The control plane is a blind relay. We never hold the keys. CNSA 2.0 tunnels that only you can configure.
Engineered in Canada · Deployed at the edge
Xeon Silver hardware. Same physical link. Same test methodology. QNyx delivers significantly higher encrypted throughput than current WireGuard-Go.
The API is a pure store-and-forward message board. It only ever sees encrypted blobs. Your ML-DSA-87 private key that signs configurations never leaves your control app.
ML-KEM-1024 for key establishment, ML-DSA-87 for identity, AES-256-GCM on every payload. Same suite as the data plane.
The relay has no visibility into configs. It cannot push a configuration and cannot alter one in transit.
Messages between instances and the control app are held for 24 hours, then permanently deleted.
Asynchronous by design. Your control app and your instances talk through the relay like a message board.
Create an account and receive free QNyx seats for the beta. No credit card required.
Deploy the QNyx instance binary on your Linux hosts (or Android). Generate identity keys locally.
In the control app, define desired state. It is signed with your private key and posted as an encrypted blob.
Instances asynchronously fetch, verify the signature, and apply the configuration. Tunnel is live.
The same post-quantum suite protects both the data plane and the control plane.
Post-quantum key encapsulation for shared session material.
Digital signatures that bind identity and sign every configuration.
Protects handshake messages, data-plane traffic, and control payloads.
Join the QNyx beta and receive free seats to run managed, post-quantum tunnels. Limited windows. No credit card required.
No. The control plane is a blind relay. It only stores and forwards encrypted blobs. Configurations are signed by your ML-DSA-87 private key, which never leaves your control application.
Upon first connection with QCore controller, a QNyx instance becomes unable to accept configurations signed by any other key than that of the QCore controller that first connected with it. This is enforced though ML-DSA-87 identity checks.
Only on your side — in the control app (and on the instances for their own identity keys). Xaoc never holds, sees, or can reconstruct them.
Opaque encrypted messages. Nothing more. The same CNSA 2.0 suite used for transport also protects every control-plane message.
24 hours. After that they are permanently deleted from the relay.
On the same Xeon Silver hardware and physical link, QNyx measured 5.17 Gbps encrypted while WireGuard-Go measured 3.94 Gbps. Raw link capacity was approximately 9.06 Gbps.
Yes. The QNyx data plane remains a compact userspace binary using the host’s standard TUN interface. No custom kernel modules required.