01
Key Escrow & Recovery
An organizational escrow keypair lets you recover data without the user's password, with every recovery written to the audit log. qnsqy escrow-keygen, qnsqy escrow-decrypt.
Enterprise & Teams
Roll QNSQY out across a team without giving up control. Organizations, roles, single sign-on, and a signed encryption policy your client enforces at runtime. The controls below ship today; anything still in development is labelled Roadmap.
Built for organizations, not just individuals
Everything QNSQY does for a single user, it now does for a team: post-quantum hybrid encryption, signatures, and the full Business feature set, governed centrally. An owner creates an organization, invites members, assigns roles, sets a signing-enforced encryption policy, and wires up SSO. The Rust client picks up that policy and applies it on the device, before any data is touched.
Honesty note. QNSQY is not SOC 2 audited and not FIPS 140-validated. It uses NIST-standardized algorithms (FIPS 203/204/205, SP 800-208) and is validated byte-for-byte against NIST ACVP test vectors, which is not the same as a certified module. Current certification status, and what is on the roadmap, lives on the Certifications page.
Organizations, members & roles Shipping
Create an organization with an owner and add members by email. Roles are owner, admin, and member, managed from both the org-admin portal and the internal admin dashboard. One organization per user is enforced. Adding a member whose email is not yet known provisions a brand-new account for them automatically, so you can stand up a team in a single pass.
Magic-link onboarding Shipping
New members do not receive a password in their inbox. They receive a single-use sign-in link that is valid for 72 hours. An organization and its owner can be provisioned together in one step, then each member is brought on through their own link.
- An admin creates the user (or the org plus its owner) in the portal.
- The account receives a single-use magic link by email. The password is never emailed.
- The member follows the link within 72 hours, sets up their own credentials, and lands in the organization with their assigned role.
Single sign-on: OIDC + SAML 2.0 Shipping
Connect your identity provider per organization over OpenID Connect or SAML 2.0, and configure and test it from the org-admin portal. For terminal and automation workflows, the CLI signs in with an RFC 8628 device-code flow: the CLI shows a short code, you approve it in a browser, and the session is bound to your organization, no copy-pasting long-lived secrets onto a server.
Three ways your people authenticate
Browser SSO (OIDC): standard OpenID Connect against your IdP.
Browser SSO (SAML 2.0): for IdPs standardized on SAML assertions.
CLI / headless (RFC 8628): device-code flow for terminal-first and SSH-only environments.
Signed, client-enforced encryption policy Shipping
An organization publishes an Ed25519-signed, versioned encryption policy. The Rust client fetches that policy and enforces it at runtime on the device. It merges the organization policy with any local policy and applies the stricter of the two, so a non-compliant operation is refused before any data is processed. Because the policy is signed and versioned, the client can verify it came from your organization and has not been tampered with in transit.
In practice this means you can mandate, for example, minimum algorithm strengths or required signing across the whole team and have the client, not a server you have to trust, hold the line at the point of use.
Per-organization audit log Shipping
Every change to members, roles, policy, and SSO configuration is recorded in a per-organization audit trail that owners and admins can review. This is the organization-level record of who changed what; it is distinct from the tamper-evident, hash-chained operational audit log that the client produces for cryptographic operations (see Security).
Recovery: escrow, threshold, and vault Shipping
QNSQY's zero-knowledge design means we cannot recover a forgotten password for you. For organizations that need continuity anyway, the Business tier ships recovery controls you operate yourself:
02
Threshold Recovery (Shamir M-of-N)
Split a secret into N shares and require any M to reconstruct it. Constant-time GF(28) arithmetic with a BLAKE3 MAC authenticating each share. Ideal for splitting recovery authority across trusted parties. See Shamir's Secret Sharing.
03
Encrypted Vault
A built-in AES-256-GCM secret store behind an Argon2id-derived master key, for the credentials and keys your team needs to keep but not expose. qnsqy vault (init, add, get, list, rekey, export, import).
04
Recipient Groups & Policy
Define named recipient groups and enforce organization-wide encryption baselines, so the right people can decrypt and the wrong configurations are refused. qnsqy group, qnsqy policy.
Where the controls live
Organization, identity, and policy controls map to concrete surfaces in the product. This is the same vocabulary you will see in the org-admin portal and the CLI.
| Capability | Where | Status |
|---|---|---|
| Organization & identity | ||
| Organizations, members, owner / admin / member roles | Org-admin portal + admin dashboard | Shipping |
| Magic-link onboarding (single-use, 72h) | Org-admin portal | Shipping |
| SSO via OpenID Connect | Org-admin portal | Shipping |
| SSO via SAML 2.0 | Org-admin portal | Shipping |
| RFC 8628 device-code login (CLI / headless) | CLI | Shipping |
| Policy & audit | ||
| Ed25519-signed, versioned encryption policy | Org-admin portal → Rust client | Shipping |
| Client-side runtime enforcement (stricter of org / local) | Rust client | Shipping |
| Per-organization audit log (member / role / policy / SSO) | Org-admin portal | Shipping |
| Recovery (Business tier) | ||
| Key escrow & recovery | CLI (escrow-keygen, escrow-decrypt) | Shipping |
| Threshold recovery (Shamir M-of-N) | CLI (split / combine) | Shipping |
| Encrypted vault | CLI (vault) | Shipping |
| Roadmap (v7.3) | ||
| HSM integration (YubiKey / TPM / CloudHSM key wrapping) | CLI / core | Roadmap |
| Air-gap license (offline license activation) | CLI | Roadmap |
On the roadmap Roadmap ยท v7.3
Two enterprise controls are in development and not yet shipping. We list them here so procurement teams can plan, and so nobody buys on a promise we are still building.
- HSM integration. Wrap the data-encryption key for hardware-secured storage, targeting YubiKey, TPM, and CloudHSM. Code exists in the core crate; it is not yet a shipped, supported feature. v7.3 roadmap.
- Air-gap license. Offline license activation for fully disconnected deployments, so a true air-gapped environment never needs to reach the billing endpoint. v7.3 roadmap.
Certifications, honestly
We do not claim certifications we do not hold. QNSQY is not SOC 2 audited and not FIPS 140-validated. It is built on NIST-standardized post-quantum algorithms and is replay-validated against NIST ACVP test vectors, which is a different and weaker claim than a validated cryptographic module. For the current state of each, and what we are pursuing next, see the Certifications page.
Bring QNSQY to your team
Org management, SSO, and signed policy are available now on the Business tier. Talk to us about seat counts, SSO setup, and a rollout plan, or compare what each tier includes.