Security Overview
Transparency in our post-quantum cryptographic infrastructure.
At QuantaCipher, security is not just a feature—it is our entire product. We are building the future of post-quantum infrastructure to protect the world's most sensitive data against "Store Now, Decrypt Later" (SNDL) attacks by cryptanalytically relevant quantum computers (CRQCs).
NIST Kyber-1024 Implementation
Our core cryptography relies on ML-KEM (Kyber-1024), the final standard approved by the National Institute of Standards and Technology (NIST) for post-quantum key encapsulation. We utilize security category 5 parameter sets, equivalent to AES-256 in classical computing, providing the highest possible margin of security against known quantum attacks. However, please note that no system is 100% invulnerable. This includes both the underlying mathematical algorithms (like ML-KEM) and our software implementations across our open-source SDKs and gateway servers.
Zero-Trust WASM Engine
Encryption and decryption occur entirely within your local environment (Node.js or Browser) via our Rust-compiled WebAssembly (WASM) engine. QuantaCipher Gateway servers never see your plaintext data, nor do we possess the private keys required to decrypt your ciphertexts. We operate on a mathematically provable Zero-Trust architecture.
Hybrid Cryptography Fallback
While we employ cutting-edge post-quantum algorithms, we follow NSA and CISA recommendations by using a hybrid cryptographic approach. All payloads are wrapped in standard ECDHE (Elliptic Curve Diffie-Hellman Ephemeral) and AES-GCM before the Kyber layer is applied, ensuring that our systems remain secure even if future mathematical vulnerabilities are found in lattice-based cryptography. If significant vulnerabilities are ever discovered in ML-KEM or within our SDK implementations, we will immediately initiate our incident response protocol, which includes falling back to our classical encryption layer and issuing rapid security patches to all affected open-source SDKs and gateway servers.
Infrastructure Security
Beyond cryptography, our cloud infrastructure is hardened against classical attacks:
- SOC2 Type II compliance procedures are currently underway.
- All API interactions require TLS 1.3.
- Gateway servers are distributed globally with automatic DDoS mitigation.
- Strict internal access controls based on the principle of least privilege.
Vulnerability Disclosure
We welcome responsible disclosure of vulnerabilities from the security research community. If you believe you have found a security vulnerability in QuantaCipher's systems, APIs, or SDKs, please immediately report it to security@quantacipher.com. Please note that we do not currently operate a paid bug bounty program.
