NIST FIPS 203/204 · ML-KEM-768 · ML-DSA-65
Host with proof.Scan. Fix. Attest.
Two products on one platform. PQC Host deploys any GitHub repo with ML-DSA-65 attestations and Bastion pre-deploy scanning. KXCO Bastion scans any stack for quantum-vulnerable cryptography and hands you the fix.
No credit card · No agents · ML-DSA-65 on every deploy and attestation
JackKXCO/my-saas-app · main · Next.js
pqc.kxco.ai/sites/3f8a2c1d… →
api.yourservice.com · package.json
Apply PQC fix → ML-DSA-65 certificate issued
Every hosting platform can't prove what it deployed. Every crypto scanner stops at the report. RSA-2048 and ECDSA — the algorithms underneath every existing cloud host, CDN, and npm crypto library — will be broken by Shor's algorithm within this decade. KXCO Cloud is the only platform that signs every deployment with ML-DSA-65 and scans your stack for quantum-vulnerable cryptography before every build.
PQC Host
Other platforms give you hosting.
We give you proof.
Connect your GitHub repo
Paste any public or private GitHub URL. Framework auto-detected in under 3 seconds — Next.js, React, Vue, Svelte, static, Node.js all supported.
Bastion scans before we build
Before a single line compiles, Bastion checks your package.json for quantum-vulnerable dependencies. Critical findings block the deploy.
ML-DSA-65 attestation issued
The moment your build completes, the platform signs a deployment manifest: commit SHA, build timestamp, Bastion result, and live URL. Verifiable forever.
KXCO Bastion
Enterprise scanners need infrastructure teams.
You need a URL.
Enterprise crypto scanners require SPAN port access and Linux LD_PRELOAD agents before you see your first result. KXCO Bastion requires a URL, a package.json, or a code snippet — and returns an ML-DSA-65 attested report in under 10 seconds. Full comparison →
Submit any target
10 scan types — no setup for any of them. URL/TLS, package.json (npm), requirements.txt (Python), go.mod, Gemfile, Cargo.toml, pom.xml, nginx/OpenSSL config, Dockerfile, Terraform HCL, GitHub Actions YAML, Kubernetes manifests. Auto-detected.
Receive your ML-DSA-65 attested report
Risk score (0–100), per-finding severity, blast radius estimate, and the exact KXCO package command for every fix. Every report is ML-DSA-65 signed and exports as a CycloneDX 1.6 CBOM.
Apply the PQC fix
One click generates before/after code and npm commands for every finding. Confirming produces an ML-DSA-65 certificate of remediation — independently verifiable forever.
Security architecture
The only platform built on NIST post-quantum standards from day one.
New · Optimize for AI
AI crawlers are reading your competitor's site and ignoring yours.
Most sites accidentally block the crawlers that feed AI answer engines. We fix the technical foundation — robots.txt configuration, llms.txt, JSON-LD schema, and citation monitoring. From $500.
Pricing
Both products. One plan.
Every tier includes PQC Host and KXCO Bastion. No weaker tier. No attestation fees.
Free
$0
no card needed
Try both products.
Starter
$12
/month
For individuals.
Pro
$49
/month · best value
For teams.
Enterprise
Custom
volume pricing
Regulated industries.
Prices in USD. Contact us for volume pricing.
FAQ
Common questions.
What does the ML-DSA-65 deployment attestation prove?+
It proves that a specific git commit, from a specific repo, was deployed to a specific URL at a specific time — and that the deployment wasn't tampered with afterwards. Verifiable by anyone using kxco-verify, with no account and no connection to KXCO required.
Does Bastion block my deploy if it finds vulnerabilities?+
Only for Critical severity. High and Medium findings appear in the attestation report but don't block the build. You can also disable the scan.
What hosting frameworks are supported?+
Next.js, React (Vite / CRA), Vue, Svelte, static HTML/CSS/JS, and Node.js Express/Fastify. Framework is auto-detected from package.json in under 3 seconds.
What does Bastion scan?+
URLs (TLS version + certificate algorithm), package.json (12+ quantum-vulnerable npm packages including node-rsa, elliptic, jsonwebtoken), environment variables (PEM-encoded RSA/EC keys), and code snippets (RSA keygen, ECDH, SHA-1 signing, AES-128, RS256 JWTs).
What happens to my attestations if KXCO stops operating?+
They remain verifiable forever. The verification is mathematical — it depends only on the ML-DSA-65 signature and the platform public key published at /.well-known/kxco-pq-pubkey.
Can I use Bastion without PQC Host?+
Yes. Bastion is available as a standalone product. Run probes against any URL, package.json, or code snippet from the dashboard — no site deployment required.
Still have questions? Talk to us →
Deploy with proof.Scan and fix. Ship faster.
PQC Host and KXCO Bastion on one platform, from day one. Start free, no card required.
No credit card · NIST FIPS 203/204 · Both products included free