Comparison
QNSP vs HashiCorp Vault
An honest comparison. HashiCorp Vault is a mature, widely-adopted secrets platform; QNSP is purpose-built around post-quantum cryptography and offered as a hosted service first. Each is a better fit for a different problem shape — the table below makes the trade-offs explicit.
If your primary need is dynamic-secret-engine breadth on infrastructure your team already operates, Vault is hard to beat. If your primary need is post-quantum cryptographic guarantees with zero operating overhead, QNSP is the lighter path.
Side by side
Eight categories
| Category | QNSP | HashiCorp Vault |
|---|---|---|
| Post-quantum cryptography | 89 NIST-track algorithms across 14 families baked into the platform: ML-KEM (FIPS 203), ML-DSA (FIPS 204), SLH-DSA (FIPS 205), Falcon, HQC, BIKE, MAYO, CROSS, UOV, SNOVA, plus the full liboqs surface. Per-tenant crypto-policy enforcement. | Classical algorithms (RSA, ECDSA, Ed25519, AES) by default as of May 2026 — see developer.hashicorp.com/vault/api-docs/secret/transit. The Transit secrets engine has added an ML-DSA opt-in path on a beta channel; PQC TLS terminates at the listener; key material across most secret engines (database, cloud, PKI, KV) remains classical at time of writing. Verify status against the Transit docs before quoting. |
| Operating model | Hosted SaaS (multi-tenant) on AWS Singapore is the default; private VPC, on-premises, and air-gapped deployments available on Enterprise Elite + Specialized tiers. No infrastructure to operate for the hosted offering. | Self-hosted is the canonical model — customers operate their own Vault clusters with quorum, seal/unseal, replication, and HA. HCP Vault (HashiCorp Cloud Platform) is the managed alternative but adds Consul + Vault operating surface even when hosted. |
| Multi-tenant isolation | Every request carries a tenant ID claim that the edge gateway and every service enforce. Tenant data is cryptographically isolated; cross-tenant access is forbidden at every layer (edge gateway, JWT validation, KMS scoping, vault scoping, audit chain). | Namespaces (Enterprise feature) provide logical isolation within a single Vault cluster — see developer.hashicorp.com/vault/docs/enterprise/namespaces. Cryptographic isolation between namespaces is configurable but not the default; smaller deployments use one Vault per tenant. |
| Dynamic secrets | On-demand database / cloud / service credentials with automatic rotation, backed by per-tenant crypto policy and metering through quota-service. Secret leakage detection scans logs / commits / external sources. | Dynamic secrets are a Vault strength — extensive engine catalog (DB, AWS, GCP, Azure, K8s, PKI, etc.). Lease management is well-engineered. Secret leakage detection is not native; integrates with HashiCorp Sentinel for policy. |
| Audit trail | Every operation hash-chained into the tamper-evident audit chain (apps/audit-service). Real-time WebSocket streaming for SIEM. Per-tenant retention add-ons (90d → 7yr). | Audit devices stream to file / syslog / socket. Tamper evidence relies on customer-side log integrity tooling (typical pattern: ship to a write-once log store). Streaming integrations supported but require customer plumbing. |
| Crypto inventory (CBOM) | Built-in apps/crypto-inventory-service produces a Cryptographic Bill of Materials, scans for classical-crypto usage that needs PQC migration, and computes a per-tenant PQC readiness score. CBOM exposed via @qnsp/qnsp SDK and the MCP server. | Not native — CBOM is typically produced by third-party scanners (Sonatype, Snyk, etc.) or in-house tooling. PQC migration tracking is not a Vault responsibility. |
| SDK story | One @qnsp/qnsp package per language: TypeScript / Node.js (npm), Python (PyPI), Go (Go modules), Rust (crates.io). Same wire contracts; outputs round-trip across languages byte-for-byte. One activation handshake per process. | Official Vault Go client + community SDKs in many languages, often with varying maturity. API surface is the source of truth; client libraries vary in their abstractions. |
| Free tier | Free forever: 25 vault secrets, 20 KMS keys, 10 GB PQC-encrypted storage, 50 000 API calls/month, no credit card. Verified in apps/billing-service/src/pricing/config.ts. | Open-source Vault is free to run; HCP Vault has a free tier with limited storage / requests. Vault Enterprise (namespaces, performance replication, governance) is commercial. |
When to pick which
Decision guide
Stay on Vault if…
- Dynamic secret engines (DB credentials, cloud IAM, K8s, PKI) are the dominant use case.
- Your team is comfortable operating a Vault cluster (or already has HCP Vault) and the threat model doesn't require PQC.
- Sentinel policy-as-code is core to your governance.
Add QNSP alongside Vault if…
- You need PQC-encrypted secrets for a specific class of long-lived data without disrupting your existing Vault flow.
- Your auditor is asking for a Cryptographic Bill of Materials (CBOM).
- You want signed audit evidence the auditor can verify externally.
Move to QNSP if…
- You don't want to operate Vault clusters and the hosted offering's tradeoffs are acceptable.
- Post-quantum readiness is in your roadmap and you'd rather adopt PQC by default than back-port.
- You need multi-tenant isolation cryptographically enforced by the platform.
Try it yourself
See QNSP run real PQC ops in 30 seconds
The live PQC sandbox at qnsp.cuilabs.io/#verify-sandbox runs real ML-KEM-768 + ML-DSA-65 round-trips on every request. No signup, no API key. Then sign up for a free QNSP account and wrap your first secret with the @qnsp/qnsp SDK.