Cryptographic posture, public and pinnable.
Every primitive in active use is published by NIST. There are no proprietary algorithms anywhere in the platform — a deliberate choice that compresses the certification path. Our issuer public key is published here for offline signature verification.
Algorithms in production today.
Verify any signed report without contacting us.
Every report SkyeConnex produces is dual-signed with HMAC-SHA-256 and ML-DSA-87 (FIPS 204). The ML-DSA-87 verification key is published here for pinning. Once pinned, you can verify any signed report entirely offline against the published key — using Python pqcrypto, Open Quantum Safe liboqs, AWS-LC, or any FIPS 204 verifier.
Fingerprint shown for illustration. Production keys are rotated and published live at app.skyeconnex.com/security with both fingerprint and raw base64 key. A machine-readable JSON variant at /api/security/posture returns the same data for automated procurement scans.
Where we are on every standard buyers ask about.
Ready
Every primitive in active use is NIST-published. ML-KEM-1024 and ML-DSA-87 in production. Cryptographic boundary candidates identified. Test suite already produces KAT-style round-trip evidence.
- CC EAL2-3
Plausible
Platform module is well-scoped for protection-profile selection.
- SOC 2 II
Evidence in place
Full audit-log and access-control infrastructure is in place. Evidence-collection plumbing exists.
- ISO 27001/27018
Instrumented
Encryption at rest and in transit, key management, and access logging all instrumented.
Architecture fit IL2–IL5
Geo-fencing supports US-only deployment regions. Continuous monitoring (provider heartbeats) running in production.
Reference implementation
SCC Technical Committee on Data Sovereignty engaged. Gap analysis: zero Critical, zero Material indicators outstanding at the Sovereign / Defence tier.
Found something? Tell us.
We take security disclosures seriously. Email [email protected] with details. We aim to acknowledge within one business day and remediate critical issues within 30 days.
Frequently asked questions
Which cryptographic primitives are in active use?
AES-256-GCM (FIPS 197 + SP 800-38D) for frame encryption. AES Key Wrap (SP 800-38F / RFC 3394) for DEK wrapping. ML-KEM-1024 (FIPS 203) for hybrid post-quantum key wrap on Sovereign tier. ML-DSA-87 (FIPS 204) for post-quantum signatures. HMAC-SHA-256 (FIPS 198-1) for legacy report verify. SHA-256 (FIPS 180-4) for integrity and provenance. HKDF-SHA-256 (SP 800-56C Rev 2) for hybrid combiner. scrypt (RFC 7914) for password-derived KEK. TLS 1.3 (SP 800-52 Rev 2) for transport. No proprietary algorithms.
Can I verify a signed report offline?
Yes. The issuer's ML-DSA-87 public key is published at /security as a SHA-256 fingerprint (for pinning) and as raw base64 (for direct use). Pin the fingerprint, then run any FIPS 204 verifier — Python pqcrypto, Open Quantum Safe liboqs, AWS-LC — to verify any signed report envelope without contacting the platform.
Is SkyeConnex FIPS 140-3 certified?
FIPS 140-3 module certification is in progress. Every primitive in active use is NIST-published; the test suite already produces KAT-style round-trip evidence; cryptographic boundary candidates are identified. The certification path is compressed because the platform uses no proprietary algorithms.
How are keys rotated?
The User Master Key (UMK) is versioned; the gateway tracks UMK versions on every write. Re-wraps are auditable and reversible. Tier changes are recovery-neutral by construction: both wrapped UMK variants (password and PQ-hybrid) are unwrap-attempted on every login, so moving between tiers never affects recoverability of previously encrypted files.
How do I report a security vulnerability?
Email [email protected] with details. We aim to acknowledge within one business day and remediate critical issues within 30 days.