One cryptographic inventory, in priority order. You keep your HSM and certificate vendors.
Request the inventoryWho reads it
Where is breakable public-key cryptography still in use, who runs it, and what moves first?
The file for the board.
The inventory of keys and certificates.
Owners, dates, and dependencies.
Vendor deadlines in the contract.
One page they can adopt.
A dated quantum-safe roadmap.
The work
A post-quantum migration plan starts as a map of the estate you already have. We do not replace the vendors who will do the cutover.
Every place the institution still uses breakable public-key cryptography: TLS, signing, APIs, HSMs, cloud keys, and the vendors who run them.
Long-lived secrets first. Customer files, contracts, and deals that must stay confidential for years. Short-lived session keys later.
One page: milestones, owners, vendor deadlines, and what “done” means. A board can adopt it. A supervisor can read it.
Why now
Supervisors are asking for a quantum-safe roadmap. The useful answer is an inventory and an order of work.
A future quantum computer breaks today’s public-key encryption. Data that must stay secret for years is already the priority, because it can be stored now and decrypted when the machine exists.
G7 guidance points critical financial systems at 2030–2032, with a fuller transition around 2035. Some supervisors want a board-level plan sooner. The first question is still where the cryptography is.
Your HSM vendor, your certificate vendor, and your cloud key service will each say they are quantum-safe on their own timeline. None of them can see the whole estate.
What this is
Your vendors will each report a timeline. This is the inventory of the estate they do not share.
| What you already hear | What you leave with |
|---|---|
| Each vendor reports their own timeline | One inventory of the whole estate |
| An innovation-lab pilot | A file the board can adopt |
| A new cipher or a new HSM | Your current vendors stay in place |
| A science briefing on quantum computers | Owners, milestones, and a definition of done |
| A living platform on day one | A fixed-fee report first. A subscription only if the board uses it |
The engagement
We show one institution where classical encryption still protects long-lived data, and the order in which to move it. Your CISO keeps the vendors. We produce the map they cannot produce alone.
We agree what is in: in-house systems, cloud, and named vendors. We work from exports you already hold — certificate lists, HSM inventories, TLS scans, and contract registers. We do not arrive and scan production on our own.
Each use of breakable public-key cryptography is tagged with the algorithm, where the key lives, who operates it, and how long the data must stay secret. Gaps are written down. A missing system is a finding, not a silent omission.
Long-lived customer, contract, and deal data moves first. Short-lived trading sessions wait. Vendor-owned systems are listed with the question you will put in the contract.
Milestones, owners, vendor deadlines, and a definition of done. You take it to the board. If they use it, we can keep the inventory current. If they do not, you have paid for a single report.
The CISO, the head of PKI, or the person who owns operational resilience and third-party risk. The innovation lab buys quantum pilots. This buyer needs a file for the board.
Illustrative sample · not a client report
This is the shape of the quantum-safe roadmap. Names, systems, and dates on a real engagement are the institution’s. Nothing below is a customer.
Board risk committee · quantum-safe roadmap
Classical public-key encryption still protects data this institution must keep secret for years. That data can be recorded now and read later. The committee is asked to adopt the order below and to name an owner for each line.
| What | Cryptography today | Who runs it | Order |
|---|---|---|---|
| Customer archive, 15-year retention | RSA-2048 | Cloud storage vendor | Move first |
| Board and deal correspondence | ECDH on mail gateway | In-house | Move first |
| Interbank file transfer | RSA on VPN | Network vendor | Contract deadline |
| Card-scheme keys | Vendor-managed | Scheme | Their roadmap, your date |
| Intraday trading TLS | ECDHE, session-only | In-house | Later |
Pricing
We do not publish a rate card. The fee follows the size of the estate: how many legal entities, how many certificate sources, and how many vendors sit on the critical path.
Fixed fee
Quoted after a scoping call. One institution.
After the report
Only if the board uses the first page.
Company
Quant.rich produces a cryptographic inventory and a quantum-safe roadmap for one financial institution at a time. The deliverable is a file a board can adopt: where breakable public-key encryption still sits, what must move first, and who owns each date.
We do not sell a quantum computer, a new encryption algorithm, or a replacement for your HSM and certificate vendors. Those firms already have a product. They cannot see the rest of the estate.
The first engagement is a fixed-fee report. A living inventory comes after, and only if the board uses the page.
Request
Tell us the institution and who owns the question. We reply with what the first six weeks would cover, and a fixed fee for that scope.
Scope
How we handle data
The work product describes your cryptography. Treat the rules below as the starting position for the engagement letter, not as a certified control set.
Certificate lists, HSM inventories, cloud key reports, and the vendor register. A production scan happens only if it is written into the scope, on your network, under your change control.
You keep the working papers and the board page. We do not reuse a named system, vendor, or finding in marketing.
This site does not assert SOC 2, ISO 27001, or a completed penetration test. If a supervisor or procurement team needs a specific control, we say whether we have it before the work starts.
We do not take custody of private keys, HSMs, or production certificates. The engagement identifies them. It does not operate them.
Draft for the website · 1 October 2026
A fixed-fee professional services engagement: a cryptographic inventory, a priority order, and a one-page roadmap. The signed engagement letter controls. This page is a description, not that letter.
Inventories, exports, and findings belong to the institution. Quant.rich does not claim rights in them and does not publish named findings.
The roadmap is not a warranty that a system is quantum-safe, not a certification, and not legal, regulatory, or cryptographic-implementation advice. Cutover stays with your vendors and your own teams.
A request sent from the site opens your mail application. This website does not store the form. Material shared during an engagement is kept for the life of that engagement and deleted when the letter says so.