XiliuxQuipu
Post-quantum cryptography for data at rest. Free software under AGPL-3.0, with a commercial licence for those who need one.
What exactly is being charged for
Quipu is free and always will be. You can use it today without paying us anything. The only condition is publishing the source of whatever you build on top of it. If that does not work for you, we sell you an exemption from that obligation.
Put another way: we do not charge for use, we charge for the right not to publish. Copyleft does not forbid charging — the licence says in so many words that you may charge any price or none. What it restricts is secrecy, not price.
If you can comply with the copyleft, you need to buy nothing from us
A free-software project, an academic one, or an organisation with an open-source policy uses Quipu for free, and we want them to: they are the reason the project exists and the reason anyone else trusts it. The commercial customer is specifically the one with code they cannot or will not publish.
Two different things are for sale
Commercial licence
Exempts you from the network copyleft. Ship Quipu inside your proprietary product or your SaaS without publishing your source.
It is an additional and parallel grant to the AGPL, not a replacement: you keep every right the free licence gives to anyone.
Managed OPRF server
Not having to run the infrastructure or hold the key. Availability, rate limiting and rotation included.
A separate, complementary business. You may need one, the other, both or neither.
What is inside
Hybrid encryption X25519 + ML-KEM-1024 and hybrid signatures Ed25519 + ML-DSA-87 — the parameters the NSA's CNSA 2.0 mandate requires — with an interoperable X-Wing-768 option (CFRG draft, conformant to its official vectors) and a triple signature that adds SLH-DSA: three schemes, and all three must verify. Threshold key custody (Shamir), start-up self-tests against RFC 5869 vectors, and a security lab that attacks the library itself.
Modes a plain cipher does not cover: discreet encryption (no cleartext header, indistinguishable from random bytes), puncturable encryption (the key is destroyed on opening, with a hash-chained log of every open), and online blind evaluation by VOPRF conformant to RFC 9497.
Verified, not just asserted. Its ML-KEM and ML-DSA are compared byte for byte, across all three security levels, against three independent implementations: the pq-crystals C reference, libcrux (formally verified) and AWS-LC (production). Agreeing with three that do not know each other is proof the standard is implemented, not just claimed.
The code is auditable and is delivered to anyone who wants to audit it, with its signature and its SHA-256 checksum. Since August 2026 it is not distributed through public registries — not crates.io, not PyPI, not npm, not GitHub — and the reason is security: the chained supply-chain attacks against those platforms through 2026 made hosting a cryptography library there stop being a neutral decision. It changes neither the licence nor the product: still AGPL-3.0, still free. Ask via the contact form — how to ask, what arrives, and why it was decided this way.
The same delivery exists for the nine Apache-2.0 libraries: direct, signed download.