Find the cryptography your migration depends on

Who this is for

SaaS companies and SMEs that need a defensible starting point for post-quantum planning but do not yet have a reliable cryptographic inventory.

The question this answers

Where is cryptography used, and what evidence is missing?

What we need to begin

• A named system owner and written authorization for the agreed scope
• Available architecture, dependency, certificate, and vendor information
• Access to approved exports or repositories without sharing production secrets
• A short list of business-critical systems and long-lived data

What we inspect

• Scanner: supported source API usage and recognized local dependency declarations.
• Separate supplied evidence: certificates, protocol settings, configuration, and runtime observations when available.
• Separate supplied evidence: cloud, identity, PKI, network, and managed-service dependencies.
• Human review: owners, vendor questions, upgrade constraints, and unresolved dependencies.
• Coverage and confidence: record what was analyzed, skipped, or remains unverified.

What you receive

• A scoped cryptographic inventory with source and confidence labels
• An exposure map linking cryptographic use to systems and owners
• A list of evidence gaps, vendor questions, and follow-up actions
• A prioritized handoff into the readiness assessment

Important limitations

• The v0.2.0 scanner analyzes supported source files and recognized local dependency declarations only. It does not scan certificates, runtime, networks, configuration, or cloud environments.
• This is not penetration testing, certification, an SBOM, or a CBOM.
• A point-in-time inventory is limited by the evidence supplied and cannot prove every cryptographic dependency has been found.