XiliuxQuipu
Post-quantum cryptography for data at rest. Free software under AGPL-3.0, with a commercial licence for those who need one.
What exactly is being charged for
Quipu is free and always will be. You can use it today without paying us anything. The only condition is publishing the source of whatever you build on top of it. If that does not work for you, we sell you an exemption from that obligation.
Put another way: we do not charge for use, we charge for the right not to publish. Copyleft does not forbid charging — the licence says in so many words that you may charge any price or none. What it restricts is secrecy, not price.
If you can comply with the copyleft, you need to buy nothing from us
A free-software project, an academic one, or an organisation with an open-source policy uses Quipu for free, and we want them to: they are the reason the project exists and the reason anyone else trusts it. The commercial customer is specifically the one with code they cannot or will not publish.
Two different things are for sale
Commercial licence
Exempts you from the network copyleft. Ship Quipu inside your proprietary product or your SaaS without publishing your source.
It is an additional and parallel grant to the AGPL, not a replacement: you keep every right the free licence gives to anyone.
Managed OPRF server
Not having to run the infrastructure or hold the key. Availability, rate limiting and rotation included.
A separate, complementary business. You may need one, the other, both or neither.
What is inside
Hybrid encryption X25519 + ML-KEM-1024 and hybrid signatures Ed25519 + ML-DSA-87 — the parameters the NSA's CNSA 2.0 mandate requires. Threshold key custody, start-up self-tests against RFC 5869 vectors, and a security lab that attacks the library itself.
The code is auditable and is delivered to anyone who wants to audit it, with its signature and its SHA-256 checksum. Since August 2026 it is not distributed through public registries — not crates.io, not PyPI, not npm, not GitHub — and the reason is security: the chained supply-chain attacks against those platforms through 2026 made hosting a cryptography library there stop being a neutral decision. It changes neither the licence nor the product: still AGPL-3.0, still free. Ask at contacto@xiliux.com — how to ask, what arrives, and why it was decided this way.
The same delivery exists for the nine Apache-2.0 libraries: direct, signed download.