← All productsIncluded from Starter

Trust Kernel

Post-quantum identities for every subject you operate.

Trust Kernel issues a cryptographic identity for any subject — an employee, a device, a service account or an AI agent — using ML-KEM-1024 key encapsulation with rotating key material. Each identity carries a stable hash you can reference from your own systems, and can be deactivated the moment a subject is decommissioned.

Built for: Platform and security engineering teams replacing shared secrets and static API tokens.

Capabilities

Subject-agnostic enrolment

One enrolment flow covers people, machines, workloads and agents. Subject type is a label, not a separate product.

Rotating key material

Keys rotate on a schedule you set. Older material stays verifiable so historical proofs never break.

Instant revocation

Deactivating an identity invalidates future proofs immediately and marks the evidence trail accordingly.

Identity hashes for your systems

Reference identities from your own database with a stable hash instead of copying key material around.

What you get out of it

  • Retire long-lived API keys and shared service credentials
  • Prove which entity performed an action, months later
  • Meet post-quantum readiness requirements ahead of mandate deadlines
Live demo

Try it right here

This runs the real logic on our servers — no account, no canned responses. Demo runs are not stored and use a published demo signing key; your tenant uses rotating ML-KEM-1024 material.

Issue an identity

Enrol any subject — a person, a device, a workload or an agent. The identity hash is computed with SHA-256 over the canonical subject record, exactly as the platform does it.

How it fits the platform

Trust Kernel is step one of the platform. Every proof, agent policy, graph node and evidence entry points back to an identity issued here, so this is where an integration normally begins.

See the four-step platform flow →

Pricing

Trust Kernel is included from the Starter plan at $49 / month, with every higher plan including it too. Verification is never charged per check — plans differ on volume, retention, autonomy and governance.