How do I answer a customer's post-quantum questions?

Do customer connections to your service use post-quantum or hybrid key exchange?

Yes. Connections to api.example.com, app.example.com use hybrid post-quantum key exchange as of 1 Oct 2026.

As of 1 Oct 2026, customer connections to api.example.com, app.example.com negotiate X25519MLKEM768, a hybrid of X25519 and ML-KEM-768 (NIST FIPS 203). This is provided at our CDN, Cloudflare. Independent evidence: https://postquantum.report/tools/pqc-questionnaire-answers

Which post-quantum algorithms do you support today, and where?

X25519MLKEM768 for TLS key exchange on api.example.com, app.example.com, example.com, as of 1 Oct 2026.

Our TLS endpoints (api.example.com, app.example.com, example.com) negotiate X25519MLKEM768, a hybrid of classical X25519 and ML-KEM-768 (NIST FIPS 203). This is provided at our CDN, Cloudflare. Certificates and signatures are classical, which is expected today.

Do you support post-quantum cryptography?

Yes, for key exchange: every endpoint uses hybrid post-quantum key exchange. Our wider PQC plan has an owner and target dates.

Do you support PQ/T hybrid modes, and when will you move to PQC-only?

Yes. Connections to api.example.com, app.example.com, example.com use hybrid X25519MLKEM768 (X25519 with ML-KEM-768). Any move to PQC-only follows our dated PQC plan.

Hybrid key exchange combines classical X25519 with ML-KEM-768 (NIST FIPS 203), so the connection stays protected if either part is broken.

Which customer data flows still rely on traditional asymmetric cryptography?

Our public endpoints use hybrid post-quantum key exchange. Some traffic behind our edge and between services still uses classical key exchange.

Do third-party dependencies introduce cryptography, and have you assessed them?

Our CDN (Cloudflare) terminates TLS for public traffic. We have asked some of our main suppliers about their PQC plans.

How will key management and certificates change under PQC?

Our certificates use ECDSA P-256, which is expected today. Keys are managed in Cloud KMS.

Post-quantum certificates for public websites aren't generally available yet, so certificates stay classical for now.

Do you maintain a cryptographic inventory or CBOM?

Partly. We have an inventory of where our product uses cryptography, but it isn't complete yet.

Is any cryptography hardcoded, fixed or hardware-bound, and how is it updated?

Mostly not. We can change most algorithms through configuration or library updates, without rewriting code.

What data lifetime assumptions do you make?

Some customer data we handle must stay confidential for more than 10 years, so harvest-now, decrypt-later risk applies to it.

Who oversees your PQC transition, and is there a dated roadmap?

A named owner leads our PQC transition, and the roadmap has target dates.

Will you be PQC-ready before the end of 2030?

Our PQC plan has an owner and target dates. The changes on our fix list are due by 30 Mar 2027.

How is software or firmware authenticity verified, and can it move to PQC signatures?

Our software and updates are signed with classical signatures. A move to post-quantum signatures isn't planned yet.

Which PQC standards and guidance do you track?

Our post-quantum key exchange uses ML-KEM from NIST FIPS 203, in the hybrid TLS group X25519MLKEM768 (RFC 10024).

The other standards that apply are NIST FIPS 204 (ML-DSA) and FIPS 205 (SLH-DSA) for signatures, and ASD's questions for vendors.