Pilot For regulated data that must stay confidential for decades
Continuum helps regulated organisations through the quantum transition. It finds the cryptography that protects long-lived records. It cuts sensitive copies with governed synthetic data. What must still travel goes over TLS with hybrid post-quantum key exchange. Every decision is approved and recorded in a tamper-evident audit log.
Each part below says what it does today and, in the same place, what it does not.
$ openssl s_client -brief \
-connect demo.gw.continum.host:443
CONNECTION ESTABLISHED
Protocol version: TLSv1.3
Ciphersuite: TLS_AES_256_GCM_SHA384
Verification: OK
Negotiated TLS1.3 group: X25519MLKEM768
$ openssl s_client -brief -groups X25519:prime256v1 \
-connect demo.gw.continum.host:443
ssl/tls alert handshake failure # refused, and recordeddemo zone. It requires hybrid key exchange: OpenSSL 3.5 is served, and a classical-only client is refused.Platform
The quantum transition touches what you store, what you share and what you send. Continuum handles them in that order. Control decides and records every step.
Know which cryptography protects what.
Import a crypto inventory as CSV, JSON or CycloneDX. Each asset gets a deterministic risk score, with the factors behind it. The ranking becomes migration actions with owners and due dates.
Limit A score ranks the work. It does not certify an asset as quantum-safe. The year a quantum computer could break today's keys is an assumption you set.
Share less.
Generate governed synthetic counterparts of relational data, so fewer production copies leave the systems that hold them. Integrity, utility and privacy gates decide each release. A second person approves it, and an evidence bundle goes with it.
Limit We do not claim synthetic output is anonymous or GDPR-compliant. Every release manifest lists both as unsupported claims.
Protect what still moves.
A TLS 1.3 gateway on NGINX and OpenSSL 3.5. It uses hybrid key exchange: X25519 or P-256, combined with ML-KEM-768. Zones either require it or prefer it. Mutual TLS is available where a zone needs it, and the gateway's key can stay in an HSM through PKCS#11.
Limit Not approved for production. Production zones stay blocked until the interoperability matrix and an independent review are complete.
Decide, and keep the record.
Tenants, deny-by-default roles and approvals with separation of duties. Policy gates block with reason codes, and a hash-chained audit log keeps the record. Evidence bundles are hash-verified and can be signed with Ed25519, the key kept in your HSM.
Limit The audit log is tamper-evident, not tamper-proof: an edit shows when the chain is verified. Anchoring the chain outside Continuum is still in build.
Gateway, live
These zones run on Continuum's own infrastructure as non-production zones. Each session they serve or refuse is written to the audit log, under the version and hash of the zone policy in force.
pq_required
Hybrid only. A client without ML-KEM is refused during the handshake, and the refusal is recorded.
pq_preferred
Hybrid first. A classical-only client is still served, and the session is recorded as a fallback.
pq_required
The Continuum dashboard. Its sign-in page opens only after the browser has agreed hybrid key exchange.
If your browser cannot open demo.gw.continum.host, it does not offer hybrid key exchange. The zone is doing its job; demo-preferred.gw.continum.host will still open.
Evidence
Each session is an audit event that names the zone policy it ran under: its version, and a hash of its exact content.
Each dataset release ships an evidence bundle. You can check it with sha256sum -c, and verify its Ed25519 signature against keys you choose to trust.
Who asked, who decided and why. Nobody approves their own request, and an emergency change needs the same approval as any other.
Every Continuum image is scanned at release, signed with Sigstore cosign, and carries a CycloneDX SBOM attestation. We deploy images by digest only.
Limits
Dashboard
app.continum.host is served only through a pq_required zone of the Continuum
Gateway. Your browser agrees X25519MLKEM768 before the sign-in page loads. The page shows
you what was negotiated, and your session goes into the audit log under the zone's
policy.
Sign in with your Continuum API key. You see what your role allows: zones and their approvals, gateway sessions, the audit chain, risk assessments and releases.
Open the dashboardTell us about the data you must keep confidential for decades, and where it travels. We will tell you what an assessment covers.