Source-code discovery
Detect cryptographic usage across 10+ languages, flagging quantum-vulnerable algorithms and weak key sizes at the source.
QSafe · Post-Quantum Cryptography
Every cryptographic risk. Discovered. Scored. Protected.
QSafe is Nova AI's post-quantum cryptography platform for banks and regulated enterprises. It finds vulnerable cryptography in your code, network and infrastructure, scores each asset against the NIST migration timeline, and protects live traffic with hybrid post-quantum TLS, with no code changes.
The quantum threat
The cryptography protecting you today is already on the clock
NIST will deprecate RSA and ECC by 2030 and disallow them by 2035. Attackers are not waiting, they harvest encrypted data now to decrypt it once a cryptographically relevant quantum computer arrives.
Harvest Now, Decrypt Later
Adversaries are already capturing encrypted traffic and archives, banking on quantum decryption. Data with a long shelf life is exposed the moment quantum arrives.
NIST deadlines are fixed
RSA and ECC are deprecated by 2030 and disallowed by 2035. Migration across a large estate takes years, the runway is shorter than it looks.
You can’t protect what you can’t see
Vulnerable crypto is buried in source code, libraries, network protocols and Kubernetes infrastructure. Most organisations have no inventory of where it lives.
How it works
Discover. Score. Protect.
A complete workflow from cryptographic inventory to live protection, grounded in the NIST post-quantum migration standards.
Discover
Scan source code (10+ languages), network protocols (15+ surfaces) and Kubernetes infrastructure to build a complete inventory of cryptographic assets.
Score
Rank every asset with a deterministic 5-factor risk model, with per-asset explanations and NIST IR 8547 migration-milestone tracking.
Protect
Wrap live traffic in a hybrid PQC TLS proxy (X25519 + ML-KEM-768) to defend against quantum attacks today, with zero application code changes.
Capabilities
From inventory to protection, on one platform
Everything security teams need to find, prioritise and remediate quantum-vulnerable cryptography.
Network protocol scanning
Inspect 15+ network surfaces to find TLS, SSH and other protocols relying on RSA or ECC in live traffic.
Kubernetes & infra scanning
Surface crypto risk inside Kubernetes and cloud infrastructure, certificates, secrets and service-to-service encryption.
Deterministic risk scoring
A transparent 5-factor model ranks every asset with a clear, per-asset explanation, no black-box scores.
Hybrid PQC TLS proxy
Protect live traffic with X25519 + ML-KEM-768 hybrid key exchange, deployed as a proxy with zero code changes.
CBOM export
Generate a CycloneDX Cryptography Bill of Materials in a NIST-referenced inventory format for audit and compliance.
Who it’s for
Built for teams facing the PQC deadline
Wherever long-lived data and regulatory pressure meet, QSafe turns an overwhelming migration into a tracked plan.
Regulatory compliance
Evidence your post-quantum readiness against NIST IR 8547 milestones and export a CBOM for auditors and regulators.
Financial institutions
Protect high-value, long-lived data across sprawling estates before Harvest-Now-Decrypt-Later attacks pay off.
Crypto-agility programs
Build and maintain a living cryptographic inventory so you can migrate algorithms as standards evolve.
Protect traffic now
Deploy hybrid PQC TLS in front of critical services to defend sensitive traffic today, ahead of full migration.
QSafe compared with a manual crypto inventory
Why spreadsheets and one-off audits are not enough for a post-quantum migration.
| Criterion | QSafe | Manual inventory |
|---|---|---|
| Coverage | Source code in 10+ languages, 15+ network protocol surfaces and Kubernetes | The systems someone remembered to list |
| Staying current | Continuous, including checks in CI/CD pipelines | A point-in-time snapshot that goes stale |
| Prioritisation | Five-factor risk score per asset against the NIST IR 8547 milestones | Judgement, asset by asset |
| Output | Machine-readable CycloneDX CBOM for auditors | Spreadsheets in varying formats |
| Protection | Hybrid post-quantum TLS proxy now, with no code changes | Nothing until migration projects finish |
| Deployment | SaaS, self-hosted, hybrid or air-gapped | Not applicable |
Technical specifications
Standards-aligned by design
QSafe implements the NIST post-quantum standards and references the official migration guidance.
Post-quantum standards
- Key encapsulation
- FIPS 203 (ML-KEM)
- Digital signatures
- FIPS 204 (ML-DSA)
- Stateless hash signatures
- FIPS 205 (SLH-DSA)
Protection
- Hybrid TLS key exchange
- X25519 + ML-KEM-768
- Deployment
- Proxy, zero code changes
- Migration guidance
- NIST IR 8547
Discovery & reporting
- Source languages
- 10+
- Network surfaces
- 15+
- Infrastructure
- Kubernetes & cloud
- Inventory export
- CycloneDX CBOM
Deployment
Deploy QSafe your way
From fully managed SaaS to fully isolated air-gapped installs, QSafe fits your security and compliance posture.
Recommended
SaaS
Fully managed cloud service, start scanning in minutes.
- No infrastructure to run
- Automatic updates
- Fastest time to value
Self-hosted
Run QSafe in your own environment with Docker or Helm.
- Docker & Helm deployment
- Data stays in your estate
- Full operational control
Hybrid
Blend managed control-plane with self-hosted scanning.
- Managed orchestration
- Local scan execution
- Flexible data residency
Air-gapped
Fully isolated deployment for the most sensitive networks.
- No external connectivity
- Offline updates
- For classified & regulated environments
Free report
Post-Quantum Readiness in MENA Banking 2026
The standards, the deadlines, what regional regulators now expect, and a migration plan banks can start this quarter
FAQ
Questions about QSafe
No. QSafe is built for post-quantum cryptographic risk, which SIEM, CSPM and vulnerability scanners were not designed to address. It works alongside your existing stack through CBOM export, SIEM forwarding and ticketing integrations.
Attackers capture encrypted traffic today and store it until a quantum computer can decrypt it. Data protected with RSA or ECC now could be exposed in 5 to 15 years, so the risk to long-lived data is already present on your network.
No. QSafe Proxy is a drop-in reverse proxy in front of your existing services. It negotiates hybrid post-quantum TLS with clients and forwards traffic to your backend, with no code changes, recompilation or reconfiguration. Algorithms are managed centrally and change without restarting the proxy.
It maps the cryptography of your live infrastructure across 15+ protocol surfaces, including TLS, SSH, QUIC, DNSSEC, IKE, SNMP, LDAP, Kerberos and RDP, without agents. Discovery can run as an active scan, from Nessus or Qualys imports, from CSV, JSON or XML sources, or natively in Kubernetes (cert-manager, Istio, Linkerd).
Yes. QSafe is available fully self-hosted (Docker Compose or Helm) and runs without external connectivity. Updates are applied by offline bundle import, and the Dashboard, Scanner and Proxy all work offline.
QSafe implements the three NIST standards finalized in August 2024: FIPS 203 (ML-KEM) for key encapsulation in the Proxy, FIPS 204 (ML-DSA) and FIPS 205 (SLH-DSA) for signatures. The Scanner flags algorithms against the NIST IR 8547 schedule (deprecated 2030, disallowed 2035), and the CBOM output uses the CycloneDX format.
The Scanner analyses source code in 10+ languages, including Python, Java, Go, Rust, C and C++, TypeScript, PHP, Ruby, Kotlin and Swift. It detects RSA, ECC, AES, SHA and every deprecated NIST algorithm, with key sizes, insecure configurations and a severity rating for each finding.
Yes. The Scanner has plugins for GitHub Actions, GitLab CI, Jenkins and Azure DevOps, so new vulnerable cryptography is flagged in the pipeline, and results feed the same CycloneDX CBOM and risk dashboard as the rest of your inventory.
QSafe at a glance
- Standards implemented
- NIST FIPS 203 (ML-KEM), FIPS 204 (ML-DSA), FIPS 205 (SLH-DSA)
- Migration guidance
- Tracks NIST IR 8547 milestones (2030 and 2035)
- Hybrid TLS
- X25519 + ML-KEM-768 via a reverse proxy, no code changes
- Inventory format
- CycloneDX CBOM
- Deployment
- SaaS, self-hosted (Docker or Helm), hybrid or air-gapped
- Regions served
- Jordan, Iraq and the GCC (Saudi Arabia, UAE, Qatar, Kuwait, Bahrain, Oman)
About Nova AI
Nova AI builds AI and security platforms for banks, fintechs and central-bank-regulated institutions across MENA. Sentri stops fraud and scams in real time, QSafe finds and fixes post-quantum cryptography risk, and TraceAI investigates SOC alerts automatically. Our agentic AI platform automates banking operations such as KYC, AML checks and loan processing.
Other Nova AI security platforms
- Sentri: real-time fraud and financial-crime defence
Real-time fraud, scam & financial-crime defence that scores payments in under 50ms across every rail.
- TraceAI: autonomous SOC alert investigation
Autonomous SIEM investigation agent that triages, investigates and contains alerts in minutes.
Start your post-quantum migration with a complete crypto inventory
Launch QSafe to explore the platform, or talk to our team about running a discovery scan across your environment.