Topology
Managed service.
Qualimetrix operates the control plane. Production records stay behind the customer boundary: the Counterpart Engine runs as a job inside the customer cluster, and only counterparts and evidence leave it.
Platform
Kubernetes-Native, Deployable Module by Module.
Continuum is one policy surface over separate microservices. A single module can be adopted without the rest of the suite, and no module leaves the data boundary it was placed in.
Deployment model
Where the data sits decides where the suite runs.
Production recordsNever leave the customer cluster
Key custodyCustomer KMS; Qualimetrix holds no key material
Operated byQualimetrix, within a documented support boundary
Topology
Private cloud.
The suite is installed in the customer cloud account through Helm charts. Qualimetrix supplies signed images, upgrade paths and policy bundles; the customer platform team owns the namespaces.
Production recordsInside the customer account and region
Key custodyCustomer KMS or HSM via PKCS#11
Operated byCustomer platform team, with Qualimetrix on call
Topology
On-premises.
An air-gapped installation for environments that cannot reach a public network. Images and policy bundles transfer as signed artefacts, and the release record is produced locally.
Production recordsInside the customer data centre
Key custodyCustomer HSM, with no external key exchange
Operated byCustomer team, with quarterly review sessions
On the wire
Post-quantum costs bytes.
Fixed sizes from the standards
ML-KEM-768 public key1 184 B
ML-KEM-768 ciphertext1 088 B
ML-DSA-65 signature3 309 B
SLH-DSA-128s signature7 856 B
Performance envelopeIllustrative
Added handshake time vs classical TLS 1.3+1.8 ms
Throughput per gateway node, hybrid mode8.2 Gb/s
Counterpart generation, relational schema40 M rows/h
Downstream model delta vs production1.8 pp
Boundary
The sizes on the left follow from the published standards. The figures on the right are illustrative and are replaced by measurements taken in your own environment; they are not a performance guarantee.
Current scope
What is contractable today, and what is not.
Capability
State
Boundary
Relational and tabular counterpartsShipping
Longitudinal, event and telemetry data remain design-partner only
Hybrid PQC transport, ML-KEM-768 and ML-DSA-65In build
Available to design partners; no CMVP or CAVP validation is claimed
Long-lived artefact signing, SLH-DSA-128sIn progress
Not yet available in a supported release
Policy orchestration and approval gatesIn build
Decision log is complete; retention automation is partial
Source, key and delivery adaptersPilot
Relational sources first; message-bus adapters are pilot scope
Information security management systemIn preparation
ISO/IEC 27001 certification is not yet held
Boundary
Statuses refer to implementation inside Continuum modules, not to certification. No CMVP or CAVP validation is claimed, and ISO/IEC 27001 is in preparation.
Control mapping
Which module touches which article.
Control
Module
Reference
Data minimisation in non-production environmentsCounterpart EngineGDPR Art. 5(1)(c) · 25
Security of processing, encryption in transitPQC GatewayGDPR Art. 32
Records of processing activitiesPolicy OrchestrationGDPR Art. 30
De-identification of protected health informationCounterpart EngineHIPAA §164.514
Transmission securityPQC GatewayHIPAA §164.312(e)(1)
Audit controls over releasesPolicy OrchestrationHIPAA §164.312(b)
Cryptography and key management measuresPQC GatewayNIS2 Art. 21(2)(h)
Supply chain and access control measuresAdaptersNIS2 Art. 21(2)(d)
ICT risk management and protectionPolicy OrchestrationDORA Art. 9
Third-party and sub-processor boundariesAdaptersDORA Art. 28 · GDPR Art. 28
No mapped controls for this framework.
Boundary
References are indicative and support an assessment of your own. They are not legal advice and not a statement of compliance.
Engagement
Five steps before acceptance.
Scope
Workload, data boundary and the decision the evidence must support
Inventory
Algorithms, key custody and retention horizon per flow
Reduce
Counterparts replace production copies in non-production environments
Protect
Hybrid transport for the exchanges that remain
Dossier
Methods, results, limitations and residual risk in one record
Each step produces a written artefact. A step is not complete until the named owner has accepted the evidence attached to it.
