlines; signed kits for the filings you owe.

Migration Command Center

Mandate countdowns, wave burndown, velocity and projected completion, owners, budget vs exposure — the page your CISO opens every Monday.

Remediation you approve

Dependency bumps, config fixes and pull requests drafted by the agent, reviewed by a human, tracked to closure on re-scan.

Runs where your data is

Self-hosted, air-gapped bundles, SCIM, OIDC, MFA, hash-chained audit log, SIEM and CMDB sinks. A free CLI and CI gate for every developer.

Pricing

Public prices. No quote cycle.

Annual plans, billed yearly. Every plan includes CycloneDX CBOM and SARIF exports, risk scoring, the migration roadmap and the free Quantum Readiness Grade.

Trial

14 days of Business with no card required. Your workspace stays on Community afterwards until you upgrade.

Self-hosted

Every plan can run on your infrastructure with a signed offline license key. No data leaves your network.

Readiness assessment

A fixed-fee assessment delivered with Quantyrix, credited toward your first year.

Trust centre

How we protect the inventory you trust us with

A cryptographic inventory is a map of your weakest points. This states what the product does today, what is still in progress, and what we have not done yet.

Assurance status

  • SOC 2 Type I

    Planned

    Control mapping to the Trust Services Criteria is done (docs/trust/SOC2-READINESS.md). The auditor and compliance-automation platform are not yet engaged.

  • Third-party penetration test

    Planned

    Scope covers the hosted console, API and Community CLI. The summary letter will be shared under NDA once issued.

  • WCAG 2.1 AA

    Self-assessed

    An accessibility regression gate runs on every change, and the VPAT 2.5 report is drafted. The external audit is pending, so we do not claim conformance yet.

  • Product SBOM (CycloneDX 1.6)

    Available

    Generated from the lockfiles on every build and release, and covered by the signed release checksums.

Controls in the product

Identity and access

  • Passwords hashed with scrypt (N=16384, r=8, p=1); 12-character minimum.
  • TOTP multi-factor with single-use codes and hashed recovery codes; can be required for admin roles.
  • OIDC single sign-on with group-to-role mapping, and SCIM 2.0 user provisioning.
  • Eight-hour sessions, re-checked on every request so deactivation and password resets take effect at once.
  • API keys stored only as SHA-256 digests, bound to one tenant, with optional expiry.

Authorisation and tenancy

  • Seven roles from viewer to platform admin; nobody can grant a role above their own.
  • Tenant comes from the signed-in account or key; only administrators can act on another tenant.
  • Cross-origin writes are rejected; logins are rate-limited and accounts lock after repeated failures.

Audit and evidence

  • Every write, denial, login and administrative change is recorded in a SHA-256 hash-chained audit log with a verifier.
  • Evidence packs, compliance kits, supplier attestations and backups are Ed25519-signed.
  • Licence keys are signed with ML-DSA-65 (FIPS 204) where the runtime supports it.

Data handling

  • Findings record algorithm, key size, location and expiry, never private key material.
  • Reasoning models can be switched off per deployment; secrets are redacted from snippets before any model call.
  • Offline mode blocks every outbound connection for air-gapped installs.
  • Run retention and per-tenant erasure tooling; signed, passphrase-encrypted backups with a restore drill.

Network and platform

  • HTTPS enforced at the edge, HSTS, a restrictive Content-Security-Policy and frame denial.
  • Hosted scans refuse private and cloud-metadata addresses; the public grader also pins DNS to prevent rebinding.
  • The in-network collector only makes outbound HTTPS calls and strips secrets before sending.
  • Containers run as a non-root user.

Secure development

  • Every change runs the test suite on three Node versions, a detection benchmark, a performance gate and an accessibility gate.
  • Weekly dependency updates, a dependency audit and secret scanning in CI; the product also scans its own source on every push.
  • The Community CLI has zero runtime dependencies; releases ship checksums signed with Ed25519 and a CycloneDX SBOM.

Subprocessors and outbound data

Which services receive data depends on how you deploy. Self-hosted and air-gapped installs use none of these unless you configure them.

ServicePurposeDataWhen
NetlifyApplication hosting and background scan functionsAll console data in transit and at restHosted console
MongoDB AtlasDatabaseAccounts, runs, findings, audit logWhen the database backend is MongoDB
StripeBillingTenant id, billing contact email, planPaid self-serve plans
Google (Gemini API)Reasoning model (narratives, remediation drafts)Redacted code excerpts around findings; metadata-only summariesOnly when reasoning is enabled; the provider is shown per run
OSV.dev (Google)Dependency advisory lookupPackage names and versionsOnline SBOM and dependency scans
GitHub or GitLabRepository fetch and pull-request deliveryRepository URL; fix branches you approveWhen you scan a hosted repository or open a fix PR

Software bill of materials

CycloneDX 1.6, runtime dependencies only, with package hashes and licences. Release builds carry the same files under the signed SHA256SUMS.

Procurement documents

  • Security whitepaper

    Architecture, data flows, authentication, tenant isolation, audit and secure development.

    On request

  • Data processing agreement (DPA)

    Template with standard contractual clauses and the subprocessor list. Draft pending legal review.

    On request

  • Service level agreement

    Uptime targets, support response times, RPO/RTO. Draft pending commercial review.

    On request

  • Accessibility conformance report (VPAT 2.5)

    Self-assessment against WCAG 2.1 AA, Section 508 and EN 301 549.

    On request

  • SOC 2 readiness map

    Trust Services Criteria mapped to product controls and evidence.

    On request

Ask your Quantyrix contact for these documents.

Report a vulnerability

No disclosure inbox is configured for this deployment. Contact its operator.

Built for the people who must file something

Federal and contractor security leads. PCI-scoped fintech. Regulated mid-market.

  • M-26-15 inventory and plan kit — signed, in a day — for the filing that was due in October
  • PCI DSS 12.3.3 annual review — assessor-formatted cipher and protocol inventory
  • Supplier attestation exchange — request CBOMs from vendors; every request onboards one
  • Public price, no quote cycle — see the plans above — Team, Business and Enterprise, billed yearly
Start in minutes
  1. 1Grade a domain — see your TLS posture against hybrid ML-KEM.
  2. 2Start a 14-day trial and point the agents at a repo, SBOM or host.
  3. 3Export the signed CBOM, kit and board brief. Keep scanning on a schedule.
Start free trial Grade a domain

Or npx quantyrix scan . — free Community CLI

Quantyrix — Agentic PQC Intelligence