01
Vendor fixes protect the future, not the past.
When suppliers switch on post-quantum encryption, it protects traffic from that day on. Anything recorded before stays exposed.
Confidentiality Review · for UK law firms
Your clients' secrets outlive today's encryption.
A three-week Confidentiality Review that maps your longest-lived client data, checks what your suppliers are doing about post-quantum risk, and gives you evidence for clients and insurers.
“Harvest now, decrypt later”: encrypted traffic recorded today can be read once quantum computers break RSA and ECC. Wills, trusts and M&A files must stay confidential far longer than that.
Why firms call us
It usually starts with a question someone else asks.
- A client security questionnaire asks about post-quantum readiness
- Your cyber insurer's renewal form has a new question
- SRA or ICO expectations on protecting client data
- A supplier incident or change of platform
- A partner asks, simply: “are we exposed?”
What most firms don't know
Six facts that change where you spend effort.
02
The weak point isn't your stored files.
AES-256 at rest holds up. The problem is key exchange in transit and digital signatures.
03
Bigger keys don't help.
RSA-4096 falls to a quantum computer just as RSA-2048 does. This is a change of algorithm, not a setting.
04
Deletion is the cheapest control.
Data you no longer hold can't be decrypted later. Retention policy is a security tool.
05
E-signatures have a long tail.
Deeds signed today must remain provably authentic for decades — longer than today's signature algorithms.
06
It's a supplier and governance job.
The NCSC expects mainstream IT to be updated by vendors. Your job is to know who, what and when.
How it works
Three weeks, fixed fee, five clear stages.
Stage 1
Entry
Free external snapshot, or a 30-minute partner briefing.
Stage 2
Week 1 · Discover
Data shelf-life workshop, supplier map, light external scan of verified domains.
Stage 3
Week 2 · Prioritise
Risk = data lifetime × exposure in transit × supplier readiness. Banded ACT NOW, PLAN FOR 2028, or MONITOR.
Stage 4
Week 3 · Deliver
Six written outputs, peer-reviewed, ready to share.
Stage 5
Maintain
Quantum Watch: a monthly check as suppliers move.
The six outputs
Written for the people who have to act on them.
| Output | For |
|---|---|
| Partner briefing | Managing partner / board |
| Supplier question pack | IT lead / COO |
| Client & insurer statement | COLP / business development |
| Retention quick wins | COLP / records |
| Technical quick wins | IT provider |
| 12-month plan mapped to NCSC 2028 / 2031 / 2035 | Whole firm |
Quantum Ready Shield
Post-quantum protection, managed for you. One monthly fee.
Founding-firm pricing. Validated with our first clients.
Prices exclude VAT.
Watch
£195/ month
Monthly billing · 30 days’ notice to cancel
For firms that want to know where they stand.
- Monthly external rescan: website, client portal, email (MX) and remote access
- Supplier Readiness alerts: when Microsoft 365, iManage, Mimecast etc. change their post-quantum position
- Supplier question pack: ready-to-send questions plus a response tracker
- Quantum Readiness Index: one 0–100 score with a monthly trend
- Client & insurer questionnaire answers: kept current
- Quarterly partner briefing: 30 minutes, plain English
- CycloneDX CBOM: machine-readable cryptographic inventory
- Harvest-now risk clock: per matter type (Mosca’s inequality)
Most firms choose
Shield
£595/ month
Monthly billing · 30 days’ notice to cancel
Everything in Watch, plus:
- Managed post-quantum gateway: hybrid ML-KEM (FIPS 203) TLS in front of up to 3 client-facing services; no code changes
- Live post-quantum coverage %: measured on your real traffic, not estimated
- Crypto-agility controls: Observe → Prefer → Require, changed centrally in minutes
- Break-before-you-enforce forecast: see exactly which clients would fail first
- Monthly evidence pack: an insurer- and client-ready PDF
- Policy audit trail: every change, who made it and why
- Certificate & expiry watch: on protected services
- Confidentiality Review included: on 12-month plans (data shelf-life workshop, supplier map, six outputs)
- UK-hosted control plane: minimal data, no client documents ever touch itUK deployment and residency confirmed before service activation.
- Next-business-day support: named analyst
Included with 12-month Shield plans
(£2,950 if bought separately)
Shield Plus
£1,450/ month
Monthly billing · 30 days’ notice to cancel
Everything in Shield, plus:
- Up to 10 protected services: portals, extranets, document exchange, remote access
- Post-quantum site-to-site tunnel: WireGuard + Rosenpass between offices or to the cloud
- Quarterly re-review: refreshed outputs and NCSC-aligned plan
- Board / insurer attendance: we join one meeting per quarter
- 4-hour response: on gateway incidents
- Supplier escalation: we chase your suppliers for answers
- Custom evidence: for client panel and tender security questionnaires
Included with 12-month Shield plans
(£2,950 if bought separately)
Free External Snapshot
Free · 48h · up to 3 verified domains only. Written authorisation before any check.
Safeguards
Trust is the product.
- We never claim anything is “quantum-safe”.
- Written authorisation and verified domain ownership before any scan (Computer Misuse Act 1990).
- NCSC and NIST quoted exactly — 2028, 2031 and 2035 are targets, not deadlines.
- Every report peer-reviewed by a second founder.
- Professional indemnity cover and a clear liability cap.
- Minimal data, encrypted, deleted on schedule.
NCSC timeline
Targets, not deadlines.
2028
Discover & plan
2031
Priority migrations
2035
Migration complete
Source: NCSC, “Timelines for migration to post-quantum cryptography” (March 2025).