Cryptographic
execution provenance
for regulated quantum
workloads.
Produce a signed, verifiable record of every quantum circuit your teams execute — with the audit content, retention, and non-repudiation your regulators already require for classical computation. Vendor-neutral across IBM Quantum, IonQ, and air-gapped hardware. Built on published NIST and NSA standards.
mapped & documented
default configuration
configurable tier
in sovereign mode
one ledger of record
attestation ready
Quantum computation is now in scope for the controls
your auditor already enforces.
Regulated enterprises are beginning to run material workloads on cloud-hosted quantum processors. The controls around those workloads — audit trail, non-repudiation, electronic records integrity — look more like best-effort observability than the evidence compliance teams already require for safety-critical classical systems. The requirements exist. The capabilities do not.
The absence of enforcement action to date is not an exemption. The underlying requirements apply to any electronic record that informs a regulated decision.
NIST SP 800-53 — Audit & Accountability
Your ATO boundary requires comprehensive, tamper-protected, time-correlated audit records with non-repudiation (AU-2, AU-3, AU-8, AU-9, AU-10, AU-11, AU-12). Cloud quantum providers emit account-level API logs — not experiment-level records you can attribute to a named individual and prove have not been modified.
21 CFR Part 11 — Electronic Records
FDA-regulated organizations must maintain secure, computer-generated, time-stamped audit trails that record creation, modification, and deletion of electronic records without obscuring previous versions (§11.10(e)). Today, quantum-derived results arrive as JSON payloads in customer buckets — no Part 11 trail over the full experiment lifecycle.
CNSA 2.0 — Post-Quantum Cryptography
New NSS acquisitions must be CNSA 2.0–compliant by January 1, 2027. That means ML-DSA-87 signatures, ML-KEM-1024 key establishment, SP 800-208 firmware signing. Most quantum tooling does not yet implement these at NSS parameter levels. Your classical systems are migrating. Your quantum systems are not.
Your Inspector General's next question
“Prove this quantum workload ran as approved, on validated hardware, in a known calibration state — and that the results you cite are the results it produced.” Most organizations cannot answer this with evidence today. They reconstruct. They assemble. They hope their spreadsheet holds up.
From researcher submission to auditor verification.
Nuqasm captures a cryptographically bound execution record at every stage of the quantum computation lifecycle — from the moment a researcher submits a workload to the moment an auditor verifies what ran. The record is signed, time-stamped, immutable, and complete. Your compliance team opens a dashboard. Your researcher keeps their existing workflow.
Researcher submits
Workload authored in Qiskit, PennyLane, or OpenQASM. Nuqasm captures the source, the submitter's signed approval, and the policy block declaring which environments are allowed.
Workload is sealed
Packaged into a signed .qcap archive using ML-DSA-87 (CNSA 2.0 default) or ML-DSA-65 for non-NSS configurations. Tamper-evident, verifiable offline without network.
Policy routes
The sealed capsule runs where policy allows — simulator, UQBench appliance, or cloud QPU. Never modified. Always verified before execution. One source of truth.
Provenance captured
Runtime records the full chain: transpiled circuit, compiler version, hardware backend, calibration snapshot at execution, shot-by-shot results. Every attribute bound to the capsule signature.
Auditor verifies
Every execution writes an append-only record. Your compliance team queries, filters, exports audit-ready reports. Your auditor receives verifiable evidence — not a spreadsheet.
Policy determines destination. Not a different source of truth.
Nuqasm separates the execution environment from the source of truth. Policy declares where a workload may run. The runtime enforces it. The audit record is identical regardless of environment. Your compliance team reviews one ledger, not three.
Simulator
For compliance and security teams assessing the control gap. No external data flow. Inherits host ATO.
Air-Gapped Appliance
Desk-side hardware with integrated QPU. Facility-local, no cloud dependency, SCIF-compatible.
Cloud Routing
Sealed workloads routed to approved QPU providers with Nuqasm-side capture of full execution record.
Procurement buys control satisfaction,
not features.
The table maps Nuqasm capabilities to the specific regulatory controls your compliance team is already responsible for. The full mapping — with evidence artifacts, control narratives, and auditor handoff documentation — is in the procurement packet.
For the compliance team that already owns these frameworks.
CNSA 2.0 programs
Sovereign deployment with managed air-gap, classified-network compatible, CNSA 2.0 default signatures.
Buyer: Program security officer · authorizing official · ISSM
Model risk & algorithmic trading
Managed cloud routing with federated audit. Execution provenance for model risk committee review.
Buyer: Head of model risk · CCO · operational risk lead
Part 11 electronic records
IQ/OQ/PQ validation package, Part 11–compliant audit trail, electronic signature attestation.
Buyer: Head of quality · validation lead · Part 11 SME
FISMA & DOE compliance
Audit records aligned to the lab's existing FISMA boundary. Execution provenance for DOE peer review.
Buyer: Cybersecurity program manager · designated approving authority
Anchored to the cost of the alternative.
No per-seat pricing for researchers. Price scales with environments, not people. Multi-year contracts available at discount for FedRAMP-authorized deployments. Pilot programs available for qualifying organizations, typically 90 days.
Self-serve to the document your team needs.
Compliance, security, and procurement teams work on different clocks with different evidence requirements. Each door below leads to the specific artifact or conversation that matches your role — without a forced sales call attached.
contact@nuqasm.com
engineering · not a shared inbox
Procurement packet
Full control mapping, SBOM, SOC 2 status, deployment architecture, pricing detail. Delivered as a PDF you can route to procurement, security, and legal simultaneously. No sales call attached.
Technical briefing
30-minute call with engineering covering architecture, cryptographic implementation, audit record schema, SIEM integration. No commercial conversation — technical verification only.
Pilot scoping
Commercial conversation with engineering lead and customer success. We map your regulatory context to our deployment options and size a 90-day pilot. Typically 45 minutes.