Frequently asked questions

Product and licensing

How is RelixQ licensed?: RelixQ Enterprise is proprietary, commercially licensed software delivered as a managed multi-tenant service. Licensing is per organization — talk to us about scope and term.
How is source code processed?: Connected-repository scans process repository content within the managed service. CLI submissions send findings metadata — algorithm, path, line, severity — rather than the repository itself. See Security and tenancy.

Quantum basics

What is post-quantum cryptography?: Algorithms designed to stay secure against large-scale quantum computers. RSA, ECDSA, Diffie-Hellman, and ECDH would be broken by Shor algorithm on a sufficiently powerful machine. NIST standardized the first replacements in August 2024: ML-KEM, ML-DSA, and SLH-DSA. Details in Post-quantum concepts.
What is harvest-now-decrypt-later?: The attack that makes PQC urgent before any quantum computer exists. An adversary records your encrypted traffic today and decrypts it years later once a CRQC becomes available. If the data inside is still confidential then, the breach happened the day it was harvested.
When do I need to migrate?: Two answers. The Mosca inequality: if X + Y > Z — confidentiality lifetime plus migration time exceeding time-to-CRQC — you are already late. And the regulatory clocks: NIST IR 8547 deprecates 112-bit-security classical asymmetric algorithms after 2030 and disallows them after 2035; CNSA 2.0 mandates PQC between 2030 and 2033. Rule of thumb: a confidentiality lifetime over ~5–10 years means start now.
Can RelixQ decrypt my data with a quantum computer?: No — and neither can anyone else. No cryptographically relevant quantum computer exists. Any product claiming to demonstrate quantum decryption of real data today is misrepresenting the state of the art. RelixQ proves exposure, reachability, and classical breaks.

Scanning

What does each product scan?: Seven surfaces: source code, dependency manifests, TLS endpoints, cloud KMS, cloud TLS infrastructure, runtime telemetry, and the readiness graph that joins all of them. Every surface normalizes to one finding schema before scoring.
Which languages does the scanner cover?: Managed coverage spans 31 programming languages, 13 configuration and infrastructure formats, CUDA routing through C++, and Jupyter preprocessing through Python — plus migration intelligence that enriches each detection in place. See Detection coverage or the public coverage matrix.
How is this different from CodeQL, Snyk, or generic SAST?: General-purpose SAST finds security bugs broadly; RelixQ is purpose-built for cryptographic semantics and PQC migration. Algorithm-aware rules that understand key sizes, curves, modes, and PQC primitives; one canonical schema joining every surface; a CBOM; a readiness graph for blast radius; governance tuned to crypto exceptions; and migration plans that name concrete PQC targets. A generic scanner tells you "MD5 is weak"; RelixQ tells you which services break, in what order to migrate them, and what your board-level score becomes when you do.
Does RelixQ send my source code anywhere?: RelixQ has two explicit collection paths. With a customer-operated CLI or CI scan, data enters RelixQ SaaS only when you submit findings or selected artifacts; the normalized finding includes metadata and the matched evidence snippet rather than the full file. With a customer-authorized repository connection, the managed service retrieves repository content to perform the requested scan under the documented scope, processing, retention, and deletion controls. See Security and tenancy and the Trust Center data page.
Why did the scanner miss something?: Most often a coverage question rather than a miss — see Troubleshooting. The scanner also emits an informational CRYPTO_API_UNMAPPED finding when a file imports a known crypto library but no rule recognizes any API in it, so blind spots surface as findings rather than as silence.

Scores and QAST

What is the RelixQ Score?: A deterministic, explainable, coverage-aware 0–100 measure of post-quantum migration readiness across the scanned surface, banded from Critical Exposure (0–24) to Quantum-Ready (90–100).
What does "Not yet assessed" mean?: There is not enough scan coverage to compute an honest score, so the product refuses to show one. An unmeasured estate scoring 90 would be a lie.
Why did my score go up without any migration work?: Most likely an approved exception, which lowers a finding risk level and therefore lifts the score. Enterprise surfaces exception-driven lift as accepted risk, distinct from genuine migration progress — check the Security dashboard exceptions widgets.
What is crypto agility, and how is it different from the score?: The score answers "how exposed am I?". Crypto agility answers "how mechanically cheap is it to change?". Two systems with identical findings can have very different migration costs. RelixQ exposes it through the scorecard API.
What does the QAST active probe actually do?: Read-only handshakes — nothing else. It connects to endpoints you have explicitly authorized, offers post-quantum and hybrid key-exchange groups, and records what the server negotiates. Consent-gated end to end with a signed Rules of Engagement, independent worker re-verification, and a safe-word kill switch. Enterprise only.
Is "classical KEX accepted" a downgrade?: No, and the distinction matters. Classical-KEX-accepted means the probe offered only classical groups and the server completed — normal negotiation; PQC simply is not enforced. Downgrade accepted means hybrid and classical were offered and the server still chose classical — a true downgrade.

Platform and integrations

Which clouds are supported?: For scanning, the Enterprise cloud posture scanner covers AWS (KMS, ACM, ELBv2, CloudFront, API Gateway, EKS), Azure (Key Vault, App Gateway, Front Door, APIM, App Service, AKS Ingress), and GCP (Cloud KMS, Certificate Manager, HTTPS LB, GKE Ingress, API Gateway).
Which LLM powers explanations and migration plans?: AI is a managed capability: it fails over across providers, enforces cost caps and guardrails, falls back to deterministic non-LLM output when no provider is reachable, and can be switched off entirely for tenants whose policy forbids external AI calls. Either way, only finding metadata is sent — never your source.
How is my data isolated from other customers?: The target architecture scopes API paths, stored artifacts, and queued work to the active organization and uses PostgreSQL row-level security as a database boundary. Production enablement and effectiveness are tracked separately in the Trust Center control review.
Which SIEM, incident, chat, and ticketing tools are supported?: Enterprise only. Export: OTLP, Datadog, Splunk, Microsoft Sentinel, Grafana, generic webhook, New Relic, Dynatrace, Elastic Security, CrowdStrike. Incidents: PagerDuty, Opsgenie, ServiceNow, Splunk On-Call, Grafana OnCall, Jira Service Management. Chat: Slack, Teams, Mattermost, Discord, Google Chat. Ticketing: Jira, GitHub Issues, Azure Boards, Linear, ServiceNow.

Troubleshooting

Symptom, cause and fix — organized by surface, so you can go straight from what you are seeing to why it happens and what to do about it.

Glossary

Every term the products use — quantum concepts, NIST algorithms, RelixQ constructs, formats, and platform mechanics — defined precisely, with the product each applies to.

The cryptography and threat model RelixQ is built on: what Shor and Grover break, why harvest-now-decrypt-later is a present-day problem, the Mosca inequality, and the NIST algorithms that replace what breaks.