KavachQ · Cryptographic inventory
See the cryptography you run, find what's most exposed, get a phased plan to NIST PQC — and the board-ready evidence to prove it. Grounded in the DST National Quantum Mission roadmap and the regulators your auditors answer to: RBI, SEBI, IRDAI, CERT-In.
🔒 The free scan reads only what's publicly negotiated in a TLS handshake — no sign-in, nothing stored.
Global crypto-discovery tools map to someone else's regulator. KavachQ is shaped around India's framework, deadlines, and deployment constraints.
Grounded in the DST National Quantum Mission roadmap, its M1/M2/M3 milestones, and India's regulators — not a foreign mandate.
Managed scan, in-VPC, on-prem, or air-gapped self-hosted Docker. Your cryptographic inventory stays inside your boundary.
The inventory is a signed CBOM in open CycloneDX 1.6 — evidence your own auditors can reproduce, and that travels with you. No lock-in.
Start with a free public scan of any domain's TLS — no sign-in, results in seconds. See the product work before a conversation.
One pipeline. Your cryptography goes in; a ranked plan and audit-ready evidence come out.
Build a Cryptographic Bill of Materials — certificates, algorithms, and the key parameters behind them — in CycloneDX 1.6.
Score every asset 0–100 and tier it T1–T4 — algorithm strength, internet exposure, criticality, cert expiry, harvest-now — worst-first.
A phased, impact-aware move to ML-KEM / ML-DSA / SLH-DSA — hybrid by default, with the apps each change touches mapped.
Export the phased roadmap to Jira (CSV) / your tracker. Your team executes — KavachQ never touches production.
A board PDF + signed CBOM, every finding tagged to DST/NQM milestones and the relevant RBI / SEBI / CERT-In references.
The free scan runs stages 01–02 on your public TLS, instantly. The rest unlocks in an engagement.
Shipping now: live public-TLS scanning; source and config scanning with a file path and line number behind every finding; cloud estate discovery from your own read-only AWS / Azure CLI exports (KMS, ACM, ELBv2, Key Vault keys and certificates — we ship no cloud SDK and hold no cloud credentials); PKCS#12 keystore enumeration when you supply the password; agentic machine-identity anchors; plus ingest of the certificates, SBOMs and CBOMs you supply (CSV, tarball, or CycloneDX 1.6). All of it serialises into one signed CBOM with a quantum-risk graph, exportable as CycloneDX 1.6 or SPDX 2.3. On the roadmap: agent-based internal discovery and CA/PKI chain walking — we read the chain a host or keystore presents, but do not yet walk issuers up to a root. We name the surfaces we cover, so the gaps are never implied away.
A CISO should never put a third party between their production traffic and their keys. KavachQ reads and advises; you stay in control of every change.
Trust boundary — KavachQ does not hold, rotate, or enforce your production cryptography.
Not a dashboard you have to live in — portable deliverables you own.
Every certificate, algorithm, and key parameter we can see — a signed CycloneDX 1.6 CBOM your auditors can re-open.
A 0–100 score and a T1–T4 tier per asset — algorithm strength, exposure, criticality, cert expiry, and harvest-now risk.
A sequenced, impact-aware move to ML-KEM / ML-DSA / SLH-DSA your team can calendar — hybrid by default.
A board PDF + signed CBOM — every finding tagged to DST/NQM milestones and RBI / SEBI / CERT-In references.
Illustrative output — not real customer data.
Not a rendered mockup — the actual KavachQ console, captured on a demo tenant. The numbers are illustrative, and real client estates never leave your environment.
Captured from the working KavachQ console on a demo tenant · illustrative data · client identities blurred or omitted.
A low-commitment path — see it work before you widen the scope.
Run it on any domain today. See Discover + Score on your public TLS in seconds — no sign-in, nothing stored.
NOW · SELF-SERVEA scoped engagement on a slice of your estate — supply your certs / CBOM and get a real signed CBOM, a ranked risk register, and a first plan.
SCOPED ENGAGEMENTRun KavachQ where your regulated data lives — in-VPC, on-prem, or air-gapped self-hosted Docker — with no key custody.
IN YOUR VPCKavachQ produces portable artifacts, so the plan lands where your team already works.
The phased roadmap exports as a Jira-ready CSV — alongside the signed CycloneDX 1.6 CBOM and a JSON risk graph that drop into any system you run.
Two-way connectors are planned, not shipped — shown greyed so nothing is implied as live.
Free, open material on the quantum threat and India's response — the understanding our team works from.
An animated masterclass — Shor's algorithm breaking RSA, harvest-now-decrypt-later, and the lattice maths behind PQC.
From "the two clocks" to the CBOM, FIPS 203/204/205, who regulates the transition, and UPI's reliance on RSA-2048.
The DST National Quantum Mission roadmap — milestone years, the three personas, and the M1/M2/M3 deadlines, summarised.
Run it on any domain. The product works in front of you, before any sales call.
A standard, machine-readable CBOM — reproducible, portable, no lock-in.
Self-hosted Docker (incl. air-gapped) keeps sensitive estates inside your boundary.
We summarise official DST and NIST sources plainly; no pay-for-placement.
Run a free scan, then bring KavachQ to your whole estate — discovery, scoring, planning, and proof, aligned to India's framework.