Trust Center
Security, privacy, and report integrity
How Qtangl handles scan data, signs reports, and supports enterprise retention controls.
Signed evidence
Every report ships with a content hash and signature — auditors verify at /verify without trusting Qtangl alone.
Continuous drift
Monitor diffs each scan against the last baseline so regressions surface before the next audit cycle.
Honest scope
Inventory aid and prioritization — not a formal attestation. We say what we do and do not claim.
Minutes, not months
Live fixture scan in under ten minutes. Compare that to spreadsheet programs that decay on first deploy.
Dogfood — we scan ourselves
Qtangl runs daily live PQC scans of qtangl.com, www.qtangl.com, and api.qtangl.com in CI. Signed reports are publicly verifiable — we hold ourselves to the standard we sell.
Loading latest self-scan…
Full multi-domain dogfood report
SOC 2 status (honest)
SOC 2 Type I observation is in progress. We do not claim SOC 2 certification on marketing pages until an independent CPA report is available under NDA.
Target: Type I observation → Type I CPA report → Type II window.
Live transparency log
Append-only hash log, Merkle root, Git + RFC 3161 anchors — fetched live from https://api.qtangl.com.
Loading…
CLI quick-start
curl -s "https://api.qtangl.com/pqc/transparency/root" | jq '.log.merkleRoot'
curl -s "https://api.qtangl.com/pqc/transparency/keys" | jq '.keys[] | {fingerprint, algorithm, active}'
python scripts/qtangl_verify.py report.json --api-base https://api.qtangl.comOffline verification spec: verify-spec.md · Verify a report
Data handling
Scan results are stored per tenant when Postgres persistence is enabled. You may delete scans via DELETE /tenant/scans/{id}. Tenant API keys are hashed at rest; revoke leaked keys immediately via admin.
Report integrity
Each migration report includes a SHA-256 content hash and signature (ML-DSA-65 when liboqs is available, Ed25519 fallback otherwise). Verify independently at /verify.
Honest scope
Qtangl provides cryptographic inventory and prioritization — an inventory aid, not a formal audit or attestation. Findings should be validated in your environment before regulatory submission.
Retention
Upload bundle sessions expire after 24 hours. Scan metadata and signed reports persist per tenant when Postgres is enabled — default evidence retention is 12 months (configurable). Full lifecycle and offboarding: Data retention policy. Enterprise data residency and custom retention windows are available on request.
Monitoring & alerts
Monitor tier supports scheduled re-scans, drift diffs, and webhook notifications on scan completion. Webhook payloads use schema version qtangl-webhook-v2 for SIEM ingestion. Optional HMAC signing via X-Qtangl-Signature when a tenant signing secret is configured. Failed deliveries are retained in a Postgres-backed DLQ with dashboard replay.
Sub-processors
See our public register at /trust/subprocessors. Primary hosting providers maintain SOC 2 reports; subprocessor attestations are available under NDA on document request. See /trust/subprocessors.
SOC 2 & compliance
SOC 2 Type I observation is in progress. We do not claim SOC 2 certification on marketing pages until an independent CPA report is available under NDA. Target: Type I observation → Type I CPA report → Type II window. GRC framework mappings (NIST CSF, EU PQC guidance) are readiness aids via the compliance posture API — not attestations.
DPA requests
Request a Data Processing Agreement via Contact sales — include entity name, data residency requirements, and expected scan volume.
Federal alignment
Qtangl helps customers with CISA ACDI-style cryptographic discovery and inventory (NIST SP 1800-38B methods). We map findings to NSM-10, NIST IR 8547, and CNSA 2.0 frameworks — as an inventory aid for customer compliance programs, not as Qtangl attestation or certification.
Dogfood verification
Qtangl runs daily live PQC scans of qtangl.com, www.qtangl.com, and api.qtangl.com in CI. Signed reports are publicly verifiable — we hold ourselves to the standard we sell. Verify spec: /docs/verify-spec; public verifier: /verify. Readiness Index governance: opt-in cohort only (k-anonymity ≥ 10) — see Readiness Index. We recommend customers verify a sample report before production rollout.
References & standards
Authoritative primary sources cited in this report. Full methodology
- Readiness score0–100 composite score reflecting quantum-vulnerable asset share, HNDL exposure, PQC-ready endpoints, and remediation coverage. Higher is better.
- Readiness bandQualitative tier (Critical / At Risk / Developing / Prepared) derived from the readiness score for executive reporting.
- Coverage confidenceHeuristic 0–95% estimate of scan completeness based on classified asset count. Not a guarantee — shadow keys and offline HSMs may be missed.
- Mosca inequality (X + Y > Z)Dr. Michele Mosca's harvest-now-decrypt-later test: data shelf-life (X) plus migration time (Y) versus years to cryptographically relevant quantum computing (Z). When X + Y > Z, intercepted ciphertext may be decrypted before you finish migrating.
- NIST IR 8547Transition to post-quantum cryptography standards
- FIPS 203 (ML-KEM)Module-Lattice-Based Key-Encapsulation Mechanism
- FIPS 204 (ML-DSA)Module-Lattice-Based Digital Signature Algorithm
- FIPS 205 (SLH-DSA)Stateless Hash-Based Digital Signature Algorithm
- NIST SP 800-208Stateful hash signatures for firmware/code signing
- CNSA 2.0NSA Commercial National Security Algorithm Suite 2.0
- NSM-10National Security Memorandum on post-quantum cryptography
- PCI-DSS 4.0Payment card industry cryptographic agility requirements
- CMMC / FedRAMPFederal contractor cryptographic inventory and migration
- HIPAA Security RulePHI transmission security and risk analysis
- EU Cyber Resilience ActCrypto-agility and vulnerability disclosure for digital products
- ISO/IEC 27001Information security management — cryptographic controls
- DORADigital Operational Resilience Act (EU financial sector)
- SOC 2Trust services criteria — encryption and key management
- GDPR Art. 32Security of processing — state-of-the-art encryption
- FedRAMPFederal cloud security — FIPS-validated cryptography
- CISA PQC RoadmapCISA guidance for migrating to post-quantum cryptography