QUANTASEAL
QUANTASEAL
Every data movement — from a single API call to a continuous bidirectional sync — uses the same post-quantum encryption envelope and the same immutable audit trail.
Your app calls QuantaSeal. QuantaSeal encrypts the payload with ML-KEM-768 + AES-256-GCM, signs it with ML-DSA-65, then forwards the encrypted envelope to the target system.
An external system sends an encrypted payload to QuantaSeal. QuantaSeal verifies both ML-DSA-65 and HMAC-SHA-512 signatures, checks the replay nonce, then decrypts and delivers to your system.
QuantaSeal continuously reads from both systems, applies your field mappings, resolves conflicts, and writes encrypted records to both sides — with checkpoint-based pause and resume.
Every payload — regardless of source or destination — is wrapped in the same four-layer HybridCryptoEnvelope before any data leaves QuantaSeal.
ML-KEM-768 encapsulates the shared secret. HKDF-SHA-512 stretches it to 32 bytes. AES-256-GCM encrypts your data. Pure PQC or pure classical is never used.
ML-DSA-65 and HMAC-SHA-512 are verified with a bitwise & — not a short-circuit &&. If either fails, decryption never starts. This prevents chosen-ciphertext attacks.
Trace a single outbound proxy call from the moment your app sends plaintext to when the encrypted object lands in S3 — with every security check in between.
JWT validated by QuantaSeal API. Tenant ID extracted from the access token — every subsequent query is scoped to this tenant.
ML-KEM-768 and ML-DSA-65 keypairs fetched from the DB. Private keys are KMS-wrapped and never written to disk in plaintext.
Payload wrapped in a HybridCryptoEnvelope: ML-KEM-768 encapsulation → HKDF-SHA-512 → AES-256-GCM encrypt → ML-DSA-65 + HMAC-SHA-512 sign.
Integration credentials are KMS-unwrapped and PQC-decrypted in memory. For Salesforce, a JWT Bearer token is signed inside the Nitro Enclave — the private key never leaves it.
Operation compared against Integration.allowed_operations. "put" not in the list? 403 returned before any network call is attempted. Default-deny by design.
Target URL DNS-resolved and validated. Private IP ranges (10.x, 192.168.x, 172.16–31.x, 127.x) and internal suffixes (.local, .internal) are blocked unconditionally.
Encrypted envelope sent to AWS S3 via httpx with AWS Signature v4 headers. S3 stores the ciphertext — it never sees plaintext. Object metadata tags the file as QuantaSeal-encrypted.
INTEGRATION_PROXY_OUTBOUND logged to AuditLog with SHA3-256 hash chain entry and ML-DSA-65 signature. Response returned to caller.
{
"encrypted": {
"ciphertext_kem": "e3b0c44298fc1c149af...", // ML-KEM-768 ~1088 bytes
"ciphertext_data": "9f86d081884c7d65...", // AES-256-GCM ciphertext
"nonce": "[NEVER LOGGED]", // 12-byte GCM nonce
"tenant_id": "a1b2c3d4-...",
"algorithm": "ML-KEM-768"
},
"signature": {
"pqc_signature": "3082014a0201003...", // ML-DSA-65 ~3309 bytes
"hmac_signature": "a665a45920422f9...", // HMAC-SHA-512 64 bytes
"algorithm": "ML-DSA-65+HMAC-SHA-512"
}
}
// S3 object metadata:
// x-amz-meta-quantaseal-encrypted: true
// x-amz-meta-quantaseal-tenant-id: a1b2c3d4-...Define field mappings, choose a conflict strategy, and let QuantaSeal continuously reconcile data between any two connected systems with checkpoint-based pause and resume.
Read every record and write all to target. Use for initial loads.
Only records modified since the last run (timestamp/cursor based).
Real-time change data capture. Salesforce CometD, Kafka consumer groups.
Two-way sync with conflict detection and resolution on both sides.
Source version always overwrites target.
Target version is preserved, source changes ignored.
Record with the later LastModifiedDate wins.
Both versions stored; flagged _conflict: true for human review.
Checkpointing: Progress stored in Redis after every page (default 200 records). Jobs can be paused mid-run and resumed exactly from the last cursor.
Map any source field to any target field with built-in transforms. Mark sensitive fields encrypt_in_transit: true for a second PQC encryption layer at the field level.
QuantaSeal ships a dedicated adapter for each system — speaking the native protocol (SOQL, OData, AMQP, JDBC, gRPC) while wrapping all traffic in the same PQC envelope.
Don't see your system? Use generic_rest, generic_grpc, or generic_webhook — or build a custom adapter with the Adapter SDK.
Chain integrations together with Workflows — trigger on webhooks, schedules, or CDC events, transform data, encrypt, write to a target system, and notify your team.
Trigger types
webhookschedule (cron)cdc_eventmanualsync_completeStep actions
ENCRYPT_PAYLOADFIELD_MAPSYNC_DATAHTTP_REQUESTBRANCHDELAYNOTIFYError handling
fail (stop workflow)skip (continue)retry (0–10 attempts)condition expressionsEvery proxy call, sync batch, and workflow execution passes through the same security stack. There are no fast paths that bypass encryption, audit logging, or tenant isolation.
Every database query includes tenant_id in WHERE. Cross-tenant data access is architecturally impossible. All comparisons use hmac.compare_digest() to prevent timing attacks.
Integration credentials sealed with 3-layer encryption: HybridCryptoEnvelope → AWS KMS CMK wrap. Plaintext never persists to disk. Unsealed only for the single request lifetime.
Every outbound URL is DNS-resolved and checked against private IP ranges before any HTTP call is made. Trusted SaaS domains (amazonaws.com, salesforce.com) bypass DNS resolution.
Each integration has an allowed_operations list. Default-deny: if the operation is not in the list, the request is rejected before any credential is unsealed.
Every inbound request nonce is stored in Redis with a 5-minute TTL. Duplicate nonces are rejected immediately — preventing replayed webhooks and duplicate messages.
All outbound HTTP calls go through a 3-state circuit breaker. After 5 consecutive failures the circuit opens for 30 seconds, preventing cascading failures.
Every operation written to AuditLog as a SHA3-256 hash-chained, ML-DSA-65-signed entry. Modifying any entry breaks the chain. Streamed to S3 WORM bucket for long-term retention.
Connect your first integration in minutes. QuantaSeal provides adapters, SDKs, and a hosted API — no infrastructure to manage on the Starter plan.