Privacy by design
Each workload carries a defined privacy model, parameters and limitations.
Quantum-ready security and privacy
Reduce What Must Be Shared.
Protect What Still Moves.
Qualimetrix Continuum adds quantum-safe transport to governed synthetic data: two lines under one policy surface, for regulated environments where records stay sensitive for decades.
Current scopeRelational and tabularGoverned synthetic counterparts
TransportHybrid classical + PQC
EvidenceAttached per accepted release
Review modelTask-level
StatusSubject to assessment
Suite capabilities
Task-level utility
Structural, statistical and downstream performance are measured separately.
Quantum-safe transport
Hybrid classical and post-quantum key establishment protects what has to cross the boundary.
Evidence attached
Methods, results, limitations and release identifiers remain inspectable.
Two lines
One suite, two problems that shrink each other.
Governed synthetic data
Shipping product.
Qualimetrix creates governed relational and tabular counterparts for software testing, AI validation and controlled collaboration. Every production copy that is not distributed is data that no longer needs quantum-safe protection.
- Relational and tabular counterparts
- Utility measured per task, not in aggregate
- Methods, results and limitations attached per release
Quantum-safe transport
In build.
Patient records, policies and contracts stay sensitive for decades, while traffic captured today can be decrypted later. The PQC Gateway terminates and re-establishes traffic with hybrid key establishment, keeping the classical layer in place.
- Hybrid X25519 and ML-KEM-768 key establishment
- Key lifecycle held in your KMS or HSM
- Negotiation and rotation recorded per zone
Boundary
Continuum reduces the number of environments that require production records, and protects the exchanges that remain. It does not replace identity, endpoint, infrastructure or software-supply-chain security, and the PQC Gateway and Policy Orchestration are still in build.
The suite
Four modules under one policy surface.
Control plane
PQC Gateway
Terminates inbound traffic, re-establishes outbound connections with hybrid key establishment, and manages the key lifecycle against the customer KMS.
TLS 1.3 hybrid KEMmTLS · SPIFFEPKCS#11gRPC · HTTP proxy
Counterpart Engine
Reads schema and distributions inside the boundary, generates relational counterparts, and measures utility per task before release.
JDBC · ODBCCDC streamsParquet · CSVCI runners
Policy Orchestration
Holds the privacy model, approval and retention rules for each workload, and refuses releases that do not meet them.
OpenAPIGit-backed policyOIDC · SCIMWebhooks
Adapters
Attaches the suite to existing databases, buses, key vaults and pipelines under least-privilege credentials declared in policy.
Postgres · Oracle · SQL ServerKafkaAWS KMS · Azure Key VaultGitHub · GitLab CI
Migration path
From inventory to post-quantum, in a defensible order.
01 — Cryptographic inventory
Adapters record which systems use which algorithms, where keys are held, and which flows stay sensitive for longer than their current cryptography will hold.
Deliverable
A cryptographic inventory with a retention horizon per flow and a ranked exposure list.
02 — Reduce what moves
Before transport is rebuilt, unnecessary production copies are withdrawn. Counterparts replace them across development, test, analytics and AI work.
Deliverable
Governed counterparts per workload, with utility measurement and limitations recorded per task.
03 — Hybrid key establishment
The PQC Gateway negotiates X25519 and ML-KEM-768 together, so a failed post-quantum negotiation does not cost confidentiality.
Deliverable
Hybrid transport per zone, with a key rotation policy and negotiation records.
04 — PQC-preferred and re-encryption
New connections prefer post-quantum by default. Long-lived archives are re-encrypted and re-signed in order of retention horizon and risk.
Deliverable
A re-encryption register per archive, with a residual-risk statement.
Partnerships
Four partners next to the suite, not inside it.
A software-first architecture for Information-Theoretic Security at the client boundary, developed and sold by QuStream.
An enterprise AI practice and product studio; ACTLAS renders the EU AI Act and GDPR as a typed graph an agent can reason over, and Lyhnis runs agent workflows with human approval and a signed audit trail.
An open control plane for virtual Kubernetes tenants: a dedicated API server, CRDs and RBAC per tenant on clusters an organisation already runs, under Apache 2.0.
An Amsterdam AI infrastructure practice for regulated financial companies, building AI platforms against the EU AI Act, DORA, NIS2 and GDPR.
Boundary
All four are third-party organisations, described here in their own terms. None is a Qualimetrix product, none is part of the Continuum suite, and a partnership is not a certification of either party.
Programme membership
Qualimetrix BV is part of the OVHcloud Startup Program.
The programme provides participating startups and scaleups with cloud credits and one-on-one engineering time on OVHcloud’s European infrastructure.
Boundary
Membership is a commercial arrangement with OVHcloud. It is not an audit, a certification or an endorsement of Continuum, and it carries no claim about where a given deployment is hosted.
