Quantinus finds the certificates, keys and protocols running in your environment, and ranks what is weak or quantum-vulnerable.
No professional services. No implementation team. No consulting fees. Results in minutes.
A few questions, about two minutes. You get a plain-language summary of the requirements that apply to your situation: what each one asks for, what Quantinus covers, what it does not cover, and what is at stake.
No email required to see your result.
Requirement 12.3.3 asks for a documented inventory of the cipher suites and protocols you use, reviewed every 12 months. Requirement 4.2.1.1 asks for an inventory of the trusted keys and certificates that protect cardholder data in transit. Both have been required since 31 March 2025.
Quantinus produces a dated inventory of the certificates, TLS settings and SSH keys it finds, with weak algorithms flagged, and a 12.3.3 evidence report covering 12 months of monitoring and changes. It covers the transmission and certificate side, not stored-data encryption or password protection, and it does not decide whether you meet the requirement. Your QSA does.
Source: PCI DSS v4.0.1, Requirement 12.3.3 (p. 299) and Requirement 4.2.1.1 (p. 116), PCI SSC document library.
This list is what the agent does today. Anything not on it, we do not claim.
--no-legacy-probes where security monitoring flags them.--enum-suites): every protocol version, cipher suite and TLS 1.3 key-exchange group an endpoint accepts, post-quantum hybrids included--scan-db): whether PostgreSQL, MySQL/MariaDB, SQL Server, MongoDB and Redis offer or require TLS, and the certificate they serve. No username or password is ever sent.--scan-stores): Windows LocalMachine and CurrentUser, and the Linux trust-store paths. Read-only; private keys are never requested.--scan-disk): BitLocker, LUKS and FileVault status. Never recovery keys or passphrases.--aws): ACM certificates, KMS key metadata, and Secrets Manager metadata, including which key encrypts each secret. Uses your read-only credentials. Never secret values or key material.If the agent does not detect something, that means it was not detected. It does not mean the thing is absent, and we do not report it as such. A server that refuses a probe may still support what we could not confirm.
Some of these are on the roadmap. None of them are in the product today.
Every finding has a severity — critical, high, medium or low — for how weak it is today, and one badge for what kind of problem it is. These are the same badges you see in the dashboard.
A larger RSA or elliptic-curve key does not protect against a quantum computer; only migrating does.
Not published yet. Email hello@quantinus.io and we will talk about your situation.
Quantinus partners help their clients find and fix weak and quantum-vulnerable cryptography. You bring the relationships. We bring the platform.
Security is not a feature we add — it is the foundation we build on.
The agent sends cryptographic metadata only. Private keys, plaintext secrets and the contents of network traffic never leave your environment.
Encrypted in transit with TLS 1.2 or 1.3; older versions are refused. Data at rest is encrypted by our hosting providers, Railway and Vercel, as their data processing agreements state.
Report vulnerabilities to hello@quantinus.io with the subject line “Security Disclosure”, or see our security.txt. We will acknowledge your report and keep you updated as we investigate.
Admin and member roles for each organization. Every change to a finding’s status is recorded with who made it and when.
Each customer’s data is isolated with row-level security on every dashboard and API read. Those reads use a database role that cannot bypass it.
Our website and dashboard negotiate the X25519MLKEM768 post-quantum hybrid. Our API does not yet; our own scanner flags it, and we track it like any customer finding.
Join early access. We are onboarding a small number of teams now.
If you have a 12.3.3 finding to close or an assessment coming, we want to hear about it.
Or email us at hello@quantinus.io
By submitting you agree to our Privacy Policy and Terms of Service.