Open QubitHub

Quantum-ready security and privacy

Reduce what must be shared. Protect what still moves.

Qualimetrix Continuum adds quantum-safe transport to governed synthetic data: two lines under one policy surface, for regulated environments where records stay sensitive for decades.

Request assessment See all four modules
Current scope
Relational and tabular
Transport
Hybrid classical + PQC
Evidence
Attached per accepted release
Review model
Task-level
Status
Subject to assessment

Two lines

One suite, two problems that shrink each other.

Governed synthetic data

Shipping product

Qualimetrix creates governed relational and tabular counterparts for software testing, AI validation and controlled collaboration. Every production copy that is not distributed is data that no longer needs quantum-safe protection.

  • Relational and tabular counterparts
  • Utility measured per task, not in aggregate
  • Methods, results and limitations attached per release

Quantum-safe transport

In build

Patient records, policies and contracts stay sensitive for decades, while traffic captured today can be decrypted later. The PQC Gateway terminates and re-establishes traffic with hybrid key establishment, keeping the classical layer in place.

  • Hybrid X25519 and ML-KEM-768 key establishment
  • Key lifecycle held in your KMS or HSM
  • Negotiation and rotation recorded per zone
Boundary

Continuum reduces the number of environments that require production records, and protects the exchanges that remain. It does not replace identity, endpoint, infrastructure or software-supply-chain security, and the PQC Gateway and Policy Orchestration are still in build.

The suite

Four modules under one policy surface.

Continuum is one policy surface over separate microservices. A single module can be adopted without the rest of the suite, and no module leaves the data boundary it was placed in.

PRODUCTION BOUNDARY · customer zone Source systems Postgres · Oracle · SQL Server · CDC Adapters profile in place, least privilege Pilot Counterpart Engine profile → generate → measure, all inside the boundary Shipping Non-production consumers dev · test · analytics · AI validation · collaboration counterpart + evidence record Policy Orchestration In build privacy model · approval · retention, decided and recorded in one place credential scope release gate suite policy per zone Customer KMS / HSM keys stay in customer custody Records that move what could not be reduced PQC Gateway re-establishes TLS 1.3 with hybrid X25519 + ML-KEM-768 In build key lifecycle · PKCS#11 · no long-term key held by the gateway Another zone or recipient partner · regulator · another data centre protected in transit
Fig. 1 Four modules under one policy surface Counterparts replace production copies, so fewer records leave the boundary. The records that still have to move cross it through the PQC Gateway. Policy Orchestration governs both lines and holds no production records and no key material. SVGPNG

Modules

Each module states its own state and boundary.

The Counterpart Engine ships today. The other three are in build or pilot, and each module states its own state and boundary rather than borrowing the suite's.

Module 02 - DataShipping product

Governed counterparts instead of production copies.

The Counterpart Engine reads schema and distributions behind the data boundary and produces relational and tabular counterparts, with utility measured separately for each task they are meant to support.

The privacy model is declared
Each workload carries a defined privacy model, its parameters and its limitations, and all three travel with the release.
Utility is measured per task
Structural fidelity, statistical fidelity and downstream performance are reported separately, because material fit for load testing is not automatically fit for model training.
Referential integrity survives
Keys, cardinality and cross-table constraints are preserved, so applications behave as they do against production.
Interfaces
JDBC · ODBCCDC streamsParquet · CSVCI runners
Evidence produced

Methods, parameters, results and limitations per release, under a release identifier that stays inspectable afterwards.

Boundary

Current scope is relational and tabular data. Complete behavioural replication of an enterprise system is not a current product claim, and testing cannot prove the absence of every future attack.

Pipeline

From production boundary to accepted release.

PRODUCTION BOUNDARY 1 Profile schema, cardinality, distributions and constraints, read in place Rows stay in the source zone; only a statistical profile is kept 2 Generate under the declared privacy model; referential integrity preserved Generation runs in the same zone as the source system 3 Measure structure, statistics and task results, reported separately Reads the counterpart and the profile, not production records WHAT STAYS INSIDE profile draft 4 Release counterpart + evidence record under an inspectable release ID accepted by a named owner Only the counterpart and its evidence record cross the boundary
Fig. 2 From production boundary to accepted release Profiling, generation and measurement all run behind the data boundary. Only the accepted counterpart and its evidence record cross it. SVGPNG

  1. Profile

    Schema, cardinality, distributions and constraints are profiled in place, behind the data boundary. Nothing is copied out at this stage.

  2. Generate

    Counterparts are generated against the declared privacy model, preserving referential integrity across tables so applications behave as they do against production.

  3. Measure

    Structural fidelity, statistical fidelity and downstream task performance are measured separately, and limitations are written down where a counterpart is not fit for a purpose.

  4. Release

    The accepted counterpart leaves with its evidence record: methods, parameters, results, limitations and a release identifier that stays inspectable.

Migration path

From inventory to post-quantum, in a defensible order.

01 Cryptographic inventory every flow listed and ranked DELIVERABLE A cryptographic inventory with a retention horizon per flow and a ranked exposure list 02 Reduce what moves production copies withdrawn DELIVERABLE Governed counterparts per workload, with utility and limitations recorded per task 03 Hybrid key establishment what remains: hybrid transport DELIVERABLE Hybrid transport per zone, with a key rotation policy and negotiation records 04 PQC-preferred post-quantum by default DELIVERABLE A re-encryption register per archive, with a residual-risk statement
Fig. 3 From inventory to post-quantum Four steps in a defensible order: list every flow, withdraw the production copies that are not needed, protect what remains with hybrid key establishment, then prefer post-quantum. The squares are illustrative proportions, not measurements. SVGPNG

  1. Cryptographic inventory

    Adapters record which systems use which algorithms, where keys are held, and which flows stay sensitive for longer than their current cryptography will hold.

  2. Reduce what moves

    Before transport is rebuilt, unnecessary production copies are withdrawn. Counterparts replace them across development, test, analytics and AI work.

  3. Hybrid key establishment

    The PQC Gateway negotiates X25519 and ML-KEM-768 together, so a failed post-quantum negotiation does not cost confidentiality.

  4. PQC-preferred and re-encryption

    New connections prefer post-quantum by default. Long-lived archives are re-encrypted and re-signed in order of retention horizon and risk.

Deployment model

Where the data sits decides where the suite runs.

Managed service Control plane operated by Qualimetrix CUSTOMER CLUSTER Production records never leave this zone Counterpart Engine runs here Customer KMS Qualimetrix holds no key material policy in · counterparts and evidence out, nothing else Private cloud Qualimetrix signed images · policy bundles CUSTOMER CLOUD ACCOUNT Production records never leave this zone Counterpart Engine runs here Control plane + KMS / HSM owned by the customer installed with Helm charts by the customer platform team On-premises Qualimetrix signed artefacts CUSTOMER DATA CENTRE · air-gapped Production records never leave this zone Counterpart Engine runs here Control plane + HSM no external key exchange transferred offline; no network path
Fig. 4 Three deployment topologies In all three topologies production records and the Counterpart Engine stay inside the customer zone. What changes is who operates the control plane and how software reaches the zone. SVGPNG

Managed service.

Qualimetrix operates the control plane. Production records stay behind the customer boundary: the Counterpart Engine runs as a job inside the customer cluster, and only counterparts and evidence leave it.

Key custody
Customer KMS; Qualimetrix holds no key material
Operated by
Qualimetrix, within a documented support boundary

Private cloud.

The suite is installed in the customer cloud account through Helm charts. Qualimetrix supplies signed images, upgrade paths and policy bundles; the customer platform team owns the namespaces.

Key custody
Customer KMS or HSM via PKCS#11
Operated by
Customer platform team, with Qualimetrix on call

On-premises.

An air-gapped installation for environments that cannot reach a public network. Images and policy bundles transfer as signed artefacts, and the release record is produced locally.

Key custody
Customer HSM, with no external key exchange
Operated by
Customer team, with quarterly review sessions

On the wire

Post-quantum costs bytes.

X25519 and ML-KEM-768 are negotiated together, so a failed post-quantum negotiation leaves the session classically protected. SLH-DSA signing of long-lived artefacts is in progress and is not available in a supported release.

CLIENT browser, or the calling zone EDGE Caddy at qubithub.io, or a PQC Gateway ClientHello · key_share X25519 public key (32 B) + ML-KEM-768 encapsulation key (1 184 B) ServerHello · key_share X25519 public key (32 B) + ML-KEM-768 ciphertext (1 088 B) shared secret = ML-KEM secret ‖ X25519 secret fed into the TLS 1.3 key schedule; breaking one half is not enough derives it derives it
Fig. 5 Hybrid key establishment Client and edge exchange a classical and a post-quantum key share in the same TLS 1.3 handshake. The session key depends on both, so traffic recorded today stays protected unless both are broken. SVGPNG

Fixed sizes from the standards

ML-KEM-768 public key
1 184 B
ML-KEM-768 ciphertext
1 088 B
ML-DSA-65 signature
3 309 B
SLH-DSA-128s signature
7 856 B
Boundary

The sizes follow from the published standards FIPS 203, FIPS 204 and FIPS 205. Handshake time and throughput depend on the environment and are measured during an assessment; no performance figure is claimed here.

Current scope

What is contractable today, and what is not.

What is contractable today, and what is not.
CapabilityStateBoundary
Relational and tabular counterpartsShippingLongitudinal, event and telemetry data remain design-partner only
Hybrid PQC transport, ML-KEM-768 and ML-DSA-65In buildAvailable to design partners; no CMVP or CAVP validation is claimed
Long-lived artefact signing, SLH-DSA-128sIn progressNot yet available in a supported release
Policy orchestration and approval gatesIn buildDecision log is complete; retention automation is partial
Source, key and delivery adaptersPilotRelational sources first; message-bus adapters are pilot scope
Information security management systemIn preparationISO/IEC 27001 certification is not yet held
Boundary

Statuses refer to implementation inside Continuum modules, not to certification. No CMVP or CAVP validation is claimed, and ISO/IEC 27001 is in preparation.

Control mapping

Which module touches which article.

Which module touches which article.
ControlModuleReference
Data minimisation in non-production environmentsCounterpart EngineGDPR Art. 5(1)(c) · 25
Security of processing, encryption in transitPQC GatewayGDPR Art. 32
Records of processing activitiesPolicy OrchestrationGDPR Art. 30
De-identification of protected health informationCounterpart EngineHIPAA §164.514
Transmission securityPQC GatewayHIPAA §164.312(e)(1)
Audit controls over releasesPolicy OrchestrationHIPAA §164.312(b)
Cryptography and key management measuresPQC GatewayNIS2 Art. 21(2)(h)
Supply chain and access control measuresAdaptersNIS2 Art. 21(2)(d)
ICT risk management and protectionPolicy OrchestrationDORA Art. 9
Third-party and sub-processor boundariesAdaptersDORA Art. 28 · GDPR Art. 28
Boundary

References are indicative and support an assessment of your own. They are not legal advice and not a statement of compliance.

Evidence

Every release ships its own record.

The evidence pack is a first-party technical record: methods, parameters, results, limitations and a release identifier. It is not an independent certification and does not claim to be one.

What an accepted release carries.

Methods and parameters
The privacy model, its parameters and the generation configuration used for this release.
Utility results
Structural, statistical and downstream measurements, reported per task rather than as one score.
Limitations
Where the counterpart is not fit for a purpose, written into the record rather than left to inference.
Release identifier
A reference that stays inspectable after the release has been used downstream.
Residual risk
What remains after the controls described, stated in terms a reviewer can act on.
Why per task

One number hides the failure.

Material fit for load testing is not automatically fit for model training or for prevalence estimates. Each task is measured on its own terms, and a task that was not measured is recorded as not measured.

Held-out evaluation

Measured against records it never saw.

Downstream results compare the counterpart against real records held out of generation. Degraded groups are named in the record rather than averaged away.

Terms used precisely

The vocabulary a reviewer will ask about.

A parameter quoted without its privacy unit, adjacency definition and contribution bounds cannot be compared across systems. Qualimetrix states all four, and states which of them a workload does not use.

Privacy unit
The entity whose contribution is bounded: usually a person, sometimes an episode of care.
Adjacency definition
The pair of datasets a formal guarantee is stated over.
Contribution bounds
The cap on how much a single privacy unit can influence a release.
Composition
How repeated releases from the same source accumulate disclosure risk.
Held-out real evaluation
Measurement against real records that were never used to build the counterpart.
Cumulative consumption
The budget already spent across accepted releases from one source.
Boundary

A first-party record supports a bounded conclusion. It is not an independent audit, not a certification, and not a warranty of fitness for a purpose Qualimetrix has not measured.

Engagement

Five steps before acceptance.

Each step produces a written artefact. A step is not complete until the named owner has accepted the evidence attached to it.

  1. Scope

    Workload, data boundary and the decision the evidence must support

  2. Inventory

    Algorithms, key custody and retention horizon per flow

  3. Reduce

    Counterparts replace production copies in non-production environments

  4. Protect

    Hybrid transport for the exchanges that remain

  5. Dossier

    Methods, results, limitations and residual risk in one record

Bring a workload to Continuum

Bring the workload, data boundary and decision the evidence must support.

Request assessmentWhat to include