Trust Center
Security, privacy, and report integrity
How Qtangl handles scan data, signs reports, and supports enterprise retention controls.
Signed evidence
Every report ships with a content hash and signature — auditors verify at /verify without trusting Qtangl alone.
Continuous drift
Monitor diffs each scan against the last baseline so regressions surface before the next audit cycle.
Honest scope
Inventory aid and prioritization — not a formal attestation. We say what we do and do not claim.
Minutes, not months
Live fixture scan in under ten minutes. Compare that to spreadsheet programs that decay on first deploy.
Data handling
Scan results are stored per tenant when Postgres persistence is enabled. You may delete scans via DELETE /tenant/scans/{id}. Tenant API keys are hashed at rest; revoke leaked keys immediately via admin.
Report integrity
Each migration report includes a SHA-256 content hash and signature (ML-DSA-65 when liboqs is available, Ed25519 fallback otherwise). Verify independently at /verify.
Honest scope
Qtangl provides cryptographic inventory and prioritization — an inventory aid, not a formal audit or attestation. Findings should be validated in your environment before regulatory submission.
Retention
Upload bundle sessions expire after 24 hours. Scan job retention follows your deployment configuration; contact Qtangl for enterprise data-residency and custom retention windows.
Monitoring & alerts
Monitor tier supports scheduled re-scans, drift diffs, and webhook notifications on scan completion. Webhook payloads use schema version qtangl-webhook-v2 for SIEM ingestion. Optional HMAC signing via X-Qtangl-Signature when a tenant signing secret is configured. Failed deliveries are retained in a Postgres-backed DLQ with dashboard replay.
Sub-processors
Production deploys may use Railway (hosting), Postgres (data), Redis (queue), Stripe (billing), and optional email delivery. Enterprise customers receive a current sub-processor list during contract review.
SOC 2 & compliance
SOC 2 Type I scope is documented internally; we do not claim certification on marketing pages until complete. GRC framework mappings (NIST CSF, EU PQC guidance) are provided as readiness aids via the compliance posture API.
DPA requests
Request a Data Processing Agreement via Contact sales — include entity name, data residency requirements, and expected scan volume.
Dogfood verification
Qtangl signs its own scan reports and publishes verification steps at /verify. We recommend customers verify a sample report before production rollout.
References & standards
Authoritative primary sources cited in this report. Full methodology
- Readiness score0–100 composite score reflecting quantum-vulnerable asset share, HNDL exposure, PQC-ready endpoints, and remediation coverage. Higher is better.
- Readiness bandQualitative tier (Critical / At Risk / Developing / Prepared) derived from the readiness score for executive reporting.
- Coverage confidenceHeuristic 0–95% estimate of scan completeness based on classified asset count. Not a guarantee — shadow keys and offline HSMs may be missed.
- Mosca inequality (X + Y > Z)Dr. Michele Mosca's harvest-now-decrypt-later test: data shelf-life (X) plus migration time (Y) versus years to cryptographically relevant quantum computing (Z). When X + Y > Z, intercepted ciphertext may be decrypted before you finish migrating.
- NIST IR 8547Transition to post-quantum cryptography standards
- FIPS 203 (ML-KEM)Module-Lattice-Based Key-Encapsulation Mechanism
- FIPS 204 (ML-DSA)Module-Lattice-Based Digital Signature Algorithm
- FIPS 205 (SLH-DSA)Stateless Hash-Based Digital Signature Algorithm
- NIST SP 800-208Stateful hash signatures for firmware/code signing
- CNSA 2.0NSA Commercial National Security Algorithm Suite 2.0
- NSM-10National Security Memorandum on post-quantum cryptography
- PCI-DSS 4.0Payment card industry cryptographic agility requirements
- CMMC / FedRAMPFederal contractor cryptographic inventory and migration
- HIPAA Security RulePHI transmission security and risk analysis
- EU Cyber Resilience ActCrypto-agility and vulnerability disclosure for digital products
- ISO/IEC 27001Information security management — cryptographic controls
- DORADigital Operational Resilience Act (EU financial sector)
- SOC 2Trust services criteria — encryption and key management
- GDPR Art. 32Security of processing — state-of-the-art encryption
- FedRAMPFederal cloud security — FIPS-validated cryptography
- CISA PQC RoadmapCISA guidance for migrating to post-quantum cryptography