Platform
Visibility, tracking and proof for your post-quantum migration.
Your teams do the migration. The plane knows your cryptographic estate, predicts what each change will break, tracks the work until it verifies, and records every step in evidence your auditor checks without trusting us. The cryptography itself stays in your HSMs.
Know
Your estate, and how we know it
The plane builds its picture from what flows through it, your HSM fleet over PKCS#11 and KMIP, and the CBOM from the discovery tool you already use. Every assertion carries its provenance and confidence: known directly, verified by test, or inferred from an ingested inventory.
Know
Readiness and migration status, kept apart
Whether an asset is broken today, quantum-vulnerable or quantum-safe is one axis. Whether it's queued, in flight, gated or done is another. The queue runs on both, so the urgent problems go first.
Predict
A dry run before anything moves
Before a key changes, the plane resolves every consumer it touches and predicts which will fail. A canary signature over a harmless payload confirms each one against the staged key, with zero production impact.
Predict
Validated, not just supported
Running ML-DSA in firmware isn't the same as being validated for it. The plane reads what each module can do inside its FIPS 140-3 boundary, plans keys only where your policy allows, and tells you plainly when none of your modules qualify yet.
Track
Blockers with owners, closed by verification
A consumer that can't take the new key becomes a tracked blocker with an owner and an estimate. Your teams run the work; the blocker closes only when the plane re-runs the right test and the fix verifies. Until then, the old key isn't retired.
Track
Compliance as a rate
A burndown of everything still open against your deadline, with the pace you need and the pace you're keeping. Logged and projected hours show what the migration costs against the rest of the roadmap.
Prove
Agility, measured
Every asset carries a signed history of each change to its cryptography: rotations, algorithm migrations and their approvals, how long each took, and what the next one will cost.
Prove · The evidence record
Every step, in a record your auditor verifies without us.
What is recorded
Every change to a key or signature, every policy decision, approval and posture change, in the order it happened, including what's still open.
How it is sealed
Records are chained and committed under Merkle roots. Each checkpoint is signed with ML-DSA (FIPS 204) and anchored outside our control.
How your auditor checks it
With the record and our published public key, an auditor confirms the sequence of events and that nothing was altered or removed, without trusting Dainamiq or asking us anything.
We sign our own releases the same way: ML-DSA-87 and OpenPGP, with the keys published at /keys.
Your HSMs and gateways
One plane across the hardware you run.
The plane works across the major enterprise HSM families: Thales, Entrust nShield, AWS CloudHSM, Utimaco and Securosys, over the standard interfaces they already speak. Where a module isn’t yet validated for post-quantum, the plane shows it, so the hardware decision is yours and made with the facts.
Your firewall already speaks our API. If you run Juniper SRX/MX (Junos 22.4R1+), Fortinet FortiGate (FortiOS 7.4.2+), or Palo Alto (PAN-OS 12.1+), the ETSI 014 REST client is already in the firmware, with no agent and no sidecar. On Juniper it is exactly “point the quantum-key-manager profile at our URL”.