What The Evidence Looks Like

Compliance teams do not buy cryptography, they buy evidence. This page shows the actual artifacts QNSQY produces: a risk-ranked crypto inventory, a migration preview, and the post-quantum after-state. Everything below is real, unedited tool output (only terminal colors stripped), generated against a synthetic demo vault so no customer data is involved.

The demo vault

A small directory built to look like the awkward corner of any real estate: two GPG-encrypted archives (a ledger and a patient export), an RSA-2048 server certificate and key, an ECDSA gateway certificate and key, a PKCS#12 backup bundle, an Ed25519 SSH keypair, and one file already migrated to QNSQY post-quantum encryption. All contents synthetic, generated for this demonstration.

Step 1 · Scan: qnsqy scan ./demo-vault -r

The scanner identifies cryptographic files by extension and magic bytes, and ranks each by quantum risk. This is the summary it printed:

Scanned: ./demo-vault
Total cryptographic files: 10

═══ RISK SUMMARY ═══

CRITICAL: 5 files
HIGH:     2 files
MEDIUM:   2 files
LOW:      0 files
SAFE:     1 files

═══ CRITICAL RISK FILES (Quantum Vulnerable) ═══

./demo-vault/archives/patient-export-2019.csv.gpg
   Type: GPG Encrypted
   Algorithms: RSA-2048, AES-256
   → RSA-2048: Replace with ML-KEM-768/1024 for encryption or ML-DSA-65/87 for signatures

./demo-vault/certs/backup-identity.p12
   Type: PKCS#12 Keystore
   Algorithms: RSA-2048, 3DES
   → RSA-2048: Replace with ML-KEM-768/1024 for encryption or ML-DSA-65/87 for signatures
   → 3DES: Replace with AES-256 or ChaCha20-Poly1305

(3 more critical files, 2 high, 2 medium: full artifacts below)

The full artifacts, exactly as the tool wrote them:

HTML report JSON (for SIEM / GRC ingestion) Plain text

Formats available: text, JSON, CSV, HTML, markdown. The HTML file is what most teams attach to their internal audit ticket.

Step 2 · Preview: qnsqy migrate ./demo-vault --dry-run

Migration never starts blind. The dry run lists exactly what would change, and the real run takes a --backup-dir so every original is preserved for rollback and audit:

DRY RUN - No files will be modified
Scanning for files to migrate...
  Directory: ./demo-vault

Found 7 files to migrate:
  Critical - ./demo-vault/archives/ledger-2021.txt.gpg
  Critical - ./demo-vault/archives/patient-export-2019.csv.gpg
  Critical - ./demo-vault/certs/api-gateway-ecdsa.key
  Critical - ./demo-vault/certs/backup-identity.p12
  Critical - ./demo-vault/certs/legacy-server-rsa2048.key
  High - ./demo-vault/ssh/id_ed25519
  High - ./demo-vault/ssh/id_ed25519.pub

Dry run complete. 7 files would be migrated.
Remove --dry-run to perform actual migration.

Step 3 · The after-state

One record in the vault was already migrated before the scan. This is how it appears in the same report, and how every migrated file appears on the rescan you attach as your after-evidence:

./demo-vault/records/patient-export-2019.csv.qs
   Type: QNSQY (Post-Quantum)
   Risk: Safe · Post-quantum safe
   Algorithms: ML-KEM-768

Before-report, migration log, after-report: that is the evidence pack. Scan output is designed as input for your internal audit process, and pairs with QNSQY's hash-chained audit log (Pro and Business) for operation-level records.

Honest scope, so nobody has to ask: this sample was produced on synthetic files, and the scanner identifies crypto by extension and magic bytes, so exotic formats can be missed; that is why services engagements start with a scoped inventory. A report like this is evidence your own auditor evaluates. It is not a certification, and QNSQY itself is not FIPS 140-3 validated or SOC 2 certified today: the full status board is at /certifications.

Get this for your own data

Download QNSQY and run qnsqy scan on any directory, or start with the scoped readiness assessment if you want the inventory, roadmap, and evidence produced for you. Pricing for both is on the pricing page.