Flowintent / proof
Loading security
Skip to content
Flowintent / proof
Security
Trust boundaries for quantum teams.
Private workspaces, sealed provider access, RBAC, reviewer-safe evidence, procurement checkpoints, and post-quantum readiness presented in a calm security surface.
private by default
Private workspacerole-gated operations
Sealed accessprovider token boundary
PQC postureNIST standards tracked
Approved proofreview-safe evidence
Post-Quantum Badges
Downloaded, local, neutral badges for the security surface.
Command mesh
One view for private access, PQC posture, inventory, and approved proof.
PQC standards stack
A practical map of ML-KEM, ML-DSA, SLH-DSA, and migration controls.
Crypto inventory radar
Cryptographic assets and dependency signals before migration work starts.
Evidence boundary
Private execution context is filtered into approved reviewer-safe proof.
Data Privacy
Share proof. Keep operations private.
Stays Private
provider tokensbilling stateadmin notesdraft workspaces
Can Be Shared
result pagescertificatescountsreview links
Procurement Checklist
Enterprise review starts with ordinary SaaS controls.
Post-quantum readiness matters, but procurement first needs direct answers on auth, RBAC, key handling, audit posture, retention, compliance status, and disclosure process.
Area
Status
Detail
Area
Authentication
Status
Auth.js v5 with credentials and optional GitHub OAuth
Detail
SAML/OIDC enterprise SSO should be treated as pilot or enterprise scope unless separately enabled.
Area
RBAC
Status
Permission-based roles
Detail
Admin access requires `admin.access` and fresh DB-backed session checks.
Area
Provider keys
Status
Server-side encrypted
Detail
Provider credentials and OAuth tokens are encrypted with AES-256-GCM through `QW_ENCRYPTION_KEY`.
Area
Tenant boundary
Status
Workspace and role gated
Detail
Private workspaces, provider setup, billing, admin notes, and draft records stay out of reviewer shares.
Area
Audit and evidence
Status
Run and review trail
Detail
Evidence pages can show circuit, source, result, trace, and certificate context without raw provider secrets.
Area
Retention and deletion
Status
Review during procurement
Detail
Confirm retention windows, deletion SLAs, backup policy, and region needs during enterprise pilot setup.
Area
Compliance status
Status
Roadmap, not certification claim
Detail
Do not infer SOC 2, ISO 27001, or provider certification unless a current signed report is supplied.
Area
Disclosure
Status
Security contact published
Detail
Use the public security contact for responsible disclosure and procurement security review.
Post-Quantum Crypto
NIST standards shown as posture, not certification theater.
The page now separates what is a product security boundary from what is a migration-readiness signal, so badges do not imply a third-party audit that has not happened.
FIPS 203
ML-KEM
Primary NIST key-establishment standard for post-quantum migration planning.
FIPS 204
ML-DSA
Primary NIST digital-signature standard tracked in readiness reviews.
FIPS 205
SLH-DSA
Stateless hash-based signature standard used as a diversity and backup signal.
Migration Shape
Modern PQC readiness starts with inventory.
The security page now mirrors the 2026 migration conversation: discover cryptography, understand vendor ownership, keep algorithm choices agile, then expose only safe evidence.
Inventory first
Map public-key usage, certificates, dependencies, and exposed protocols before picking rollout scope.
Vendor boundary
Track which providers, SDKs, and hosted services control cryptographic implementation details.
Crypto-agility
Keep configuration, evidence, and provider routing ready for staged algorithm changes.
Review evidence
Show readiness state without exposing private keys, credentials, or admin-only records.
Provider boundary
keys sealed
queues private
roles enforced
Evidence boundary
result page
certificate page
review-safe link
Private execution, public-safe proof.
Review packets should carry enough context to verify a result without leaking provider keys, user records, admin notes, or billing state.