DeployQuantum

We ran it on ourselves

AssessQu scanned the public TLS edge of deployquantum.com and www.deployquantum.com, our own site, classified the cryptography, scored quantum risk and crypto-agility, mapped the DORA RTS controls, and sealed the result into a tamper-evident evidence pack anchored to an independent time authority. Everything below is read live from that sealed pack.

If we sell sealed evidence, we should be able to seal our own. Verify us before you trust us with yours.

This is the first record of our own chain. The migration work it implies is ours to do, and the next records will show it.

Externally observed public TLS only. Point-in-time snapshot, sealed 2026-06-17T04:18:38Z. Evidence pack seq #1.

JavaScript is off, so this page shows the sealed headline values baked in at build time: 6 cryptographic assets, all 6 quantum-vulnerable (100%), crypto-agility score 0%. The TLS protocol versions are recorded as informational context, not counted as cryptographic primitives. DORA controls: AQ-C-01 PASS, AQ-C-02 PASS, AQ-C-03 PASS, AQ-C-04 N/A. content_hash ad5764da059ad3ac789a623978c6b31abac6cdc2f04171f7190d4dd19de4d1b1, anchored by RFC 3161 TSA freetsa.org at 2026-06-17T04:18:39+00:00. The check that matters is offline: download pack.json and verify.py and run python3 verify.py pack.json.

What the scan found

6crypto assets

6quantum-vulnerable

0already post-quantum

0%crypto-agility score

2harvest-now exposed

2certs expiring 90d

Both hostnames terminate TLS 1.3 with ECDSA P-256 certificates and elliptic-curve key agreement. That is a well-configured modern edge, and most of the discovered assets still depend on elliptic-curve cryptography, which a cryptographically relevant quantum computer breaks. Modern is not the same as quantum-safe. That gap is what AssessQu measures. Both certificates are short-lived managed certificates, so expiry inside 90 days is their normal rotation cycle.

DORA RTS control coverage

Mapped to Commission Delegated Regulation (EU) 2024/1774. The article mapping is AssessQu's interpretation and carries no legal opinion.

Control	Requirement	Status
AQ-C-01 (Art. 6 / 6(2))	Cryptographic inventory and encryption policy basis	PASS
AQ-C-02 (Art. 7(4))	Register of certificates and certificate lifecycle	PASS
AQ-C-03 (Art. 6(4))	Crypto-agility: ability to update/replace algorithms	PASS
AQ-C-04 (Art. 6(5))	Reasoned explanation where algorithms cannot yet be updated	N/A

The seal

Content hash

ad5764da059ad3ac789a623978c6b31abac6cdc2f04171f7190d4dd19de4d1b1

Entry hash

cfbcf093f34bdf17b0101d41ad4372f76f92fa5656211f0852de2921b57072b8

External anchor

RFC 3161 TSA https://freetsa.org/tsr, existence asserted at 2026-06-17T04:18:39+00:00

Tamper check

Pass intact, fail on any change

The hash chain proves the pack was not altered after sealing. The RFC 3161 anchor is an independent third party asserting the content existed at the stated time. Neither needs DeployQuantum to re-check.

Verify it yourself, offline

Download the pack and the standalone verifier. The verifier is Python standard library only: no network, no vendor service, no AssessQu code. It recomputes the hashes and confirms the pack is intact. Change one byte and it reports FAIL. This is the exact output for the pack published on this page:

python3 verify.py
content_hash recomputed match: True
entry_hash recomputed match:   True
time anchor (issuer-verified time): VERIFIED - TSA https://freetsa.org/tsr; embedded imprint matches content_hash; genTime 2026-06-17T04:18:39+00:00 matches the pack
  TSA issuer chain:              VERIFIED - signed by FreeTSA, chains to the pinned root (signer key NIST P-384, SHA-512; root RSA-SHA512)
key signature:                 signature: not present
KAT replay (NIST ACVP):        REPLAYED - 6 ACVP vector(s) re-checked; all digests match
  ML-KEM-768 encaps (ACVP tcId 26): digest match; seal-time live_pass=True
  ML-KEM-768 decaps (ACVP tcId 86): digest match; seal-time live_pass=True
  ML-DSA-65 verify_valid (ACVP tcId 139): digest match; seal-time live_pass=True
  ML-DSA-65 verify_invalid (ACVP tcId 136): digest match; seal-time live_pass=True
  SLH-DSA-SHA2-128s verify_valid (ACVP tcId 258): digest match; seal-time live_pass=True
  SLH-DSA-SHA2-128s verify_invalid (ACVP tcId 253): digest match; seal-time live_pass=True
note: this verifier checks integrity + the anchored time imprint + the FreeTSA issuer chain (pinned root) + (when present) the key signature and KAT replay. It does not bind the timestamp or signing key to a named legal identity.
RESULT: PASS, pack intact
note: this verifier attests integrity + anchored time (and, when shown above, FreeTSA issuer trust); it does NOT attest that the control-to-DORA-article mapping in this pack is legally correct or regulator-accepted (DeployQuantum documented interpretation, counsel sign-off pending).

Download the evidence pack (pack.json) Download the verifier (verify.py) See the platform that produced this

Honest boundaries

This is the externally observed public TLS edge of our own two public hostnames, not an internal estate scan.
It is a point-in-time snapshot of what was reachable, and what was negotiated, when the scan ran.
The key-agreement entries record what this handshake negotiated. An edge can offer additional groups, including post-quantum hybrids, to clients that request them.
The DORA RTS mapping is AssessQu's interpretation and carries no legal sign-off. It is not legal advice.
verify.py re-checks the hash seal offline. The RFC 3161 time anchor is additionally checkable using the timestamp token carried inside the pack.