Sovereign Systems Labs · Quantum security
Find the encryption a quantum computer will break
Check any TLS, SSH or mail server for post-quantum key exchange, and get the fix and the evidence.
This session
Workspace
Assets
Every server you check appears here. The list stays in this browser until you choose to monitor it.
| Grade | Endpoint | Key exchange | Exposure | ML-KEM-1024 | Hosted by | Reg. | Score | Checked |
|---|
Nothing checked yetScan a domain from the overview, or press ⌘K and type a hostname. Results land here, ready to export.
Ontology
Cryptographic graph
Endpoints linked to their key exchange, host and registered country.
Geography
Exposure map
Endpoints placed where their address block is registered. Drag to turn.
Post-quantumPartialClassical onlyNo response
Quantum Readiness Index
AustraliaGlobal, by industry
Whether post-quantum key exchange was observed on each organisation's main public website, checked from Cloudflare's edge. A point-in-time technical observation, not a security rating. Method and removal requests.
By industry · post-quantum observed
Over time
| Organisation | Industry | Endpoint | Key exchange observed | Post-quantum | Observed |
|---|
Crypto Lab · runs on this device
On-device cryptography
ML-KEM-1024 · ML-DSA-87 · AES-256-GCM · SHA-512, the parameter sets ASD and NSA CNSA 2.0 specify. Files never leave this device. Works offline.
Your identity
No identity loaded. Create one, or load the private key file you saved earlier.
Seal a file
Sign with ML-DSA-87. Any change to the file is detected.
Encrypt a file
ML-KEM-1024, HKDF-SHA-512, AES-256-GCM.
Analyse firmware
Static scan for RSA, elliptic-curve, legacy-hash and post-quantum code in binaries and firmware.
Fix a config file
nginx, Apache, HAProxy, OpenSSH, OpenSSL, Caddy, Terraform or CloudFormation. Findings and a patched copy, on this device.
Scan source code
RSA, elliptic-curve, Diffie-Hellman and weak-hash use, embedded private keys and existing post-quantum code in Java, Python, Go, JavaScript, TypeScript, C, C++, C# and Rust. File and line, the native replacement, and a CBOM. Files are read on this device; only the names and versions of crypto dependencies are checked against OSV.dev.
Mosca's theorem
When does your data become readable?
If the years your data must stay secret plus the years it takes to migrate exceed the years until a cryptographically relevant quantum computer exists, that data is already lost to anyone recording it.
What moved the estimate
- 2025Global Risk Institute survey28 to 49% chance of a cryptographically relevant quantum computer within 10 years; 51 to 70% within 15.
- 2025Gidney (Google)RSA-2048 could fall to under one million noisy qubits in under a week.
- 2026US executive orderFederal high-value systems on post-quantum key establishment by 31 Dec 2030.
- 2024NIST FIPS 203 / 204 / 205ML-KEM, ML-DSA and SLH-DSA became standards, so migration can start now.
Engagements
Plans
Monitoring plans and fixed-scope engagements. Paid work is delivered under a written agreement. Prices exclude taxes.
Services
Contact
Frameworks by industry
API, CLI and agents
Put quantum exposure in your pipeline
The same engine runs at the edge, on your laptop, in CI and inside an air-gapped network. Results are plain JSON and CycloneDX.
HTTP API
Public, CORS-enabled, 30 checks a minute. Send an API key from Monitor to tie checks to your organisation.
Sensor CLI · any OS
One file. Needs Node 20+ (Bun and Deno work too). Reaches private ranges, any port, and in-country hosts the cloud can't see.
CI gate
Fail a deploy when an endpoint stops negotiating ML-KEM.
AI agents (MCP)
Give Claude or any MCP client the tools scan_endpoint, discover_subdomains, quantum_index, analyze_code, check_dependencies and fix_config.
Sensor mesh
Run the sensor inside each network, site or country. Every sensor reports into one Monitor: internal and geo-blocked endpoints included, results kept to your organisation.
SIEM rules
Downgrade and exposure alerts from watch --jsonl, mapped to MITRE ATT&CK T1562.010.
Status badge
Show customers and auditors your live grade.
Self-host
Run the full console inside your network with Docker.
docker build -t sovereign-q . docker run --rm -p 8787:8787 sovereign-q # then open http://localhost:8787/security/
Effective 2 November 2026
Terms of Service
1. Who we are
Sovereign Q is operated by Sovereign Systems Labs ("we", "us"), Sydney, Australia. These terms govern sovereignsystemslabs.com/security, its API and MCP endpoint, and the sensor CLI (the "Service").
2. Acceptance
By using the Service you agree to these terms. If you use it for an organisation, you confirm you can bind that organisation.
3. Authorised use only
Only check systems you own or are authorised to test. A check opens a connection, reads the server's TLS or SSH hello and closes it. It does not complete a session, send application data or attempt exploitation. You must not use the Service to break any law, test systems without authority, disrupt any service, evade rate limits, or resell the Service without our written consent.
4. Results are information, not advice
Results are automated, point-in-time technical observations. Analyst answers are generated by an AI model and can be wrong. They can be incomplete or wrong, for example when a content delivery network, firewall or geographic restriction sits in front of a server, or where a result is marked inferred. They are not an audit, certification, rating, or legal or compliance advice. You are responsible for decisions you make with them.
5. Quantum Readiness Index
The index reports whether post-quantum key exchange was observed on the main public website of listed organisations at a point in time. It is not a statement about any organisation's overall security. Names and trademarks belong to their owners; listing does not imply endorsement or any relationship. Organisations can request correction or removal through the contact form on the Plans page, and we act on reasonable requests promptly.
6. Accounts and keys
Keep your passkeys and API keys secure; you are responsible for activity under your account. We may suspend access that breaches these terms or puts the Service at risk.
7. Paid plans and services
Paid plans and professional services are provided under a separate written agreement, which prevails over these terms for that work. Prices shown are indicative and exclude taxes.
8. Crypto Lab and CLI
Lab tools run in your browser and the CLI runs on your systems; we never receive those files or keys. Keep backups: lost keys cannot be recovered.
9. Intellectual property
We own the Service. You own your data and the outputs generated for you, such as reports, CBOMs and seals.
10. Disclaimer
To the maximum extent permitted by law, the Service is provided "as is" and "as available", without warranties of any kind, including accuracy, fitness for a particular purpose or uninterrupted availability.
11. Australian Consumer Law
Nothing in these terms excludes, restricts or modifies any guarantee, right or remedy that cannot lawfully be excluded, including under the Australian Consumer Law. Where liability for breach of such a guarantee can be limited, it is limited, at our option, to supplying the services again or paying the cost of having them supplied again.
12. Limitation of liability
To the maximum extent permitted by law, we are not liable for indirect, incidental, special or consequential loss, or for loss of profit, revenue, data or goodwill. Our total liability arising out of or in connection with the Service is limited to the greater of the fees you paid us for the Service in the 12 months before the claim and A$100.
13. Indemnity
You indemnify us against claims arising from your breach of these terms, including use of the Service against systems you were not authorised to test.
14. Changes
We may change the Service and these terms. The effective date above will change, and continued use means you accept the updated terms.
15. Governing law
These terms are governed by the laws of New South Wales, Australia. The courts of New South Wales have non-exclusive jurisdiction.
16. Contact
Use the contact form on the Plans page.
Effective 2 November 2026
Privacy Policy
Sovereign Systems Labs handles personal information under the Australian Privacy Act 1988 and, where they apply, the EU and UK GDPR.
What we collect and why
- Account: work email, organisation, region and industry, to provide your account. Passkey sign-in stores only a public key; we never receive biometrics or passwords.
- Session: one strictly necessary cookie that keeps you signed in. We store only a hash of it, and it expires after 30 days.
- Checks: the hostnames you check and their results, to cache results, keep history, run monitoring and maintain the public index.
- Monitoring: your endpoints, alert history, webhook URL and API keys, which we store only as one-way hashes.
- Contact requests: your email, organisation and message, used only to reply. For business email domains we also check that domain's public endpoint so we can prepare for the conversation.
- Analyst: if you ask a question, the question and the results on screen are sent to Cloudflare Workers AI to generate the answer. We do not store either.
- Discovery: subdomain discovery reads public Certificate Transparency logs and the public pages of the domain you enter.
- Dependency checks: when you scan source code, only the names and versions of its cryptography dependencies are sent, through our server, to OSV.dev to look up known vulnerabilities. Your code stays on your device.
- Sensors: sensors you run send their check results to your organisation's monitor. They are kept with your organisation and never used in the public index.
- Technical: your IP address is used briefly for security and rate limiting and is not stored in our database. Our hosting provider keeps short-lived operational logs. We use no advertising, cross-site tracking or third-party analytics scripts.
Kept only on your device
Your workspace and preferences stay in your browser's local storage. Crypto Lab files and keys never leave your device.
Who processes it
We host on Cloudflare, whose global network may process data outside your country. If email notifications are enabled, they are sent through our email provider. We do not sell or rent personal information.
How long we keep it
Check history: 180 days. Sessions: 30 days. Account data: until you ask us to delete it. Contact requests: as long as needed to respond and to keep business records.
Security
Passkey (WebAuthn) authentication, hashed sessions and keys, TLS everywhere, a strict content security policy and least-privilege access.
Your rights
You can ask to access, correct or delete your information, or withdraw consent, through the contact form on the Plans page. We respond within 30 days. You can also complain to the Office of the Australian Information Commissioner or your local regulator.
Changes
When this policy changes, we update the effective date above.