QuantaSeal
QuantaSeal
From security reviews to code generation to incident response — real conversations that teams have every day
How's my security looking?
✅ 3,421 API calls — all encrypted with ML-KEM-768
✅ 0 threats detected in the last 24 hours
✅ SOC2 Score: 92/100
⚠️ 2 vault credentials expiring in 14 days
I'd recommend renewing those credentials soon. Want me to show you which ones?
Generate Python code to encrypt a SSN field
from quantaseal import QuantaSeal
qs = QuantaSeal(api_key="qs_live_...")
result = qs.encrypt(
plaintext="123-45-6789",
algorithm="ML-KEM-768",
encryption_context={
"field": "ssn",
"purpose": "pii_protection"
}
)
This uses ML-KEM-768 + AES-256-GCM with ML-DSA-65 signing. The encryption_context is bound to the ciphertext — decryption requires the same context.
Help me connect Salesforce to QuantaSeal
Let's set up your Salesforce integration:
Step 1 — Create a Connected App in Salesforce Setup with OAuth scope api refresh_token.
Step 2 — Seal your SF credentials in QuantaVault.
Step 3 — Create the integration via proxy API with system_type: salesforce.
Step 4 — I'll discover your schema and recommend which fields to encrypt.
Ready to start? I can generate the API calls for each step.
We have a HIPAA audit next week. How ready are we?
Your HIPAA compliance score is 87/100 — rated "Good".
Strengths:
• Post-quantum encryption (ML-KEM-768) — exceeds requirements
• Immutable audit trail with tamper detection
• 3-layer encrypted vault for PHI credentials
Gaps to address:
• 1 encryption key overdue for rotation (critical)
• Consider enabling automated compliance reports
Shall I rotate that key now and generate a HIPAA compliance PDF?
Unauthorized vault access detected — help me investigate
Initiating incident response.
Scope: 3 unauthorized vault.unseal events from IP 203.0.113.42 (Singapore) at 02:14 UTC.
Affected entries: db-prod-creds, stripe-api-key, aws-iam-secret
Immediate actions:
• ✅ Flagged IP in audit trail
• ⚠️ Recommend rotating all 3 credentials NOW
• ⚠️ Check if the actor's session token was compromised
Want me to rotate all affected vault entries and generate a forensic export?
We're at 85% of our API limit — how can we optimize?
Current usage: 85,000 / 100,000 API calls (Professional plan).
Analysis of your call patterns:
• 34% are encrypt calls for the same 12 field types
• 28% are vault.unseal for cacheable credentials
• 18% are proxy requests to Salesforce
Recommendations:
• Enable client-side caching for vault creds (saves ~23K calls/mo)
• Batch encrypt instead of per-field calls (saves ~15K calls/mo)
• Use proxy auto-encryption instead of manual encrypt calls
Estimated reduction: ~38,000 calls/month. Stay well within Professional limits.
Quanta Copilot connects to every part of the QuantaSeal platform. Whether you write code, manage compliance, or run operations — it speaks your language.
Generate working encrypt/decrypt, vault, and proxy code in Python, Node.js, Go, or Java — copy-paste ready with your API key pattern.
"Generate Python code to encrypt a credit card number with ML-KEM-768"
Describe what you want in plain English and get the exact API call — curl commands, SDK methods, request/response schemas, and auth headers.
"How do I seal a database credential into QuantaVault via the REST API?"
Walk through connecting any of 50+ integrations step by step — Salesforce, HubSpot, AWS S3, Stripe, and more. Copilot validates each step.
"Help me connect my Salesforce org to QuantaSeal"
Discover external system schemas and create field-level encryption mappings. Copilot introspects your integration and recommends which fields to encrypt.
"Discover the fields on my Salesforce Contact object and suggest which ones need encryption"
Generate Terraform configs using the official QuantaSeal provider — vault entries, integrations, encryption policies, key rotation schedules.
"Generate Terraform to create a vault entry and a 90-day rotation policy"
Register webhook endpoints, configure PQC signature verification, test payloads, and debug delivery failures — all through conversation.
"Register a webhook for vault.accessed events at https://api.myapp.com/hooks"
Paste an error message or describe the issue. Copilot diagnoses common problems — expired keys, rate limits, malformed envelopes, auth failures.
"I'm getting a 403 on encrypt calls — my API key was working yesterday"
Get GitHub Actions, Docker, and Kubernetes configs for QuantaSeal. Copilot generates workflows for key rotation, compliance checks, and secret scanning.
"Generate a GitHub Action that runs a compliance check on every PR"
Quanta Copilot doesn't just tell you what's happening — it can encrypt data, rotate keys, generate code, create integrations, and trigger workflows on your behalf.
Enterprise-grade AI agent with tool-calling architecture
Type naturally — "Encrypt this SSN", "Generate a Terraform config", "Why did my sync job fail?" — no commands to memorize, no docs to search.
The AI analyzes your intent and selects from 24 specialized tools. For complex requests, it chains multiple tools — discover schema, create mapping, then start a sync job.
Each tool runs a scoped operation against your tenant — audit logs, vault entries, encryption APIs, integration endpoints, compliance engines — all isolated to your account.
Copilot synthesizes results into a clear response with actionable recommendations. Code is copy-paste ready. Reports are downloadable. Actions are confirmed before execution.
One AI assistant that adapts to how each role works
Function-calling tools the Copilot invokes automatically based on your natural-language queries — scoped to your tenant data
get_security_summaryFull security posture overview — encryption stats, active threats, key rotation status, and event counts.
list_integrationsList all connected systems with health status, latency, and last-sync timestamps.
get_compliance_scoreScore compliance across SOC 2, ISO 27001, PCI DSS 4.0, HIPAA, GDPR, NIST CSF, FedRAMP, and APRA.
search_audit_logsSearch the immutable, hash-chained audit trail. Filter by event type, actor, resource, time range, or outcome.
get_vault_summaryVault overview — total credentials, types, expiration status, and rotation schedules.
get_encryption_key_statusKey inventory with rotation dates, algorithm types, and overdue rotation alerts.
get_usage_metricsAPI call counts, encryption operations, vault access, proxy requests, and bandwidth — with plan limit tracking.
analyze_threat_patternsAnomaly detection across security events — brute force, API spikes, geographic anomalies, credential stuffing.
get_sync_job_statusStatus of all data sync jobs — running, completed, failed — with error details and next-run schedules.
get_workflow_statusWorkflow execution status — active, paused, errored — with execution history and failure diagnostics.
recommend_security_actionsAI-generated security recommendations based on your current posture, compliance gaps, and usage patterns.
explain_pqc_conceptExplain post-quantum cryptography concepts — ML-KEM, ML-DSA, SLH-DSA, FIPS 203/204/205, and quantum threats.
Four endpoints. JWT-authenticated. Conversation state is managed automatically — just send messages.
| Method | Endpoint | Description |
|---|---|---|
| POST | /api/v2/agent/chat | Send a message (creates conversation on first message) |
| GET | /api/v2/agent/conversations | List all conversations for the authenticated user |
| GET | /api/v2/agent/conversations/{id} | Get full conversation with all messages |
| DELETE | /api/v2/agent/conversations/{id} | Delete a conversation and all its messages |
Choose the provider that fits your security and cost requirements — switch any time without changing your integration
Uses IAM authentication — no API keys needed. Data stays within your AWS account. Pay-per-token pricing.
Uses GPT-4o by default. Requires an OpenAI API key. Best for teams already using the OpenAI ecosystem.
Direct Anthropic API integration. Uses Claude Sonnet by default. Requires an Anthropic API key.
Security-first AI architecture — no compromise
Every tool query is scoped to your tenant. Copilot never crosses boundaries — enforced at the database query level, not just prompt engineering.
Supports AWS Bedrock (IAM-based, no API keys), OpenAI, and Anthropic. Switch providers without changing your workflow.
Copilot never reveals decrypted vault secrets, raw encryption keys, or sensitive payloads. Tools return metadata only — your secrets stay sealed.
Chat history stored in PostgreSQL with full encryption. User-scoped with cascade delete — you control your data.
20 requests/minute per user, 100 conversations max, 50-message context window. Prevents LLM cost abuse while keeping conversations deep.
Destructive operations (key rotation, credential deletion, algorithm migration) require explicit confirmation before execution. No accidental changes.
24 tools. 50+ integrations. 8 compliance frameworks. 4 SDK languages. One conversation.