Home / Products / Quantpass Vault
Quantpass Vault
A post-quantum identity and credential platform. Credentials are encrypted on the device before they leave it. Authentication is a Dilithium2 signature, not a password sent to a server. The vault holds ciphertext. Humans, machines, AI agents and CI/CD pipelines share the same cryptographic floor.
Zero-knowledge vault · ML-KEM-1024 · ML-DSA-44 · rotation on humans, CI/CD tokens and AI agent keys.
Capabilities
Harvest now, decrypt later
Stolen ciphertext must still face ML-KEM-1024 (NIST FIPS 203). The vault assumes RSA and ECC will fail, rather than patching for it later.
Zero-knowledge credential store
Private keys never leave the device. Servers store public keys and encrypted blobs. A copy of the tenant does not yield usable passwords.
Phishing-resistant sign-in
No shared secret is transmitted. The client signs a nonce with ML-DSA-44 (FIPS 204). Optional FIDO2 on the identity card.
Enterprise passwordless vault
Browser extension autofills without exposing plaintext to the service, on the login forms you already have.
Machine secrets and rotation
API keys, SSH keys, TLS certificates, tokens. Automated rotation. Every checkout written to a signed audit trail.
AI agents and CI/CD
Headless vault API. Ephemeral credentials for agents and pipelines. Secrets injected without living in environment variables.
Identity provider overlay
SAML and OIDC SSO. SCIM from Okta or Entra. The identity provider answers who may enroll. The vault answers what they may hold.
SIEM and evidence
Tamper-evident, signed audit logs. Forward to Splunk or Microsoft Sentinel. Device revoke and keypair re-enrollment from the console.
Crypto-agility with a floor
Policy sets the cryptographic floor. AES-256-GCM at rest. TLS 1.3 in flight. Post-quantum on the credential itself.
No plaintext on the server. No password on the wire. Same vault for people, machines and agents.
Credentials in Quantpass Vault are rotated on a finding from the NHI misuse threat library, so the secret behind a revoked entitlement is replaced and not only flagged. Rotation is how identity threat remediation closes a case.
ID entitlement. Rank by risk. Remediate.
Start with a two-week, read-only pilot against one lifecycle path. If nothing turns up, you keep a clean report.