Open QubitHub

Diagrams

Every figure, in one place.

The architecture and flow diagrams for both products, as they appear across this site. Each can be downloaded as SVG or PNG, in a light and a dark version, for a document or a slide.

QubitHub Continuum

QubitHub

real computation in this build mock service, labelled not connected BROWSER · public code only, no credentials Playground visual + OpenQASM Industry demos 6 workflows Benchmarks suites × backends JobDraft InferenceService single entry point for every job 1 validate backend · quota · role · gates 2 record JobRecord + reproducibility data 3 dispatch to the backend's provider 4 poll status · queue position · logs 5 enforce timeout cancels where the provider can 6 store result counts + provenance label QuantumProvider interface submit · poll · cancel · health LocalSimulatorProvider State-vector simulator, ≤ 20 qubits Web Worker · seeded sampling MockCloudProvider Shared pool · Aurora-7 · Kestrel-27 fault sandbox · all labelled mock HttpGatewayProvider HTTPS to /v1/jobs · poll · cancel no provider keys in the browser dispatch secret boundary SERVER · holds provider credentials Quantum hardware not connected in this build Upstream adapter stub: add a provider SDK Server simulator same engine API gateway /v1/backends · /v1/jobs rate limit · bearer token keys stay in its environment HTTPS runs routes SDK call JOB LIFECYCLE · identical for every backend queued running completed cancelled failed timed_out accepted execution starts result stored cancel error exceeds timeout Terminal states are final. The same circuit, backend version, parameters, shots and seed reproduce the same counts.
Fig. 1 How a job runs Every job enters through one service, which validates, records and dispatches it to a provider. Provider credentials exist only on the server side of the secret boundary, and every backend follows the same lifecycle. SVG · lightSVG · darkPNG · lightPNG · dark
1 Illustrative data fictional or synthetic, downloadable as CSV Sample 2 Formulation the question as a cost, Hamiltonian or oracle 3 Quantum circuit parameterised gates; opens in the Playground 4 Run as a job browser · shared pool · Aurora-7 noisy profile Simulated 5 Classical baseline exact or brute force, on the same formulation Simulated 6 Labelled result metric + seed, versions, fingerprint per job Reproducible same formulation, solved exactly measured counts
Fig. 2 One workflow for every industry demo All six industry demos follow the same six stages. The formulation is also solved exactly on a classical computer, so every simulated quantum result is shown next to its baseline. SVG · lightSVG · darkPNG · lightPNG · dark
TLS 1.3 at the edge · hybrid key establishment X25519MLKEM768 (ML-KEM-768, FIPS 203) · falls back to X25519 for older clients WHAT HAPPENS WHAT PROTECTS EACH STEP 1 Request access name · organisation · requested role · reason Argon2id, memory-hard + server pepper 2 Pending no access yet; the super admin is emailed account state: pending nothing is granted 3 Approval the super admin approves and assigns a role role enforced server-side entry in the audit log 4 First sign-in password, then enrol an authenticator app AES-256-GCM at rest 10 recovery codes 5 Every sign-in password + 6-digit one-time code HMAC code (RFC 6238) single use · rate limited 6 Session 12 h absolute · 2 h idle revocable on the server 256-bit random token stored as SHA-256 hash
Fig. 3 Access by approval, sign-in without RSA or elliptic curves An account goes from request to approval to a two-step sign-in. No step of the login path depends on RSA or elliptic-curve cryptography; the edge negotiates a hybrid post-quantum key exchange. SVG · lightSVG · darkPNG · lightPNG · dark
Browser any client OVHCLOUD PUBLIC CLOUD Load balancer public address TLS 1.3 X25519MLKEM768 MANAGED KUBERNETES · private network Caddy edge Let's Encrypt · PQ TLS qubithub-app web + API qubithub-app web + API sticky cookie migrate Job on every deploy db-backup CronJob nightly pg_dump non-root · read-only root · only Caddy reaches the app Managed PostgreSQL 17 HA · point-in-time recovery Object Storage versioned · encrypted CA-verified TLS private endpoint backups Private registry signed image pull GitHub Actions CI · scans · deploy push image kubectl apply: secrets, migrations, rollout terraform apply: network, cluster, database, registry, storage
Fig. 4 Production deployment on OVHcloud QubitHub runs on OVHcloud Public Cloud: a load balancer in front of a Caddy edge and the application on Managed Kubernetes, with Managed PostgreSQL and Object Storage behind a private network. GitHub Actions builds, scans, provisions and deploys. SVG · lightSVG · darkPNG · lightPNG · dark

Continuum

PRODUCTION BOUNDARY · customer zone Source systems Postgres · Oracle · SQL Server · CDC Adapters profile in place, least privilege Pilot Counterpart Engine profile → generate → measure, all inside the boundary Shipping Non-production consumers dev · test · analytics · AI validation · collaboration counterpart + evidence record Policy Orchestration In build privacy model · approval · retention, decided and recorded in one place credential scope release gate suite policy per zone Customer KMS / HSM keys stay in customer custody Records that move what could not be reduced PQC Gateway re-establishes TLS 1.3 with hybrid X25519 + ML-KEM-768 In build key lifecycle · PKCS#11 · no long-term key held by the gateway Another zone or recipient partner · regulator · another data centre protected in transit
Fig. 5 Four modules under one policy surface Counterparts replace production copies, so fewer records leave the boundary. The records that still have to move cross it through the PQC Gateway. Policy Orchestration governs both lines and holds no production records and no key material. SVG · lightSVG · darkPNG · lightPNG · dark
PRODUCTION BOUNDARY 1 Profile schema, cardinality, distributions and constraints, read in place Rows stay in the source zone; only a statistical profile is kept 2 Generate under the declared privacy model; referential integrity preserved Generation runs in the same zone as the source system 3 Measure structure, statistics and task results, reported separately Reads the counterpart and the profile, not production records WHAT STAYS INSIDE profile draft 4 Release counterpart + evidence record under an inspectable release ID accepted by a named owner Only the counterpart and its evidence record cross the boundary
Fig. 6 From production boundary to accepted release Profiling, generation and measurement all run behind the data boundary. Only the accepted counterpart and its evidence record cross it. SVG · lightSVG · darkPNG · lightPNG · dark
01 Cryptographic inventory every flow listed and ranked DELIVERABLE A cryptographic inventory with a retention horizon per flow and a ranked exposure list 02 Reduce what moves production copies withdrawn DELIVERABLE Governed counterparts per workload, with utility and limitations recorded per task 03 Hybrid key establishment what remains: hybrid transport DELIVERABLE Hybrid transport per zone, with a key rotation policy and negotiation records 04 PQC-preferred post-quantum by default DELIVERABLE A re-encryption register per archive, with a residual-risk statement
Fig. 7 From inventory to post-quantum Four steps in a defensible order: list every flow, withdraw the production copies that are not needed, protect what remains with hybrid key establishment, then prefer post-quantum. The squares are illustrative proportions, not measurements. SVG · lightSVG · darkPNG · lightPNG · dark
Managed service Control plane operated by Qualimetrix CUSTOMER CLUSTER Production records never leave this zone Counterpart Engine runs here Customer KMS Qualimetrix holds no key material policy in · counterparts and evidence out, nothing else Private cloud Qualimetrix signed images · policy bundles CUSTOMER CLOUD ACCOUNT Production records never leave this zone Counterpart Engine runs here Control plane + KMS / HSM owned by the customer installed with Helm charts by the customer platform team On-premises Qualimetrix signed artefacts CUSTOMER DATA CENTRE · air-gapped Production records never leave this zone Counterpart Engine runs here Control plane + HSM no external key exchange transferred offline; no network path
Fig. 8 Three deployment topologies In all three topologies production records and the Counterpart Engine stay inside the customer zone. What changes is who operates the control plane and how software reaches the zone. SVG · lightSVG · darkPNG · lightPNG · dark

Shared by both products

CLIENT browser, or the calling zone EDGE Caddy at qubithub.io, or a PQC Gateway ClientHello · key_share X25519 public key (32 B) + ML-KEM-768 encapsulation key (1 184 B) ServerHello · key_share X25519 public key (32 B) + ML-KEM-768 ciphertext (1 088 B) shared secret = ML-KEM secret ‖ X25519 secret fed into the TLS 1.3 key schedule; breaking one half is not enough derives it derives it
Fig. 9 Hybrid key establishment Client and edge exchange a classical and a post-quantum key share in the same TLS 1.3 handshake. The session key depends on both, so traffic recorded today stays protected unless both are broken. SVG · lightSVG · darkPNG · lightPNG · dark

The company view

QUANTUM AS A CAPABILITY QubitHub An open commons to discover, run and share quantum workloads Catalog circuits · datasets Playground visual + OpenQASM Job API one interface Real state-vector simulator today hardware providers plug in through a server-side gateway QUANTUM AS A THREAT TO TODAY'S ENCRYPTION Continuum Governed synthetic data and quantum-safe transport Counterpart Engine fewer production copies PQC Gateway hybrid transport for the rest Reduce what must be shared, then protect what still moves Policy Orchestration decides and records · Adapters connect SHARED GROUND Hybrid key establishment X25519 + ML-KEM-768 (FIPS 203) A record with every result provenance labels · evidence packs Limits stated next to claims what is real, in build or not connected live at its edge · labels every result built into the gateway · evidence per release
Fig. 10 Two products, one stance QubitHub treats quantum computing as a capability to build with; Continuum treats it as a threat to the encryption that protects long-lived records. Both rest on the same hybrid key establishment and the same habit of attaching a record to every result. SVG · lightSVG · darkPNG · lightPNG · dark