Methodology

Last updated November 1, 2026

Every QuantumWhitelist score is a dated observation or documentation review, linked to its evidence. This page explains how scores are made, what they mean, how we stay independent, and how to challenge a score.

The three tiers

Tier 2 listings also show how the feature is enabled: On by default, Partly on by default, or Opt-in. Opt-in features are scored for capability, but protect only customers who turn them on.

Two kinds of evidence

Documentation review

For infrastructure vendors such as clouds, CDNs, network equipment and libraries, we score from the vendor's own public documentation. Every listing links to its source. A second reviewer checks each claim against the cited page before it is published.

Live connection test

For SaaS applications, we open the public sign-in page in a current browser, without signing in, and record the key exchange the browser actually negotiated. Each listing shows the exact address tested and the date and time. Each listing links to its evidence: a screenshot of the browser's Security panel, or the server's connection trace with the tester's IP address removed.

1. Open the sign-in page in a current version of Chrome or Edge.
2. Press F12 and open the Security tab (in Edge, add it with the + button).
3. Reload the page and read the Connection line, for example "TLS 1.3, X25519MLKEM768, AES_128_GCM".
4. A key exchange containing MLKEM is post-quantum (Tier 2). X25519, P-256 or P-384 alone is classical (Tier 1).

Automated weekly scan

Every week, an automated scanner using OpenSSL 3.5 connects to each listed address from servers in the United States and records the key exchange the server chooses. Each run first checks a control address known to support post-quantum; if the control fails, the whole run is discarded. Browser tests and scanner results are compared, and any disagreement is re-tested before a score changes.

Control test. Before recording any classical result, we confirm the same browser negotiates X25519MLKEM768 with a known post-quantum site. A Tier 1 result therefore reflects the vendor's server, not the browser. Anyone can repeat these tests in about a minute.

What a Tier 1 score means

A Tier 1 score means only that the tested connection used classical key exchange. Classical methods such as X25519 and P-384 remain secure against today's computers. A Tier 1 score is not a vulnerability, a breach or a judgment of a vendor's overall security. It flags exposure to future decryption of traffic recorded today.

How vendors are chosen

We cover widely used vendors that enterprise buyers are likely to rely on, and add more with each edition. The directory is not a random sample, so its results describe the vendors listed, not whole markets.

Limitations

• Addresses tested. Each listing shows every address tested: sign-in, and where available API, app and marketing website. The score follows sign-in and API results, since those carry customer data. Other services and regions may differ.
• Point-in-time results. Results can vary by region, by connection type (QUIC or standard TLS), by client, or while a vendor is partway through a rollout. Tier 1 vendors are re-tested from a second network and browser before each edition.
• Key exchange only. We do not assess stored data, internal service traffic, signatures inside applications, or vendor roadmaps.
• Documentation can lag. A vendor may support more, or less, than its public pages describe.

Independence and sponsorship

QuantumWhitelist may sell category and report sponsorships. Sponsors have no influence over any score, test or finding. Sponsored placements are clearly labeled, and a sponsor's own listing is scored by the same method as every other vendor.

Corrections

Anyone can request a correction from the link on any listing, or by email to carmstrong@quantumwhitelist.com.

• Response time: within 5 business days.
• Evidence we accept: public vendor documentation, a reproducible connection test, or a statement from the vendor's security team.
• Re-tests: we re-test any live result on request.
• Transparency: every confirmed change is published with its date in the change log below.

Use of AI

Research, drafting and fact-checking are assisted by AI tools. Every live result is observed and recorded by a person, and every score is approved by a person before publication.

Change log

Contact