Documents and Access Levels
What we publish, what customers read after signing in, and what only approved organizations receive. Every customer and restricted copy names its reader, and every opening is logged.
Four levels
1. Public
This website: what QNSQY does, the three editions and their limits, prices, the test evidence on the Validation page, the release notes, the downloads and how to check them, and our security contact.
2. Customer
For every signed-in account on Pro or Business, personal or through its organization. Open them in your dashboard under Documents.
- Standard edition: deployment and administration guide
- Test evidence: original wording of the edited files
3. Restricted
For organizations we approve for the Approved Mode or CNSA 2.0 edition, under contract. Each person needs two-factor sign-in and enters a code every time they open a document. Openings also appear in the organization's own audit log.
- CNSA 2.0 edition: offline licence, activation and hardening
- Approved Mode edition: Security Policy (draft), on request
- Approved Mode and CNSA 2.0 editions: operator guide, on request
4. Company only
Source code, internal build and test records, signing keys and customer records stay with us. Customers and auditors can ask for source access under a non-disclosure agreement.
How access works
- One sign-in for everything. There are no separate logins per edition: your plan, your organization and our approval decide what you can open.
- Our billing server checks every request. The documents are not files on this website, so they cannot be reached by guessing a link.
- Each copy you open starts with your email address, your organization, the time and a copy number. We record a fingerprint (SHA-256) of that exact copy, so a copy found elsewhere can be traced to the account that opened it.
- We record who opened which document and when. We do not store your IP address for openings.
- You can read a document in the dashboard or save it as a Markdown file.
The rules we follow
How we decide what goes on this website follows these public rules. They describe how we handle information; they are not certifications.
- NIST SP 800-53 Rev. 5, control AC-22 (publicly accessible content): only designated people publish, they are trained to keep nonpublic information out, content is reviewed before it is posted, and the public site is reviewed regularly, with any nonpublic information removed.
- NIST SP 800-171 Rev. 3, requirement 03.01.22, and FAR 52.204-21, which asks federal contractors to control the information they post on publicly accessible systems.
- RFC 9116: our security.txt tells researchers how to reach us.