QuantaSeal
QuantaSeal
A breach of any single layer leaves the other two intact. Defence-in-depth by design.
TLS 1.3 + ML-KEM-768 hybrid
AES-256-GCM + AWS KMS
Zero-plaintext runtime
No home-grown cryptography. No experimental algorithms. Every primitive is standardised by the National Institute of Standards and Technology.
Key Encapsulation
Data-in-Transit Encryption
192-bit post-quantum
Digital Signatures
API Auth & Code Signing
192-bit post-quantum
Stateless Hash Signatures
Long-term Data Signing
256-bit post-quantum
Symmetric Encryption
Payload Encryption Layer
256-bit classical
Key Derivation
Per-Session Key Material
512-bit output
| Algorithm | FIPS Standard | Type | Use in QuantaSeal | Security Level | Role |
|---|---|---|---|---|---|
| ML-KEM-768 | FIPS 203 | Key Encapsulation | Data-in-Transit Encryption | 192-bit post-quantum | Primary |
| ML-DSA-65 | FIPS 204 | Digital Signatures | API Auth & Code Signing | 192-bit post-quantum | Primary |
| SLH-DSA | FIPS 205 | Stateless Hash Signatures | Long-term Data Signing | 256-bit post-quantum | Secondary |
| AES-256-GCM | FIPS 197 | Symmetric Encryption | Payload Encryption Layer | 256-bit classical | Hybrid |
| HKDF-SHA-512 | FIPS 198-1 | Key Derivation | Per-Session Key Material | 512-bit output | Supporting |
Cryptographic Agility Engine
QuantaSeal's Cryptographic Agility Engine allows seamless algorithm migration without re-encrypting your data. When NIST publishes new standards or updates existing ones, your platform migrates automatically \u2014 on the next key rotation cycle.
Every QuantaSeal control maps to a concrete threat. Here is our full threat model and how we address each vector.
Adversaries collect today’s encrypted traffic to decrypt it once quantum computers are available. Data with a 10-year sensitivity window is at risk right now.
Our Mitigation
ML-KEM-768 hybrid encryption makes harvested ciphertext permanently unrecoverable — even with a quantum computer.
A single compromised key can expose all data encrypted under it — the classic single point of failure in traditional KMS architectures.
Our Mitigation
Per-tenant CMKs with automatic rotation mean a compromised key exposes exactly one tenant’s data from one rotation period.
Engineers with database or infrastructure access can read sensitive data in systems that don’t enforce field-level encryption.
Our Mitigation
QuantaSeal encrypts at the field level before data reaches the database. Infrastructure access yields only unreadable ciphertext.
Compromised dependencies or build pipelines can inject malicious code that exfiltrates secrets during execution.
Our Mitigation
Pinned dependency versions, SBOM generation, automated vulnerability scanning on every build, and signed releases via ML-DSA-65.
Malformed requests can exploit processing pipelines to leak data or execute unintended operations.
Our Mitigation
Input validation against strict JSON schemas, parameterised queries only, rate limiting, and HMAC-signed API payloads.
Sophisticated actors with access to near-future quantum hardware target long-lived sensitive data in financial, healthcare, and government sectors.
Our Mitigation
NIST FIPS 203/204/205 algorithms are specifically designed and validated to resist attacks from cryptographically relevant quantum computers.
Our security control library is mapped to SOC 2 Type II, NIST CSF 2.0, ISO 27001, and the Australian Privacy Act. Full documentation available to Enterprise customers under NDA.
Encryption at Rest
AES-256-GCM + AWS KMS per-tenant CMK
Encryption in Transit
TLS 1.3 + ML-KEM-768 hybrid key exchange
Authentication
OAuth 2.0 + PKCE, JWT with issuer/audience validation
Authorisation
RBAC with least-privilege defaults, per-endpoint auth
Rate Limiting
Per-endpoint limits, fail-closed when service degraded
Cryptographic Agility
Automatic algorithm migration on NIST updates
Observability
OpenTelemetry traces, metrics, and distributed tracing
Logging
Immutable audit logs — all access events
Feature Flags
Controlled rollouts with admin-only flag management
Vulnerability Scanning
Daily SAST/DAST on CI pipeline
Dependency Auditing
GitHub Dependabot + OSV Scanner
Penetration Testing
External pentest before GA launch
Incident Response
24h detection SLO, public status page
Data Residency
Australia (ap-southeast-2), EU (eu-west-1) optional
Backup Encryption
Separate backup CMK, cross-region replication
Zero-Knowledge Logs
Logs contain no sensitive field values ever
Error Handling
Sanitised responses — no internal details exposed
We take security reports seriously. If you discover a vulnerability, we commit to:
24 hours
Initial acknowledgement
72 hours
Severity triage complete
90 days
Maximum remediation window
Email security@quantaseal.io with a detailed description of the issue. PGP key available on request. We practise coordinated disclosure and will credit researchers in our security advisories.
Deploy post-quantum protection across all your systems in 30 minutes or less.