Sources
Code, dependencies, repositories, endpoints, certificates, cloud, protocols
Platform
One evidence architecture from cryptography discovery to release control.
RelixQ normalizes source and protocol evidence, maps HNDL exposure, preserves proof boundaries, and delivers the result to leadership, security operations, and engineering workflows.
Product architecture
Sources become evidence. Evidence becomes control.
Every scanner and workflow contributes to one normalized evidence chain rather than producing an isolated report.
Evidence
Normalized findings, assets, observations, provenance, confidence
Analysis
Classification, scoring, HNDL windows, attack paths, policy
Validation
Signed-RoE observations, PQC Lab results, safe proof boundaries
Control
Owners, exceptions, retests, reports, gates, audit history
Delivery
API, SARIF, SIEM, observability, tickets, incidents, chat
Normalized evidenceOrganization scopedHonest proof boundariesService claims verified separately
Coverage
31 languages, 13 configuration formats, 7 evidence input surfaces.
Evaluate source, configuration, dependency, TLS, cloud-key, cloud-TLS, and runtime coverage in one public matrix, with the readiness graph presented separately as correlation.
- Semantic and parser-backed analysis
- Specialist, legacy, and modern stacks
- Cloud and runtime correlation
Connected operations
Bring evidence in. Send action to the systems teams already use.
Connect source control, identity, cloud, and delivery workflows, then route posture to SIEM, observability, tickets, incidents, on-call, and chat.
- Source, identity, cloud, and CI connections
- Security and observability delivery
- Alerting, ticketing, and status sync
Interoperability
Standards-based evidence stays portable by design.
Use widely adopted security and observability formats so RelixQ evidence can move through existing governance and engineering systems.
- SARIF and OCSF findings
- CycloneDX CBOM and SBOM ingest
- SPDX, OpenTelemetry, API, and webhooks
Quantum exposure assessment
QAST turns inventory into a time-bound exposure model.
RelixQ classifies HNDL risk using data lifetime, harvestability, migration time, reachability, confidence, and explicit assumptions. Attack-path projection connects exposed entry points to the data assets that matter.
What the workflow carries
- HNDL register and exposure windows
- Mosca X + Y > Z assumptions
- Data assets and confidentiality horizons
- Quantum attack-path projection
- Observed versus modeled evidence boundaries
Leadership metric
RelixQ Score makes posture traceable instead of decorative.
The score is a 0–100 leadership signal backed by drivers, confidence, severity, exposure, trend, and next actions. Engineering can drill from the rollup into the findings and evidence responsible for movement.
What the workflow carries
- Traceable score drivers
- Project and portfolio posture
- Score deltas and readiness trend
- HNDL-critical exposure context
- Engineering and executive views
Discovery and inventory
Inventory code, dependencies, certificates, protocols, and assets together.
RelixQ normalizes cryptographic evidence across scanners so teams can investigate one consistent finding contract and generate a cryptographic bill of materials for migration planning.
What the workflow carries
- Source-code and configuration evidence
- Dependency, CycloneDX, and SPDX ingest
- TLS endpoint and certificate posture
- JWT, SAML, mTLS, and infrastructure coverage
- Asset inventory and CycloneDX CBOM export
Compatibility evidence
PQC Lab shows what a protocol actually negotiated.
Read-only observations expose negotiated groups, hybrid support, classical acceptance, downgrade labels, handshake duration, and message size. Honest empty states remain visible until evidence is connected.
What the workflow carries
- TLS and hybrid negotiation posture
- Classical acceptance and downgrade context
- Certificate and protocol evidence
- Read-only observations
- No application-payload mutation
Product surfaces
The same evidence stays visible from analysis to operations.
Consistent screenshot treatment makes the product story concrete while preserving the status and honesty labels buyers need.
Engineering
Priorities tied to evidence
RelixQ Score, HNDL-critical exposure, next actions, service context, and confidence in one working view.
QAST
A ranked HNDL register
Exposure windows, harvestability, reachability, and Mosca assumptions stay visible beside the result.
PQC Lab
Read-only protocol evidence
Inspect negotiated groups, hybrid support, classical acceptance, downgrade labels, and handshake details.
Operations
Evidence delivered to the operating stack
Route posture and findings to SIEM, observability, ticketing, incident, chat, and webhook destinations.
Operating controls
Govern, gate, report, and integrate.
Assessment value persists only when the same evidence drives decisions and developer behavior after the initial review.
Governance
Policies and exceptions keep every decision explainable.
Attach posture expectations, accepted risk, scope, owners, approvers, expiration, and audit history to the same project evidence.
- Policy evaluation
- TTL-bounded exceptions
- Named approvers
- Decision and audit history
- Retest and remediation state
CI and release gates
Stop new migration debt before merge.
CLI and pipeline controls support SARIF, committed baselines, base-versus-head comparison, score thresholds, HNDL conditions, exception state, and regression checks.
- Warn and block modes
- SARIF output
- Baseline-aware net-new findings
- Score and severity thresholds
- Verified-to-open regressions
Reports and integrations
Deliver evidence to leadership and the operating stack.
Generate executive and technical artifacts, then route findings and posture changes into SIEM, observability, ticketing, incident, on-call, chat, or webhook systems.
- Executive, technical, and remediation reports
- JSON, CSV, SARIF, Markdown, and PDF workflows
- SIEM and OCSF delivery
- Observability and metrics destinations
- Ticketing, incident, on-call, and chat routing
Technical evaluation
Start in the guide. Validate in a bounded pilot.
Use the Developer Guide to examine workflows and evidence boundaries, then scope the application portfolio and operating integration for an Enterprise evaluation.