PQC Data Protection Tool
Protect long-lived data against tomorrow's computers.
Qontomcrypt encrypts your files with AES-256-GCM and delivers keys through a hybrid post-quantum envelope.
The problem
Data recorded today can be unlocked later.
A quantum computer powerful enough to break today's public-key cryptography does not yet exist. But adversaries are collecting encrypted data now, intending to decrypt it once that capability arrives. This is the harvest-now, decrypt-later threat. For organisations that hold medical records, financial contracts, legal documents or state information, the exposure window is already open. Replacing encryption across an organisation takes years. The time to act is before the threat matures, not after.
The average cryptographic migration takes [CONFIRM] years. Quantum-capable hardware is projected to arrive within [CONFIRM] years.
How it works
Three steps. No new infrastructure required.
Sign in
Authenticate with your organisation's existing identity provider. No separate accounts or passwords to manage.
Encrypt
Each file receives its own random data key, encrypted under your organisation key. The organisation key is wrapped in a hybrid post-quantum envelope using ML-KEM-768 combined with X25519.
Decrypt and verify
Integrity is checked before the file is returned. If the file has been altered since encryption, decryption is refused.
What you get
Designed for regulated environments.
Organisation sign-in
Integrates with your existing identity provider. No separate credentials.
A unique key for every file
Each file is encrypted with its own random data key. Compromise of one key does not affect others.
Hybrid post-quantum key delivery
Organisation keys are wrapped using ML-KEM-768 combined with X25519, providing protection against both classical and quantum attacks.
Keys held in browser memory only
Keys are never written to disk. They are wiped automatically on lock, logout, or 15 minutes of inactivity.
Integrity check on every decrypt
Authenticated encryption ensures that any modification to a file is detected before the content is returned.
Opens older formats
Files encrypted before a key rotation or format change can still be decrypted, provided the appropriate key material is available.
Activity log
Every encrypt and decrypt operation is recorded with a timestamp, user identity and file reference.
Protection layers
How protection is layered.
| Layer | Method | Quantum status |
|---|---|---|
| Credentials and key delivery | ML-KEM-768 plus X25519 hybrid (NIST FIPS 203) | Post-quantum, hybrid |
| Stored data | AES-256-GCM | Symmetric, generally considered quantum-resistant |
| Data key wrapping | Wrapped by the organisation key | [CONFIRM] |
We show what each layer does and does not cover.
What is coming next.
The following capabilities are on the roadmap. They are not yet available. Timelines are subject to change.
Frequently asked questions
Questions we are asked most often.
Get started
Request a briefing.
Speak with a Qontomcrypt specialist about how the PQC Data Protection Tool fits your organisation's data protection requirements.