Be one of our first three design partners

What the scan does

We scan only the hosts on your signed consent form, from EpochCore's scan server. A scan runs when someone signed in to your company's account starts one, or once a week for hosts in a weekly check someone in your account turned on. For each host and port:

• TLS (443, or any other port): up to four short connections. Three each send a TLS hello and hang up after the server's first reply, without setting up a session. They show which key exchange the server would pick, whether it accepts the post-quantum hybrid key exchange X25519MLKEM768 offered alone, and whether it accepts the CNSA 2.0 key exchanges SecP384r1MLKEM1024 or MLKEM1024 offered alone. The fourth completes a TLS handshake to read the certificate, then closes without sending a request.
• HTTPS (443): one more connection sends one plain request for the front page (/), reads the software and version the response headers announce, and closes: no other path, no redirect followed, nothing read beyond the headers. A version on CISA's Known Exploited Vulnerabilities list fails on every profile.
• SMTP, IMAP, POP3 and PostgreSQL (ports 25 and 587, 143, 110, 5432): the same connections, each after asking the server to switch to TLS.
• SSH (22): one connection. We exchange version lines, read the server's list of key exchanges and hang up before any key is exchanged.

One host and port at a time, one connection at a time. No login, and nothing read beyond those headers. Each connection attempt and each wait for a reply gives up after 5 seconds. A server that doesn't answer is recorded as unknown, never as safe. Hosts on the opt-out list are skipped.

What you get

• A signed report for each scan you choose to sign: a PDF, and the signed file behind it. It lists every check, how each one did against the rules you picked (Mid-market or CNSA 2.0), and your fix plan.
• A dated fix plan, inside the signed report: what to fix first, and by when. A host that couldn't be read is listed as unknown, never as safe.
• Two signatures on the signed file behind every report, one classical and one post-quantum, so your auditor can check it without us. Changing one word of that file breaks both. The PDF's own check covers the digest printed on page 1. To tie the PDF's text to that digest, your auditor checks the signed file.
• A weekly re-check, if you want it. It's off until you turn it on for a finished scan. Then every Tuesday we start a new scan of the same hosts, and email you only when a result changes.
• Storage, the GitHub app and the in-network collector come with the same account.

The report is evidence for an auditor, not a certification. It covers only the hosts it lists.

What you sign

One page: the scan consent. It says:

• Which hosts we may scan. You list each host name. Approval is per host name, so it covers every port on that host.
• Who signs for your company: someone who can approve scans of those hosts, with their name and title.
• That you can withdraw any host, any time. Tell us which one. When we get your message we take it off your list, and from then on the app won't scan it: a scan waiting to run doesn't run, a scan already running skips it, and a weekly check that includes it stops. We keep a record of every approval and every withdrawal.

Open the consent form

Print it, fill it in, sign it, and send a scan or photo of the signed page to [return address not set yet]. We set up your account from it, invite the people you name, and add your hosts.

Never scan my host

Anyone who runs a host can ask us never to scan it, partner or not. Send the host name to [return address not set yet]. We add it to our opt-out list.

Every scan from our scan server skips the hosts on that list, and the app shows a skipped host as “not scanned: it's on the opt-out list”. If the scan server can't read the list, it scans nothing. Each name is matched exactly, so send every name you want skipped: example.com and www.example.com are two names.

How to check a report

Every signed PDF ends with the commands and the files your auditor needs to check both signatures without us. The signatures show the report wasn't changed. To show the keys are EpochCore's, work out each key id yourself from the key file the check used (the first 16 characters, in capitals, of the SHA-256 of the raw public key) and compare it with the ids EpochCore publishes at epochcoreqcs.com/qshield-keys. Don't rely on the ids printed in the report itself.

The classical signature (Ed25519) checks with OpenSSL 3.0 or newer. The post-quantum signature (ML-DSA-87) needs OpenSSL 3.5 or newer. The openssl that comes with macOS can't check it; Docker works on any system.

Three free places

1. Read the consent form.
2. Sign it and send it to [return address not set yet].
3. We invite the people you name. They sign in with a code we email them, and run your first scan.

Free, in exchange for a reference. After the program: $2,500 for a one-time report of up to 25 hosts, and $300 to $500 a month for the weekly re-check.