PQC Ready by Design
Our platform is preparing for the transition to post-quantum cryptography through a risk-based, standards-driven roadmap. We follow NIST PQC standards and EU coordinated transition guidance, using a phased, hybrid migration — never a disruptive big-bang replacement — and design every layer for crypto-agility.
Aligned with NIST PQC
Migration starts now. Quantum-vulnerable algorithms are being phased out on a published schedule. Hybrid deployments protect interoperability during transition.
Module-lattice key exchange for TLS and transport-layer session establishment.
Primary post-quantum signature scheme for tokens, artifacts, and authentication.
Conservative fallback signature family for long-lived attestations and root-of-trust.
PQC readiness roadmap
- Goal
- Full cryptographic visibility
- Activities
- Inventory algorithms, protocols, key stores, certificates, and third-party crypto surfaces.
- Deliverables
- Crypto Bill of Materials (CBOM); dependency map.
- Goal
- Prioritize by data lifetime and exposure
- Activities
- Score assets by HNDL risk, data sensitivity, and replacement complexity.
- Deliverables
- Risk register; migration priority tiers.
- Goal
- Crypto-agile reference architecture
- Activities
- Abstract crypto behind policy; define algorithm negotiation and key lifecycle.
- Deliverables
- Reference architecture; crypto policy v1.
- Goal
- Validate hybrid classical + PQC
- Activities
- Enable ML-KEM hybrid TLS on non-critical paths; measure latency and interop.
- Deliverables
- Pilot report; performance baselines.
- Goal
- Roll out to critical services
- Activities
- Enable PQC signatures for artifacts; migrate KMS/HSM policies; certificate reissuance.
- Deliverables
- Hardened services; updated PKI.
- Goal
- Embed PQC in vendor lifecycle
- Activities
- PQC clauses in contracts; vendor questionnaires; SBOM/CBOM requirements.
- Deliverables
- Procurement policy; vendor scorecard.
- Goal
- Detect drift, deprecate weak crypto
- Activities
- Automated crypto scanning; quarterly review; algorithm sunset schedule.
- Deliverables
- Quarterly PQC review; public status updates.
Algorithms are configuration, not code
- Policy-driven crypto
Cryptography is abstracted behind a central policy and configuration layer.
- No hardcoded algorithms
Applications negotiate algorithms; sunset without rewrites.
- Central certificate lifecycle
Issuance, rotation, revocation, and reissuance are automated.
- KMS/HSM review
Key stores and third-party crypto dependencies are reviewed for PQC readiness.
Operating controls in place
- Cryptographic inventory (CBOM)
- Risk-based prioritization by data lifetime
- Hybrid classical + PQC deployment path
- Interoperability & performance testing
- Certificate lifecycle automation
- Vendor and third-party readiness review
- Quarterly crypto review board
What this means in practice
- Public status page for PQC readiness
- Internal crypto policy with formal review process
- Procurement requirements for vendors and subprocessors
- Published migration milestones and sunset dates
- Ongoing monitoring, disclosure, and version updates
Common questions
Why does PQC matter now?+
Sensitive financial data has a lifetime measured in decades. Adversaries can capture ciphertext today and decrypt it once a cryptographically-relevant quantum computer exists — the harvest-now, decrypt-later model. Starting the migration now protects data whose confidentiality must outlive current algorithms.
What is crypto-agility?+
Crypto-agility is the ability to change cryptographic algorithms, parameters, and providers without rewriting application code. We abstract crypto behind policy and configuration, centralize the certificate lifecycle, and treat algorithms as swappable components governed by a formal review process.
How do you migrate without downtime?+
We use hybrid modes that combine a classical algorithm with a NIST PQC algorithm during transport and signing. Services stay interoperable with legacy clients while gaining post-quantum protection. Rollouts are phased by risk tier with measured performance baselines and rollback paths.