Security & Data Residency
Last updated October 2026. How QuantumRand produces randomness, where your data is stored, who can reach it, and what we do and do not hold in the way of certifications.
1. How the randomness is produced
QuantumRand's core /generate API serves bits from a NIST SP 800-90A DRBG seeded with quantum measurements.
- The seed comes from measurements on real IBM Quantum hardware. It is refreshed daily and reported as stale after 48 hours without a fresh hardware seed.
- After a restart, until the first hardware seed arrives, the generator runs on a seed from the operating system's CSPRNG and responses are labelled
csprng-fallback. - The industry endpoints (
/security,/gaming,/health,/iot,/legal,/finance) default to a quantum-circuit simulator; passbackend=quantum_seededto use the IBM-seeded generator, oribm_hardwarefor a direct hardware run.
Each response is labelled with the source that produced it, and /health reports whether the current seed is fresh or stale. Statistical test results are published on the SP 800-22 results page.
QuantumRand provides randomness. It is not post-quantum cryptography and does not implement the NIST post-quantum standards.
2. Where data lives
- The API runs on Railway in the europe-west4 region (Netherlands).
- Account records, hashed API keys and usage logs are stored in Google Cloud Firestore (Firebase).
- Payments are handled by Stripe; we never see or store card numbers.
We do not store the random values we generate for you.
3. Access controls
- API keys are stored only as SHA-256 hashes; the raw key is shown once, when it is created.
- You can restrict each key to a list of allowed IP addresses.
- All traffic is served over HTTPS.
- Administrative endpoints require a separate secret that is never written to logs.
4. Audit logging
Each API call is logged with the key hash, endpoint, number of bits requested, latency and time. You can view your own logs in the dashboard. Usage logs are purged automatically after 90 days.
5. Compliance posture
QuantumRand holds no SOC 2, ISO 27001, PCI DSS or HIPAA certification, and no audit is underway. We do not sign Business Associate Agreements, so do not send protected health information to the API. The security testing done so far has been internal; no independent penetration test has been performed.
If your own audit needs information about how your randomness was produced, the per-response source label and your usage logs are the evidence we can provide.
6. Incident response
Report a vulnerability to security@qntyx.io (see also security.txt). If an incident affects your account or data, we will notify you by email without undue delay once we have confirmed it.