Quantum imperative
Designed for 2026+ resilience
Multi-tenant Integrated Trust Platform delivering PQC-native security, zero-trust automation, quantum-resistant protection and built-in compliance across all services.
- Private/VPC/sovereign and air-gapped deployments are not shown here.
- Statuses may appear Offline/Degraded due to network connectivity. Refresh to retry. For persistent issues, check your deployment’s /status endpoint or internal monitoring. If you’re using QNSP Cloud, visit https://qnsp.cuilabs.io/status.
Transparent pricing
Simple, predictable pricing for every team
Start free, scale as you grow. All SDKs are free. Enterprise features (enclaves, AI training) available on higher tiers.
Free Forever
FREE
Free-forever for everyone—from individual users to global enterprises—exploring QNSP workloads
- ✓5GB quantum-secure storage
- ✓2,000 API calls/month
- ✓Full PQC storage + limited KMS (1 key, 5k ops/month)
- ✓11 SDKs (Included)
- ✓Community support
Developer Plans
DEV STARTER
For startups and small teams
- ✓50GB quantum-secure storage
- ✓50,000 API calls/month
- ✓PQC storage + KMS
- ✓Basic search
- ✓11 SDKs (Included)
- ✓Email support
DEV PRO
For growing companies and production
- ✓200GB quantum-secure storage
- ✓250,000 API calls/month
- ✓Full PQC stack
- ✓Advanced SSE + Vault
- ✓AI inference (non-enclave)
- ✓11 SDKs (Included)
DEV ELITE
For advanced development teams
- ✓500GB quantum-secure storage
- ✓500,000 API calls/month
- ✓Full PQC stack
- ✓Advanced SSE + Vault
- ✓AI inference (non-enclave)
- ✓11 SDKs (Included)
Business Plans
BUSINESS TEAM
For mid-market teams
- ✓500GB quantum-secure storage
- ✓1M API calls/month
- ✓SSO (SAML/OIDC) + Audit
- ✓Team management (25 users)
- ✓AI orchestration
- ✓11 SDKs (Included)
- ✓Priority support (8h)
BUSINESS ADVANCED
For advanced teams and larger businesses
- ✓2TB quantum-secure storage
- ✓5M API calls/month
- ✓PQC automation + SCIM
- ✓Team management (100 users)
- ✓AI batch workloads
- ✓11 SDKs (Included)
- ✓Priority support (4h)
BUSINESS ELITE
Premium business tier with compliance focus
- ✓3.5TB quantum-secure storage
- ✓7.5M API calls/month
- ✓Multi-region PQC
- ✓Enhanced audit logs + compliance
- ✓Team management (200 users)
- ✓11 SDKs (Included)
- ✓Priority support (2h)
Enterprise Plans
ENTERPRISE STANDARD
Enclave-secured AI inference
- ✓5TB quantum-secure storage
- ✓10M API calls/month
- ✓🔒 Enclave inference (8 hardware enclave types)
- ✓Multi-region PQC
- ✓Audit + residency proofs
- ✓11 SDKs (Included)
- ✓Dedicated account manager
ENTERPRISE PRO
Full AI security platform
- ✓10TB quantum-secure storage
- ✓25M API calls/month
- ✓🔒 Encrypted AI training/fine-tuning
- ✓🔒 Full enclave security suite
- ✓Full compliance bundle
- ✓11 SDKs (Included)
- ✓Dedicated support engineer
ENTERPRISE ELITE
Fortune 200 & mission-critical
- ✓Unlimited storage & API calls
- ✓🔒 Dedicated enclave GPU clusters
- ✓🔒 Private/VPC deployments
- ✓Custom PQC schedules
- ✓11 SDKs (Included)
- ✓1-hour SLA (99.95% uptime)
- ✓Pre-warmed enclave pools
Mission-Critical Programs
PUBLIC SECTOR
Government & public services programs with regulated procurement
- ✓Custom storage & API limits
- ✓🔒 Controlled deployment options (VPC / private / on-prem)
- ✓Customer/partner-managed HSM integration (certification level depends on selected HSM)
- ✓IL5/FedRAMP High alignment (deployment-specific)
- ✓SOC 2-aligned controls & ISO 27001 roadmap
- ✓GDPR, HIPAA & data residency
- ✓11 SDKs (Included)
- ✓Dedicated account manager
- ✓24/7 incident escalation (enterprise agreement)
- ✓Field engineering via customer/partner processes (as required)
DEFENSE & SPACE
Defense, national security, and space agency deployments
- ✓Custom storage & API limits
- ✓🔒 Classified enclave clusters
- ✓🔒 Customer-controlled air-gapped orchestration
- ✓Customer/partner-managed HSM integration (certification level depends on selected HSM)
- ✓ITAR program support (deployment-specific)
- ✓Data residency guarantees (deployment-specific)
- ✓Private cloud & edge deployment
- ✓11 SDKs (Included)
- ✓Dedicated account manager
- ✓24/7 incident escalation (enterprise agreement)
CRITICAL INFRASTRUCTURE & LABS
Nuclear, biosecurity, critical infrastructure, and quantum labs
- ✓Custom storage & API limits
- ✓🔒 High-assurance enclaves + attestation controls
- ✓Customer/partner-managed HSM integration (certification level depends on selected HSM)
- ✓Air-gapped / isolated tenancy options (deployment-specific)
- ✓Compliance alignment (deployment-specific)
- ✓Data residency & retention controls
- ✓Private cloud & edge deployment
- ✓11 SDKs (Included)
- ✓Dedicated account manager
- ✓Field engineering via customer/partner processes (as required)
- This service is currently in Technical Preview. Features, functionality, SDKs and APIs may evolve, and users may experience bugs, outages, or performance variability. Certain capabilities may be limited or unavailable during the beta period.
- Support is provided on a best-effort basis and no service level agreement (SLA) applies during Technical Preview.
- “Popular” and “Recommended” indicators are derived from aggregated customer preference signals and live usage analytics.
- Pricing may change over time. Promotional or introductory pricing is subject to change following the applicable promotional period.
Platform
Security Framework
Threat modeling, cryptographic policy enforcement, signed audit trails, and automated incident response—mapped to common enterprise frameworks.
Live PQC-TLS Evidence
Public TLS terminates at the AWS ALB with a PQ/hybrid TLS policy. You can verify negotiated groups and policy evidence via /platform/v1/crypto/tls/evidence/public. Full platform crypto posture is available at /platform/v1/crypto/posture/public(authentication required for full details).
Quantum Threat Model v2.0
Comprehensive threat modeling aligned with NIST PQC standards and CRQC timeline assumptions.
- 4 attacker classes: Script Kiddie → Nation-State with CRQC
- HNDL (Harvest Now, Decrypt Later) timeline modeling
- 15+ security controls mapped to specific threats
- Data classification: ephemeral → long-lived secrets
- Legacy migration milestones: staged classical deprecation (PQC-Native is the default)
Cryptographic Attestation
Forensic-grade cryptographic evidence with NIST algorithm lifecycle tracking and compliance assessment.
- NIST algorithm registry with lifecycle status (Final/Draft/Deprecated)
- CBOM (Cryptographic Bill of Materials) export with SHA3-256 hash
- Automated CNSA 2.0 and FIPS 140-3 compliance checks
- Policy enforcement: audit mode or hard-block mode
- Migration planning for deprecated algorithms (platform-wide)
- Machine-verifiable compliance snapshots with PQC signatures
Cryptographic Policy Engine
Tenant-configurable PQC enforcement with algorithm allowlists and HSM requirements.
- KEM: ML-KEM-512/768/1024 (formerly Kyber)
- Signatures: ML-DSA-2/3/5 (formerly Dilithium), Falcon-512/1024, SLH-DSA (formerly SPHINCS+)
- Symmetric: AES-256-GCM, ChaCha20-Poly1305
- 4 policy tiers: Default → Government/Defense
- HSM-enforced root key protection (HSM-backed root keys; certification depends on deployment)
Signed Audit Evidence
Cryptographically signed, hash-chained audit trail for compliance and forensics.
- 40+ crypto-critical event types across 12 services
- PQC-signed events with ML-DSA-3 signatures
- SHA3-512 hash chains with Merkle checkpoints
- Severity inference: info → critical
- SIEM-ready export (Splunk, Elastic, Datadog) via deployment-specific forwarding
Key Compromise Response
Automated incident response for suspected or confirmed key compromises.
- 5-step remediation: record → rotate → rewrap → revoke → audit
- KMS, Vault, Storage service integration
- Automatic capability token revocation
- Sub-10s response SLA for critical incidents
- Correlation tracking across services
Downgrade Attack Remediation
Real-time detection and response to cryptographic downgrade attempts.
- Protocol tracking: PQC-TLS → TLS 1.3 → TLS 1.2
- Algorithm monitoring: ML-DSA → ECDSA downgrades
- Automatic IP/user blocking on critical severity
- Token revocation and resource quarantine
- Escalation to key compromise handler
Platform Capabilities
14+ Production Services
Edge Gateway, Auth Service, Vault Service, Storage Service, Search Service, Tenant Service, Billing Service, KMS Service, Audit Service, Access Control Service, Security Monitoring Service, Observability Service, AI Orchestrator, Crypto Inventory Service (plus platform utilities like platform API and provisioning).
Hardware Enclaves
Intel SGX (MEE), AMD SEV (Memory Guard + SEV-SNP), NVIDIA CC (GPU memory encryption), Intel TDX (TME - supports Google Cloud Confidential VMs/GKE), ARM TrustZone, ARM CCA/RME (supports Google Cloud Confidential GKE), AWS Nitro Enclaves, IBM Secure Execution with cryptographic attestation.
Scheduler Backends
Kubernetes (Jobs API), AWS Batch (job queues), GPU Fleet, TPU Fleet (with attestation).
HSM Integration
Thales Luna, Entrust nShield, AWS CloudHSM, Azure HSM (PKCS#11 integration; certification level depends on the selected HSM and customer deployment).
Developer Platform
11 TypeScript SDK/client packages, REST APIs (OpenAPI), WebSocket API, CLI tools, CI/CD integrations (GitHub Actions, GitLab CI, Jenkins, CircleCI).
Observability & Compliance
OTLP streaming, Merkle tree checkpoints, automated remediation, SIEM-ready export via OTLP/audit forwarding (Splunk, Elastic, Datadog), real-time collaboration.
Feature Comparison
Competitor Landscape
Cloud Providers
Cloud providers are rolling out PQC primarily through primitives (KMS, certificates, TLS endpoints) and managed services. This lowers the barrier to adoption, but customers still assemble end-to-end enforcement across ingress, policy, audit evidence, storage/search workflows, and incident automation.
Examples
- PQC primitives in KMS / secrets / certificate services and selected TLS endpoints
- Broad managed service catalogs (storage, search, AI) with varying security/enforcement cohesion
- Identity + policy products exist, but cross-service, evidence-grade enforcement is usually an integration project
Strengths
- Global footprint, managed services, and operational maturity
- PQC exposure through standard interfaces (TLS, KMS) accelerates early adoption
- Compliance programs and enterprise procurement pathways
Gaps
- Often focused on primitives rather than end-to-end tenant policy + audit evidence
- Customers still stitch together ingress enforcement, signed ingestion, retention, and incident automation
- Consistency across services varies; strong outcomes often require additional control-plane buildout
Security Tools
Security tools deliver best-in-class point capabilities (vaults, PAM, edge access, SIEM/SOAR). They can be critical building blocks, but the end-to-end outcome (tenant policy, capability enforcement, signed audit evidence, and secure data workflows) is usually assembled across multiple vendors and systems.
Examples
- Vaults / PAM for secrets and credential rotation
- Edge access + WAF/Zero Trust posture controls
- SIEM/SOAR for monitoring and response automation
Strengths
- Mature deployments for identity/edge/PAM use cases
- Good fit for incremental adoption (swap one control at a time)
- Broad ecosystem integrations
Gaps
- Often focused on one layer rather than cross-service, tenant-scoped enforcement
- Doesn’t typically unify storage/search/AI workflows under a single policy + capability model
- Audit evidence exists, but it’s rarely delivered as a single, tamper-evident platform trail
PQC Tooling
PQC tooling vendors focus on crypto-agility and migration readiness (PKI lifecycle, discovery, HSM options, and PQC primitives). They can accelerate planning and rotation, but typically don’t deliver the full platform surface: secure ingress + signed ingestion, per-tenant policy enforcement, evidence-grade audit, and secure data workflows.
Examples
- Crypto posture / inventory + certificate lifecycle automation
- Hardware-backed key protection options and PQC primitives
- Rotation orchestration for PKI and machine identity surfaces
Strengths
- Deep cryptographic specialization and migration readiness tooling
- Helpful for inventory, policy design, and lifecycle automation at scale
Gaps
- Usually not a full stack for tenants, audit trails, storage/search workflows, or billing/metering
- Integration and operational ownership remains with the customer or SI
Developer platform
Build with quantum-secure infrastructure
TypeScript SDKs and REST APIs (OpenAPI). Free for all tiers. Get started in 5 minutes.
Sign up free
Create your account at cloud.qnsp.cuilabs.io and provision your tenant in minutes
Install SDK
SDK install and usage instructions are provided in the documentation portal
Upload your first document
Use QNSP APIs to upload documents with quantum-secure encryption
Build your app
Integrate QNSP into your application with full PQC protection
Available SDK packages
@qnsp/storage-sdkAvailableDocument upload/download, lifecycle management, compliance controls
@qnsp/search-sdkAvailableFull-text search, vector similarity, SSE token generation
@qnsp/ai-sdkAvailableAI workload orchestration, enclave management, GPU scheduling
@qnsp/auth-sdkAvailableAuthentication, FIDO2 passkeys, Personal Access Tokens (PATs), session management
@qnsp/vault-sdkAvailableSecrets management, credential storage, break-glass access
@qnsp/tenant-sdkAvailableTenant management, subscription, metadata operations
@qnsp/billing-sdkAvailableInvoice management, usage tracking, payment processing
@qnsp/access-control-sdkAvailablePolicy management, capability tokens, authorization flows
@qnsp/audit-sdkAvailableAudit log querying, compliance reporting, event retrieval
@qnsp/kms-clientAvailablePQC envelope encryption client, BYOK workflows, signing helpers
@qnsp/crypto-inventory-sdkAvailableCrypto asset discovery, PQC migration tracking, inventory management
SDK access and install guidance is provided in the documentation portal.
Use cases
Real workloads, developer stories, and why now
Reference architectures, production patterns, and external standards show how QNSP lands in AI labs, gov clouds, and zero-trust programs.
Real workloads
Universal Free Forever Access
QNSP Cloud stays free forever for everyone—from individual users to global enterprises—starting with PQC storage and the full developer toolkit (11 SDK/client packages), with 5GB storage plus 2,000 API calls monthly.
Kick off proofs of concept or production pilots immediately without credit cards, procurement reviews, or contracts.
Sovereign AI labs
Encrypted model training pipelines in customer-controlled sovereign cloud/VPC/on-prem environments, with GPU enclave orchestration and PQC-signed inference APIs.
Zero plaintext exposure of training sets while holding <5% latency overhead.
Defense & intelligence
Customer-controlled private or air-gapped deployments with offline signing, distributed edge routing, tamper-evident audit flows.
Sub-10s revocation SLAs and deterministic mission replay.
Regulated finance
Quantum-safe document vaults, searchable encryption, automated retention + legal hold APIs.
PQC compliance with immediate regulator reporting via audit service webhooks.
Healthcare & life sciences
PHI-safe storage, secure collaboration, PQC-authenticated research data exchanges.
Meets HIPAA + GDPR residency through data-layer policying.
Developer stories
LegalTech contract management
Store thousands of contracts with long-term retention, search across clauses, and run AI contract analysis with immutable audit trails.
Unified storage + search + AI workflows with compliance-grade evidence and legal holds.
Healthcare patient record systems
Protect PHI with encrypted storage, HIPAA-aligned audit trails, and secure search across records with de-identification controls.
Retention, legal holds, and tenant isolation built into the platform primitives.
Investment & broker-dealer archives
WORM-style retention policies, immutable audit trails, and searchable encryption for investment documents and compliance reporting.
Regulator-ready retention and audit workflows without bespoke infrastructure.
Multi-tenant B2B document platform
Self-serve onboarding, tenant-isolated storage and search, and usage metering for billing across thousands of customer workspaces.
Ship faster by outsourcing encryption, compliance controls, and tenant isolation.
EdTech secure LMS
Securely store coursework and student submissions with privacy-safe search and long retention windows for transcripts and records.
FERPA-aligned handling through classification, retention, and tenant isolation patterns.
GovTech public records management
Manage public records with controlled access, immutable audit logs, and retention policies aligned to FOIA-style workflows.
Tamper-evident audit trails with policy-driven storage and selective indexing.
Why now
NIST post-quantum cryptography standards
NIST finalized FIPS 203 (ML-KEM), FIPS 204 (ML-DSA), and FIPS 205 (SLH-DSA), encouraging organizations to begin transitioning.
Read reference →Confidential computing for secure AI pipelines
Trusted execution environments (TEEs) protect data, models, and computations across preprocessing, training, and inference with attestation-based verification.
Read reference →Engage
Talk to CUI Labs about QNSP
QNSP Cloud is currently in Technical Preview.
We’re working with a limited number of teams on early access, technical evaluations, and structured pilots across QNSP Cloud, private/VPC deployments, and partner-delivered on-prem environments.
Early Access & Enterprise Inquiries
Email contact@cuilabs.io to request preview access or discuss enterprise, government, and partner programs.
For fastest routing, include:
- Intended workload (data, AI, identity, search, etc.)
- Deployment model (cloud, private/VPC, sovereign)
- Data residency or compliance requirements
- Post-quantum cryptography scope
Private, sovereign, and air-gapped deployments are delivered into customer-controlled environments and operated under customer or partner governance.
Explore QNSP Platform Capabilities
Explore the platform architecture, APIs, and developer documentation while we prepare for the Technical Preview.