Procurement Pack
Everything your procurement, security, and legal teams need to evaluate QCOS. Request technical documentation or a custom briefing.
Technical Documentation
Documents for your evaluation process are provided on request; none are published yet. Email info@softquantus.com.
Executive Summary
One-page overview of QCOS value proposition for C-suite
Security Architecture
Security model, data flow, and the exact compliance position (see status table below)
Deployment Options
Cloud, self-hosted and air-gapped deployment patterns, scoped per engagement
Access Control & Audit Logging
Access control, audit logs, and export formats
Integration Checklist
Google SSO (SAML and SCIM on request), API, CI/CD, and observability integration requirements
Pricing & Licensing
Detailed pricing tiers, volume discounts, and licensing terms
Compliance & Certifications
SOC 2 Type II and ISO 27001: not started. No audit engaged and no report exists.
SOC 2 Type II
Valid until: —
No audit engaged and no report exists. We will not claim otherwise.
ISO 27001
Valid until: —
No certification held. Roadmap item; ask us for the current position.
GDPR
Valid until: —
EU-based (Estonia), hosted in West Europe, DPA available on request
Post-quantum licence tokens
Valid until: —
ML-DSA-65 (FIPS 204) via liboqs, used for QuantumLock licence tokens. No CAVP/ACVP algorithm certificate and no CMVP module validation — the implementation is standards-based, not validated.
No certification reports exist yet. Request access →
Security Features
Security controls and their current status
Data Protection
- Azure-managed encryption at rest
- TLS 1.2+ encryption in transit
- Hosted in West Europe (Azure); no region selection
Access Control
- Email/password and Google SSO sign-in
- SAML and SCIM: on request (roadmap)
Audit & Compliance
- Tamper-evident audit logs (90-day retention)
- Evidence bundles SEALED with a SHA-256 Merkle root (verified offline with softquantus-verify)
Infrastructure
- Azure-hosted (Microsoft holds the data-centre certifications, we do not)
- Single hosting region (West Europe)
- Independent penetration test: not yet commissioned
Deployment Options
Choose the deployment model that fits your requirements
QCOS Cloud
Fully managed SaaS platform
- Hosted and operated by SoftQuantus on Azure (West Europe)
- Availability target 99.9% (not a contractual SLA)
- Priority email support (Enterprise)
Best for: Teams wanting fastest time-to-value
Self-Hosted
Deploy in your own infrastructure
- Runs inside your own infrastructure
- You keep control of data and network policy
- Available on request, scoped per engagement
Best for: Organizations with strict data residency requirements
Air-Gapped (QuantumLock)
Offline licence enforcement for HPC and restricted networks
- Offline licence verification
- ML-DSA licence tokens (liboqs, not CAVP-validated)
- Bring-your-own-key custody via a PKCS#11 HSM adapter; no FIPS validation held
- Available on request, scoped per engagement
Best for: Organizations that need offline licence enforcement
Request Custom Procurement Brief
Get a tailored brief for your organization with specific compliance requirements, pricing, and technical architecture recommendations.
Ready to evaluate?
Request a technical deep-dive with our solutions team