Which of your connections could be recorded today and read later?

Set up a scan

Your hosts, your data, your rules

• Pick hosts from your company's approved list, each from your signed scan consent.
• Say what each host's traffic carries, so the plan can rank by how sensitive the data is and how long it must stay secret.
• Choose Mid-market or CNSA 2.0.
• Or upload results from your own run of the collector.

The estate at a glance

Then every check, host by host

• Overview answers the first question: "3 of 9 hosts recorded as exposed to harvest-now-decrypt-later."
• Findings lists every check per host and port: what the server would pick, whether recorded traffic is exposed, and the verdict.
• Each finding says who runs the host, as given when the scan was set up, and what the server itself says, such as Cloudflare in its Server header.

What to fix first

Ranked, dated, and owned

• Fixes are ranked by exposure, how sensitive the data is, how long it must stay secret, and whether the host faces the internet.
• Each fix gets a date and, where the server says so, who runs it.
• Grover note per cipher suite: AES-128 keeps 64 bits against Grover's search on paper, and whether it meets CNSA 2.0's AES-256 rule. The PDF adds the published qubit count (Grassl et al. 2016).
• Quantum timeline per finding, in the signed JSON: the error-corrected qubits and Toffoli gates the best published attack needs for that key, with its source paper; which milestone of a published quantum hardware roadmap first reaches that size; and the year the recorded traffic must stay secret until (Mosca's inequality). It's informational and never changes the rank.

"quantum_timeline": {
  "algorithm": "ECC-255",
  "logical_qubits": 2321,
  "toffoli": 1.27e11,
  "source": "Roetteler, Naehrig, Svore & Lauter 2017",
  "roadmap": "IBM Quantum roadmap (June 2025)",
  "beyond": "beyond its largest milestone (Blue Jay, 2033)",
  "secret_until": 2036
}

Evidence for your auditor

Signed once, checked by anyone

• Signed once, with two signatures: Ed25519 and ML-DSA-87. Changing one word breaks both.
• Downloads: the PDF (its appendix holds every file the check needs), the signed JSON, and a CBOM (CycloneDX 1.6).
• Your auditor verifies it offline with OpenSSL: 3.0 or newer for Ed25519, 3.5 or newer for ML-DSA-87. The verifier is public and open source: github.com/EpochCore-LLC/qshield-verify. The keys are at epochcoreqcs.com/qshield-keys/.
• Results you collected yourself are marked that way in the report.
• Download a sample signed report: the Alder example, computed by Q-Shield's own code and signed with a demo key.

History, and a weekly re-check

Email, and Slack if you want it

• Every scan you've run, with its status and its report.
• Turn on the weekly re-check for a finished scan: every Tuesday it re-scans the same hosts.
• It emails you only when a verdict changes, and posts the same message to your Slack channel if you add a link.

Slack · the weekly check's messageExample data

Post-quantum storage for the files that can't wait

Encrypted in your browser

• Step 1: make or load your company's key file. Step 2: pick the scan and server the data came from, label it, choose the file, then Encrypt and upload.
• Each file is encrypted in your browser before it leaves, with a key locked to your key file (ML-KEM-1024 together with X25519). EpochCore can't open it, and if the key file is lost, nobody can.
• Files are checked before encryption; one hiding other content is refused.
• Up to 256 MB per file, 5 GB per account.
• Each upload gets a receipt signed by the storage service, and the scan's signed report lists the files moved.
• Delete removes the encrypted parts and the wrapped key and keeps a deletion record; later reports list the file as deleted.

The encryption libraries your code depends on

The GitHub app

• The GitHub app "EpochCore Q-Shield" only reads code, metadata and pull requests, and posts a commit status. It never changes code.
• On every default-branch push and every pull request it reads the lock files and manifests (npm, PyPI, Cargo, Go, Maven, NuGet), or GitHub's dependency graph when a repository has none.
• A pull request shows what it adds and removes. Files it can't read yet (Gradle, for one) make the check "unknown", and are named.
• When a push adds a library a quantum computer breaks, it emails whoever connected the organization, and posts to Slack if set.

The app on GitHub →

Run Q-Shield inside your network

For networks that won't let outside traffic in

• Mail, remote access and databases often can't be reached from outside. The collector is the same scanner as one signed file, qshield.tar, a Docker image you run inside your network.
• Check its fingerprint and EpochCore's two signatures with OpenSSL, run it, upload the results, and get the same signed report.
• This is the route for CNSA 2.0 and defense buyers who won't let outside traffic in.

Who signs in, and what's public

No passwords

• Sign-in is by invitation: EpochCore invites the people your consent names, and each signs in with an emailed 6-digit code. No passwords.
• Look up a company reads public DNS and certificate logs for a work email or domain, names the providers, and lists the hosts. No connection is made to them. We run it before a first call, if you'd like one; signing up needs no call.
• What a design partner gets and signs is public at /partner; the signed scan consent, withdrawal and opt-out at /consent.