Quantinus is a post-quantum cryptography readiness platform. This policy explains what we collect, where it is stored, who processes it, and what we do not do. Where we cannot support a claim, we do not make it.
Quantinus is operated by Orevi Inc., a corporation registered in Canada, based in Stratford, Ontario. Our platform helps organizations find the cryptography running in their environment and understand where it is weak or quantum-vulnerable.
For privacy inquiries, contact us at: hello@quantinus.io
When you run the Quantinus scanning agent in your environment, it sends us:
The agent never sends: private keys, plaintext secrets, passwords, or the contents of network traffic. It reads cryptographic configuration, not data.
Two things that description does not cover, and should. A certificate subject can contain a person's name or email address, and a file path can contain a username. The agent sends both, along with hostnames and IP addresses, because they are how a finding is identified. We do not look for personal data, but we cannot promise that none reaches us inside those fields.
We do not run product analytics. There is no analytics service, tag manager or tracking pixel on this website or in the dashboard.
The questionnaire at quantinus.io/check runs in your browser. Your answers are sent to our API to work out which requirements apply and are not stored — no record of your answers is kept on our servers or in our database. If you choose to give us your email address and tick the consent box, that address, the consent wording you agreed to, the date, and the list of requirements that applied are sent to Formspree Inc. (United States), which we use to receive form submissions, and then to us by email. Your individual answers are not included. The questionnaire sets no cookies and makes no third-party requests.
We use the information we collect to:
We do not sell your data to third parties. We do not use your data to train AI models. We do not serve advertising.
For users in the European Union, we process personal data under the following legal bases:
The Quantinus API and database run on Railway, in the United States. There is one deployment. You cannot select a region, and we do not offer regional storage: any statement to the contrary in an earlier version of this policy was wrong, and this section replaces it.
This means personal data crosses borders by design. If you are in Canada, the European Union, or anywhere outside the United States, your data is stored in the United States and is accessible to the service providers listed in section 7, which are US-based. If that is not acceptable for your organization, tell us before you deploy the agent.
Email is the exception. Our mailbox is hosted by Proton Mail in Switzerland, so anything you send us by email is stored there rather than in the United States. The European Commission recognises Switzerland as providing an adequate level of data protection.
We use Amazon Web Services in the ca-central-1 region for one purpose only: storing the platform's own secrets and credentials. No customer data is stored in AWS.
The dashboard and this website are served by Vercel.
These companies process data on our behalf. This is the complete list:
Beyond these providers, we share data only where required by law, court order or government authority; in connection with a merger, acquisition or sale of assets, with notice to you; or with your explicit consent.
We never sell, rent, or trade your personal data or scan results to any third party.
We do not currently run an automated deletion schedule, so we are not going to promise one. In practice:
To have any of it deleted, email hello@quantinus.io. If we introduce a fixed retention period, we will update this section before it takes effect.
The dashboard sets the cookies required to keep you signed in. That is the only category of cookie we use.
This website sets no cookies at all. The compliance questionnaire sets none, stores nothing in your browser, and keeps your answers only in memory for as long as the page is open. We use no advertising cookies and no third-party tracking, and the fonts on this site are served from our own domain rather than a font provider.
Depending on your location, you may have the following rights regarding your personal data:
To exercise any of these rights, contact us at hello@quantinus.io. We will respond within 30 days.
EU residents have the right to lodge a complaint with their national data protection authority. Canadian residents may complain to the Office of the Privacy Commissioner of Canada.
We apply the following security measures:
Administrative access to the database uses a credential that bypasses row-level security and whose use is not currently logged. We are addressing that; until we have, we are not claiming audit logging of administrative access.
To report a security vulnerability, please email hello@quantinus.io with the subject line "Security Disclosure". We will acknowledge your report and keep you updated as we investigate.
Quantinus is intended for use by organizations and their authorized personnel. We do not knowingly collect personal data from individuals under the age of 18. If you believe a minor has provided us with personal data, please contact us immediately.
We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email (if we have your address) and update the effective date at the top of this page. Your continued use of Quantinus after changes take effect constitutes acceptance of the updated policy.
For privacy questions, requests, or concerns:
We aim to respond to all privacy inquiries within 5 business days.