FLAGSHIP PRODUCT PROFILE · BROWSER · API · FILE · EMAIL PROTECTION

QuantumSafe Data Shield
Controlled pilot

Protect selected fields, files, messages and API payloads before they cross shared infrastructure, using versioned hybrid/PQC envelope profiles and protected backend key services.

Try interactive demo Open product manual Readiness passport →

CUSTOMER PROBLEM

TLS can terminate at gateways, proxies or service meshes. Sensitive payloads may still be exposed to shared infrastructure, logs, backups or future harvest-now-decrypt-later attacks.

Protect selected fields, files, messages and API payloads before they cross shared infrastructure, using versioned hybrid/PQC envelope profiles and protected backend key services.

OPERATING WORKFLOW

QuantumSafe Data Shield: from source input to governed outcome.

Every step names a product responsibility rather than a generic security box.

Load protection policy

Load an approved browser/client protection profile

Select protected data

Select protected fields, files or message content

Establish hybrid session

Establish a short-lived hybrid/PQC content-key session

Encrypt and bind context

Encrypt and bind origin, transaction, nonce and policy metadata

Route ciphertext through gateway, email…

Route ciphertext through gateway, email or storage infrastructure

Decrypt in protected zone

Decrypt only in the authorized backend and erase session keys

END-TO-END PROTECTED DATA ARCHITECTURE

Keep sensitive payloads encrypted across shared infrastructure and expose plaintext only inside the approved backend boundary.

Client protection, protected envelopes, ciphertext-only routing, HSM-backed decryption and cross-cutting policy are shown as distinct security zones.

SOURCE INPUTS

Sensitive fieldsJSON payloadFiles / messages

CLIENT SECURITY ZONE

Browser & Client SDK

Selects protected fields, binds origin and transaction context, and encrypts before the application submits data.

CLIENT ZONE

QuantumSafe Envelope

Carries algorithm identifiers, encapsulated key references, AEAD metadata, nonce, transaction ID and policy version.

PROTECTED PAYLOAD

CIPHERTEXT-ONLY ZONE

API & Message Gateway Adapter

Authenticates and routes protected envelopes while preventing intermediary logs and middleware from receiving plaintext.

CIPHERTEXT ONLY

PROTECTED BACKEND ZONE

HSM-backed Decryption Service

Performs approved decapsulation or unwrap, authenticated decryption and immediate session-key zeroization.

PROTECTED BACKEND

Secure Email & File Connector

Packages protected files or message bodies for controlled recipient onboarding, retrieval and enterprise recovery.

CONTROLLED DELIVERY

GOVERNED OUTPUTS

Authorized serviceControlled recipientAudit evidence

INTERFACES & PROFILES

JavaScript/WebAssembly SDK
REST/OpenAPI
Email/file connector
HSM/KMS
Windows CNG/KSP option
Audit/event API

USE CASES

Internet-banking credentials
eCitizen and identity payloads
Secure email and attachments
File/API protection beyond TLS termination

PRODUCT READINESS PASSPORT

Decision-grade facts before product evaluation.

Browser-local envelope demo, client-SDK contract, protected-backend API model and policy/audit design.

Public profile ID: QS-DSS-2026.07
Website profile release: 2026.07 / v8.0
Current maturity: Controlled Pilot
Deployable scope: On-premises or private-cloud gateway with approved HSM/KMS-backed backend service.
Interactive demo: Available — AES-GCM envelope workflow demonstrating client-side protection.
Product manual: Available — profile-specific manual.
API publication: Reference API published for profiles, envelopes, protected decryption and audit events.
Test corpus: Field, JSON payload, file, replay, origin-binding and rotation scenarios.
Compatibility: Browser, mobile, gateway, email and HSM combinations require release-specific validation.
Independent assessment: Independent penetration test and source review are not yet published.
Support model: Controlled enterprise pilot with approved origin, data class, backend boundary and failure policy.
Commercial route: Controlled pilot; production availability requires an approved cryptographic profile and assessment.

PRODUCT BOUNDARIES

What the public profile does—and does not—claim.

These boundaries preserve accuracy while keeping the product value visible.

RELATED PLATFORM MODULES

Deep technical profiles behind this flagship product.

EVALUATE