Qypher is used to inventory the cryptography of regulated institutions, so it is built to need as little of your data as possible. This page says what leaves your environment, where it is stored, who can see it, and what is not in place yet.
What the internal agent sends
The agent runs on your machines, with your credentials, and reads your systems locally. It sends Qypher classified findings only. Each finding is a fixed list of fields:
- what was found: algorithm, key size, primitive, whether it is quantum-safe, a risk score and the recommended replacement;
- where: the discovery method, a location (a file path and line, a host and port, a cloud resource name or an HSM token and key label) and the scan scope;
- certificate facts where relevant: issuer, issue and expiry dates;
- context: the rule that matched, confidence, whether an entry point reaches the code and whether it protects stored data, and a few descriptive attributes (for example, whether a key can be exported);
- a SHA-256 fingerprint so the same asset keeps one identity across scans.
It never sends source code, file contents, private keys, key material, passwords or the credentials it uses. HSM keys are described from their attributes only; the agent never asks the HSM for key material.
You can check this before the agent ever connects: qypher-agent --output findings.json runs the real scan and writes exactly what would be sent, byte for byte, without sending anything.
How it talks to Qypher
- HTTPS only; the agent refuses a plain-http API address unless told otherwise for a test.
- The enrolment token is read from a file or an environment variable, not the command line, and is shown once when you create it. You can revoke an agent at any time.
- An agent running as a daemon enrols once and then authenticates with its own client certificate (mutual TLS) or signed HTTPS requests.
- The agent only ever connects out to the Qypher API; nothing connects in to it.
Where data is stored
- Hosted platform: application servers on Render in Singapore, database on Render Postgres in Singapore. Transactional email is sent through Amazon SES in the US (us-east-1).
- CBOM exports are encrypted at rest, come in full, regulator and vendor redaction tiers, and every export and share link is audited; share links can be revoked.
- Self-hosted and air-gapped: on request, the whole platform runs inside your network from a Helm chart, with no required outbound connection; licence and regulation updates arrive as signed files. It has been installed end to end on our own test cluster, not yet on a customer’s.
Signed outputs
Regulator submission packs, the board report and CBOM exports are signed with ML-DSA-65 (FIPS 204), and each comes with the public key and instructions so the recipient can verify it offline. The public Quantum-Readiness Passport is signed the same way.
Access control inside the platform
- Single sign-on over OpenID Connect or SAML 2.0, and SCIM user provisioning, configured per organisation.
- Viewer, member and admin roles; new accounts are approved before they get access.
- An organisation audit log of every security-relevant change, exportable as CSV.
- Accepting a risk needs a reason and an end date, and can require a second admin’s approval.
No LLM in the decision path
Classification, scoring and prioritisation are deterministic rules. The same estate gives the same answer, and an auditor can follow why each finding was ranked where it is.
What is not in place yet
- No independent penetration test report, and no SOC 2 or ISO 27001 certification. We will say so here when that changes.
- Qypher is early-stage and works with a small number of design partners.
Reporting a vulnerability
Email kalash@qypherlabs.tech with the details and how to reproduce it. We will acknowledge it within three working days and keep you informed until it is fixed. Please give us a reasonable time to fix it before disclosing it publicly, and don’t access other people’s data or disrupt the service while testing. Our security.txt has the same contact.
How we handle personal data is in our Privacy Policy.