Engineering
Priorities tied to evidence
RelixQ Score, HNDL-critical exposure, next actions, service context, and confidence in one working view.
Enterprise post-quantum exposure management SaaS
Own the quantum migration before it owns your roadmap.
RelixQ finds quantum-vulnerable cryptography, shows which long-lived data is exposed, and turns that evidence into remediation, reporting, and release controls.
Product UI
In one sentence
RelixQ is a managed SaaS platform for enterprise post-quantum exposure management: cryptography discovery, harvest-now-decrypt-later exposure, QAST validation, the RelixQ Score, governance, and developer release gates.
The enterprise problem
Quantum risk is already a data-lifetime problem.
The work crosses security leadership, application teams, platform engineering, and governance. Each team needs a different operating artifact from the same evidence.
Cryptography is distributed
Code, dependencies, certificates, TLS, JWT, SAML, mTLS, cloud services, and build systems all carry migration assumptions.
Inventory alone cannot set priority
Security teams need data lifetime, harvestability, reachability, ownership, and confidence—not a flat count of algorithms.
Migration can regress every release
Without retests, policies, tickets, exceptions, and gates, the same exposure returns after every remediation cycle.
Why RelixQ
Inventory shows what exists. RelixQ shows what to do next.
RelixQ connects each finding to how long the data must stay private, whether it can be harvested, where it is reachable, who owns it, and how confident the evidence is. The same evidence then drives remediation, governance, and release controls.
Inventory alone
Flat algorithm lists. Unclear owners. One-time reports.
With RelixQ
Ranked exposure. Traceable evidence. Named owners. Retests and release gates.
- 01
Discover
Find cryptography across code, dependencies, certificates, protocols, cloud services, and infrastructure.
- 02
Prioritize
Rank work by data lifetime, harvestability, reachability, confidence, and score impact.
- 03
Validate
Collect consent-gated, read-only evidence from approved targets.
- 04
Operate
Assign owners, remediate, retest, report, and enforce release gates.
Four connected capabilities
Follow the work from discovery to control—across the estate you already run.
The product mirrors the operating model, while broad language, infrastructure, and interoperability coverage keeps the evidence chain intact across teams and tools.
Inventory & CBOM
Find cryptography everywhere
Discover cryptography across code, dependencies, certificates, TLS, protocols, cloud services, and infrastructure.
Explore capabilityQAST & HNDL
Prioritize exposed data
Rank work by how long data must stay private, whether it can be harvested, where it is reachable, and how confident the evidence is.
Explore capabilityPQC Lab
Validate posture safely
Inspect read-only negotiation evidence for approved targets, including hybrid support, classical acceptance, and downgrade context.
Explore capabilityRelixQ Score, governance & gates
Prevent migration risk from returning
Track posture, assign owners, manage exceptions, retest fixes, and block net-new exposure with baseline-aware release gates.
Explore capabilityEnvironment fit
Coverage buyers can evaluate before the demo.
31
programming languages
Semantic, parser-backed, and curated rule coverage across modern, legacy, specialist, and infrastructure-heavy estates.
View coverage7
evidence input surfaces
Source, configuration, dependencies, TLS, cloud keys, cloud TLS infrastructure, and runtime telemetry—joined in a readiness graph.
View coverage13
configuration formats
Infrastructure, proxy, container, key-material, and platform configuration stay inside the same evidence model.
View coverageOpen
evidence formats
SARIF, CycloneDX, SPDX, OCSF, OpenTelemetry, APIs, and webhooks keep the result portable.
View coverageProduct proof
One evidence chain, three working views.
Leadership sees posture, security sees ranked exposure, and engineering sees the action behind every finding.
Leadership
See posture move over time
Track the RelixQ Score, open findings, and quantum exposure in one leadership view.
Exposure
Prioritize the data at risk
Rank HNDL exposure by data lifetime, harvestability, reachability, assumptions, and score impact.
Engineering
Move from evidence to remediation
Give engineering the finding, owner, confidence, migration target, recommendation, and status in one workbench.
One product, four teams
Give every team the view it needs.
Leadership, security, engineering, and governance work from the same findings, assumptions, owners, and progress.
Solution
CISO & security leadership
See posture, exposure trends, and the priorities changing the RelixQ Score.
View solutionSolution
Application security
Triage findings with evidence, owners, migration targets, and retest history.
View solutionSolution
Platform engineering
Automate scans, route evidence, and enforce baseline-aware release gates.
View solutionSolution
GRC & customer trust
Keep reports, policies, exceptions, and accepted risk tied to technical evidence.
View solutionFrequently asked
Questions buyers ask before the first call.
Short answers with the same facts the Developer Guide and Trust Center carry. Longer versions live in the guide.
- What is RelixQ?
- RelixQ is a managed SaaS platform for enterprise post-quantum exposure management: cryptography discovery, harvest-now-decrypt-later exposure, QAST validation, the RelixQ Score, governance, and developer release gates.
- What does RelixQ actually scan?
- RelixQ scans 7 evidence surfaces: source code, dependency manifests, TLS endpoints, cloud key management, cloud TLS infrastructure, runtime telemetry, and the readiness graph that joins them. Detection coverage spans 31 programming languages and 13 configuration and infrastructure formats, and every surface normalizes to one finding schema before scoring.
- How is RelixQ different from generic SAST or a crypto inventory scanner?
- General-purpose SAST finds security bugs broadly and an inventory scanner produces a flat list of algorithms. RelixQ is built for cryptographic semantics and post-quantum migration: algorithm-aware rules that understand key sizes, curves, modes, and PQC primitives; one canonical schema joining every surface; a CycloneDX CBOM; a readiness graph for blast radius; and migration targets that name concrete NIST replacements such as ML-KEM, ML-DSA, and SLH-DSA.
- When do we need to migrate to post-quantum cryptography?
- Two clocks apply. The Mosca inequality says that if data confidentiality lifetime plus migration time exceeds time-to-quantum (X + Y > Z), the exposure already exists. The regulatory clocks are dated: NIST IR 8547 deprecates 112-bit-security classical asymmetric algorithms after 2030 and disallows them after 2035, and CNSA 2.0 mandates post-quantum cryptography between 2030 and 2033.
- Does RelixQ send our source code anywhere?
- There are two explicit collection paths. With a customer-operated CLI or CI scan, data reaches RelixQ only when you submit findings or selected artifacts, and the normalized finding carries metadata and the matched evidence snippet rather than the full file. With a customer-authorized repository connection, the managed service retrieves repository content to perform the requested scan under documented scope, processing, retention, and deletion controls.
- Can RelixQ decrypt data with a quantum computer?
- No, and neither can anyone else. No cryptographically relevant quantum computer exists today. RelixQ models exposure, reachability, and dated risk windows, and demonstrates classical breaks in a local sandbox on generated artifacts. Any product claiming quantum decryption of real data today is misrepresenting the state of the art.
- How much does RelixQ cost?
- RelixQ Enterprise is quoted per organization through an Enterprise evaluation that confirms portfolio scope, product capabilities, SaaS service scope, and operating requirements. There is no published list price, and the site does not invent one.
Trust
Clear boundaries for a managed SaaS service.
RelixQ separates observed evidence, modeled quantum risk, and proven classical breaks. Active validation stays within approved scope under signed Rules of Engagement.
Managed SaaS
Service modelRelixQ is delivered as a managed service with data handling documented in the Trust Center.
Authorized targets only
Policy in reviewActive validation is limited to approved targets under a signed, project-specific Rules of Engagement workflow.
Claims published with status
Control reviewDraft, verified, planned, and review-required material stays clearly labeled for buyers and procurement teams.
See RelixQ on your portfolio
Turn a real migration portfolio into an actionable plan.
Scope a controlled SaaS evaluation around the applications, data, and delivery workflows that matter most.