Post-Quantum Claims Should Be Verifiable: How QNSI Proves Them

Post-quantum security has a credibility problem. The market is full of broad claims: “quantum-safe,” “crypto-agile,” and “enterprise-ready.” But a security team cannot migrate a regulated estate on adjectives. It needs to know what is implemented, what is available now, how a change is governed, and which evidence can be checked without trusting a vendor presentation.

That is the standard we are building QNSI around at HEOSSI: product claims should lead to evidence a buyer can inspect and, where possible, reproduce.

From cryptographic inventory to governed change

QNSI connects discovery, planning, execution, custody, and operational evidence into one migration chain.

Discover cryptography across infrastructure, hosts, TLS, and source code. The QNSI CLI scans source repositories locally and uploads signed normalized findings rather than repository contents. Host discovery checkpoints progress, resumes after interruption, and supports signed evidence transfer from disconnected or air-gapped estates.
Turn findings into an accountable migration plan. Assets move through hash-bound dry runs, approval and four-eyes controls where configured, durable waves, individual cutover confirmation, crash recovery, and reconciliation against the observed result.
Choose the right custody path without blurring validation boundaries. Native-PQC HSM and cloud-KMS products now exist. QNSI's current HSPK path is an ML-DSA-44/65/87 compatibility option for qualified PKCS#11 estates: the HSM performs RSA-OAEP custody while QNSI performs ML-DSA outside the module.
Retain operational evidence. QNSI's AI event-intelligence workflow detects anomalies, correlates signals, builds root-cause context, and prepares remediation proposals. A proposal is not an automatic production change: tenant authorization and configured operator approval remain in the path.

A broad catalog, with a strict operated boundary

QNSI exposes a catalog of 87 post-quantum algorithms across 13 families for migration, interoperability, and research use. HEOSSI-operated cryptographic trust paths use the finalized NIST standards: ML-KEM (FIPS 203), ML-DSA (FIPS 204), and SLH-DSA (FIPS 205). FN-DSA/Falcon remains draft and is excluded from finalized-only policy tiers.

We publish reproducible conformance evidence instead of converting test results into a vague badge:

435/435 addressable ACVP-vector checks for the pure-JavaScript reference and cross-verification provider
240/240 addressable ML-KEM checks for the native provider
Committed evidence files and methodology that let an evaluator inspect how each result was produced

These are vendor-run conformance results against published ACVP vectors-not a claim of NIST CAVP or CMVP certification. Inspect the methodology and evidence at qnsi.heossi.com/verify/conformance.

The product facts are signed, too

QNSI publishes a deterministic facts.json document with two signatures over the same canonical bytes: ML-DSA-65 and Ed25519. A verifier validates both proofs against keys published by the producer. Removing the post-quantum proof is a verification failure, not an acceptable downgrade.

The signed document records the current product facts-including the 18-service production footprint, public SDK releases, capability affordances, pricing entry point, and recent shipped changes-and drives the human- and machine-readable llms.txt view. A signature proves origin and integrity; the linked reproducible evidence establishes what the implementation does. Serious infrastructure needs both.

Inspect the evidence yourself

Signed product facts: https://qnsi.heossi.com/facts.json
Published verification keys: https://qnsi.heossi.com/.well-known/facts-signing-key
Human and AI product projection: https://qnsi.heossi.com/llms.txt
Conformance evidence: https://qnsi.heossi.com/verify/conformance
Reproducible benchmarks: https://qnsi.heossi.com/benchmarks
Source-code discovery: https://docs.qnsi.heossi.com/crypto/source-code-scanning
Governed migration execution: https://docs.qnsi.heossi.com/migration/governed-execution
HSM and HSPK integration: https://docs.qnsi.heossi.com/kms/hsm-integration
AI event intelligence: https://docs.qnsi.heossi.com/observability/ai-intelligence
MCP server: https://docs.qnsi.heossi.com/sdk/mcp-server
Public source mirror and SDKs: https://github.com/heossihq/qnsi-public

Turn inventory into a governed migration program

If your organization is planning its post-quantum migration-or trying to turn an inventory into a governed, recoverable program-I would be glad to compare notes.

QNSI is free to start at https://cloud.qnsi.heossi.com/auth?mode=signup. Developer plans begin at $149 per month; qualified HSM custody and specialized deployment models are enterprise engagements.