Comparison
QNSI vs HashiCorp Vault
An honest comparison. HashiCorp Vault is a mature, widely-adopted secrets platform; QNSI is purpose-built around post-quantum cryptography and offered as a hosted service first. Each is a better fit for a different problem shape - the table below makes the trade-offs explicit.
If your primary need is dynamic-secret-engine breadth on infrastructure your team already operates, Vault is hard to beat. If your primary need is post-quantum cryptographic guarantees with zero operating overhead, QNSI is the lighter path.
Side by side
Eight categories
| Category | QNSI | HashiCorp Vault |
|---|---|---|
| Post-quantum cryptography | 87 NIST-track algorithms across 13 families baked into the platform: ML-KEM (FIPS 203), ML-DSA (FIPS 204), SLH-DSA (FIPS 205), Falcon, BIKE, MAYO, CROSS, UOV, SNOVA, plus the full liboqs surface. Per-tenant crypto-policy enforcement with declarative cryptoEntropySource. NIST ACVP conformance verified live: noble 435/435 across FIPS 203/204/205, liboqs 240/240 ML-KEM via OQS_KEM_keypair_derand + OQS_KEM_encaps_derand bindings (qnsi.heossi.com/verify/conformance). | Classical algorithms (RSA, ECDSA, Ed25519, AES) by default as of May 2026 - see developer.hashicorp.com/vault/api-docs/secret/transit. The Transit secrets engine has added an ML-DSA opt-in path on a beta channel; PQC TLS terminates at the listener; key material across most secret engines (database, cloud, PKI, KV) remains classical at time of writing. Verify status against the Transit docs before quoting. |
| Operating model | Hosted SaaS (multi-tenant) on AWS Singapore is the default; private VPC, on-premises, and air-gapped deployments available on Enterprise Elite + Specialized tiers. No infrastructure to operate for the hosted offering. | Self-hosted is the canonical model - customers operate their own Vault clusters with quorum, seal/unseal, replication, and HA. HCP Vault (HashiCorp Cloud Platform) is the managed alternative but adds Consul + Vault operating surface even when hosted. |
| Multi-tenant isolation | QNSI request and service contracts carry tenant identity through edge authorization, JWT validation, and tenant-scoped KMS, vault, and audit paths. Complete cross-tenant isolation across every synchronous, asynchronous, storage, cache, export, and support path requires deployment-specific negative testing and remains NOT VERIFIED until recorded. | Namespaces (Enterprise feature) provide logical isolation within a single Vault cluster - see developer.hashicorp.com/vault/docs/enterprise/namespaces. Cryptographic isolation between namespaces is configurable but not the default; smaller deployments use one Vault per tenant. |
| Dynamic secrets | On-demand short-TTL credentials backed by per-engine drivers across 13 engine types - SQL (PostgreSQL, MySQL, MariaDB, SQL Server, Oracle), NoSQL/cache (MongoDB, Redis, Cassandra), cloud IAM (AWS STS, GCP service-account keys, Azure SP passwords), Kubernetes ServiceAccount tokens, SSH signed user certificates. Lease lifecycle is a state machine (intent → active → revoking → revoked|failed) with retry + dead-letter + reconcile sweep for orphaned principals. Per-config admin connections live in AWS Secrets Manager; vault-service resolves at provision time and never stores plaintext admin creds in its own DB. | Dynamic secrets are a Vault strength - extensive engine catalog (DB, AWS, GCP, Azure, K8s, PKI, etc.). Lease management is well-engineered. Secret leakage detection is not native; integrates with HashiCorp Sentinel for policy. |
| Audit trail | The audit source defines hash chaining, checkpoint signing, streaming, and retention contracts. Complete event ingestion, replay, and retention effects remain NOT VERIFIED. | Audit devices stream to file / syslog / socket. Tamper evidence relies on customer-side log integrity tooling (typical pattern: ship to a write-once log store). Streaming integrations supported but require customer plumbing. |
| Crypto inventory (CBOM) | Built-in apps/crypto-inventory-service produces a Cryptographic Bill of Materials, scans for classical-crypto usage that needs PQC migration, and computes a per-tenant PQC readiness score. CBOM exposed via @heossihq/qnsi SDK and the MCP server. | Not native - CBOM is typically produced by third-party scanners (Sonatype, Snyk, etc.) or in-house tooling. PQC migration tracking is not a Vault responsibility. |
| SDK story | QNSI publishes TypeScript/Node, Python, Go, Rust, and JVM/Android distribution surfaces around shared wire-contract definitions. Method coverage, byte-level interoperability, backend behavior, and activation remain version- and deployment-specific. | Official Vault Go client + community SDKs in many languages, often with varying maturity. API surface is the source of truth; client libraries vary in their abstractions. |
| Free tier | Free forever: 25 vault secrets, 20 KMS keys, 10 GB encrypted storage, 50 000 API calls/month, no credit card. Tier limits independently reproducible from the public mirror at github.com/heossihq/qnsi-public. | Open-source Vault is free to run; HCP Vault has a free tier with limited storage / requests. Vault Enterprise (namespaces, performance replication, governance) is commercial. |
When to pick which
Decision guide
Stay on Vault if…
- Dynamic secret engines (DB credentials, cloud IAM, K8s, PKI) are the dominant use case.
- Your team is comfortable operating a Vault cluster (or already has HCP Vault) and the threat model doesn't require PQC.
- Sentinel policy-as-code is core to your governance.
Add QNSI alongside Vault if…
- You need versioned secrets with a PQC-envelope target for a specific class of long-lived data without disrupting your existing Vault flow.
- Your auditor is asking for a Cryptographic Bill of Materials (CBOM).
- You want signed audit evidence the auditor can verify externally.
Move to QNSI if…
- You don't want to operate Vault clusters and the hosted offering's tradeoffs are acceptable.
- Post-quantum readiness is in your roadmap and you'd rather adopt PQC by default than back-port.
- You need multi-tenant isolation cryptographically enforced by the platform.
Try it yourself
See QNSI run real PQC ops in 30 seconds
The live PQC sandbox at qnsi.heossi.com/#verify-sandbox runs real ML-KEM-768 + ML-DSA-65 round-trips on every request. No signup, no API key. Then sign up for a free QNSI account and wrap your first secret with the @heossihq/qnsi SDK.