Encrypted traffic recorded todaycan be opened on Q‑Day.
Capturing traffic is passive, cheap and leaves no trace. The White House now names it a national risk: adversaries “collecting United States information now, and decrypting it later.”1 An attacker only has to keep the recording until a quantum computer can open it, and the latest research keeps moving that day closer.2–4When it comes, it won’t stop at that day’s traffic.Years of data, exposed at once.
And suddenly, the liability is yours.
- TodayCapturedEncrypted traffic is copied off the link, without anyone noticing.
- For yearsStoredYour data sits in an archive, ready and waiting. The attacker is patient. When Q‑Day comes, the wait pays off.
- Q-DayDecryptedQ‑Day is when a quantum computer can break today’s key exchange.5 Years of recorded data become readable at once.
You don’t need a quantum computer to stop this. The attacker does.
What’s already been recorded can’t be un‑recorded, by us or by anyone. Everything that hasn’t been recorded is still yours to protect.
PacketLoq protects your data in motion from the day it’s installed. Until then, every day your links run on today’s key exchange adds another day to the attacker’s archive. Switch, and let them record. On Q‑Day, it still won’t open.
Q‑Day only decides when the recording opens. Executive Order 14412 warns that adversaries may already be collecting encrypted data to decrypt later.1 Quantum experts surveyed by the Global Risk Institute put the chance of Q‑Day within ten years at 28–49%, the highest in the report’s history.4
Executive Order 14412 requires post-quantum key establishment on high-value and high-impact federal systems by December 31, 2030, and directs a rule holding covered federal contractors to NIST’s standards by the same date.1
In 2025, Google’s Craig Gidney cut the estimated hardware needed to break RSA-2048 about twentyfold, through better methods, not better machines.2 The target is the key exchange. AES‑256, which encrypts the data itself, holds up well; the RSA or elliptic‑curve exchange that sets it up does not.
The secret never crosses the wire.
Public key exchange was invented in 1976 so strangers could agree on a secret in public. IPsec and TLS still open every link that way, even between your data center and a branch office that have known each other for years.
- 1The key is placed in advance.Loaded at both ends before any traffic flows, so it never travels over the link.
- 2Session keys stay inside the link.They’re set up over the encrypted connection, with nothing negotiated in the open.
- 3Keys rotate on their own.Every gigabyte by default (customizable), with old keys erased from memory.
- A recording holds nothing to break
- No handshake for a quantum computer to attack
- Still safe after Q‑Day
PacketLoq’s approach is its own invention.Patent pending in the US, Canada and the EU.
The difference is the first two frames.
The same site-to-site link, recorded on IPsec and then on PacketLoq.
| No. | Source | Protocol | Info |
|---|---|---|---|
| 1 | 203.0.113.4 | ISAKMP | IKE_SA_INIT key exchange payload |
| 2 | 198.51.100.9 | ISAKMP | IKE_SA_INIT key exchange payload |
| 3 | 203.0.113.4 | ISAKMP | IKE_AUTH |
| 4 | 203.0.113.4 | ESP | SPI=0x8f2a1c04 encrypted |
| 5 | 198.51.100.9 | ESP | SPI=0x1d77b930 encrypted |
| … | ESP | every packet that follows |
| No. | Source | Protocol | Info |
|---|---|---|---|
| 1 | 203.0.113.4 | UDP | 9876 → 9876 Len=1422 |
| 2 | 198.51.100.9 | UDP | 9876 → 9876 Len=1422 |
| 3 | 203.0.113.4 | UDP | 9876 → 9876 Len=1422 |
| 4 | 198.51.100.9 | UDP | 9876 → 9876 Len=1422 |
| 5 | 203.0.113.4 | UDP | 9876 → 9876 Len=1422 |
| … | UDP | every packet that follows |
Today’s key exchange is tomorrow’s breach.PacketLoq removes the weak point.
Why can a quantum computer break those two frames, but not ours? See how Shor’s algorithm works →Your options for Q‑Day, compared.
Everyone else hardens the handshake. PacketLoq removes it.
- PacketLoqNothing to record, keys that rotate on their own, on hardware you already own.
- Post‑quantum key exchangeA stronger lock, but it still sends the handshake that gets recorded.
- Post‑quantum pre‑shared keysThe right idea, but the keys are static and handled by hand.
- Hardware link encryptorsA new box at every site.
- Key‑delivery servicesSomeone else in your key loop.
- Quantum key distributionSpecial hardware and dedicated fiber.
1 No key exchange to record · 2 No new hardware · 3 No outside key service · 4 Works over any network · 5 Keys rotate on their own. Tap a row for details.
Categories, not vendors. “Varies” means it depends on the product and how it’s set up.
Why not just turn on post‑quantum IPsec?
Good. Keep it. It comes in two forms, and PacketLoq runs underneath either one.
A post‑quantum key exchange makes the exchange harder to break, but it still sends one, and that’s still being recorded.
Post‑quantum pre‑shared keys are the closest thing to our approach, and proof that it works. But the keys are static, created and shared by hand, and one major vendor’s own guide says they don’t scale well across many sites.6 PacketLoq rotates its keys on its own, under whatever VPN, router or firewall you already have.
Find the link you’re responsible for
PacketLoq protects links between endpoints you provision: your own sites, servers, cloud instances and managed devices, or a counterparty you have a contract with. For talking to strangers on the open internet, keep TLS.
Protects links in any of these layouts
- Site to site
- Hub and spoke
- Mesh
- Client to server
Select your industry
Branch to core, and data center replication
Payment instructions and account records cross circuits you don’t own and must stay confidential for decades.
PacketLoq protects those links, and because you own both ends, there’s nobody else to negotiate with.
- Confidential for7–30 years
- Sits underneathYour IPsec site-to-site
- Runs onServers you already run
Start with one branch link and a packet capture.
Talk to us about a pilotBetween hospitals, imaging and the data center
Patient records move between your sites all day and must stay private for a lifetime.
PacketLoq protects every link you own and logs each key operation for your auditors.
- Confidential forA patient’s lifetime
- Sits underneathYour site VPN, on any circuit
- Runs onServers you already run
Prove any link is encrypted, from the appliance.
Talk to us about a pilotControl center to plant, substation or wellhead
Control protocols were built without security, and a private line doesn’t help if someone can tap it.
PacketLoq works at Layer 3, so the plant doesn’t change.
- Confidential forThe life of the plant
- Sits underneathYour control traffic, unchanged
- Runs onHardware the size of a paperback
Start with one control link and a packet capture.
Talk to us about a pilotCloud to cloud, and cloud to data center
Provider encryption stops at the edge of each cloud, so many teams pay a third party to bridge them.
PacketLoq runs the same way on every provider. Keep your interconnect and run PacketLoq underneath it, or retire it and save the cost.
- Confidential forYears
- Sits underneath, or can retireThird-party interconnect
- Runs onInstances you already run
Paying to bridge two clouds? Run the comparison.
Talk to us about a pilotSite to site, and ground segment to spacecraft
Government and defense links, from site to site or ground to spacecraft, need key custody you can account for from generation to destruction.
PacketLoq separates red and black, keeps keys on a crypto ignition key, tracks each key by serial number, and speaks CCSDS for spacecraft.
- Confidential forDecades
- Sits underneathYour existing site-to-site encryption
- Runs onAir-gapped hardware
Your assessors can export the full key audit trail.
Start a conversationAny link where you control both ends
Retail, logistics, law, media, education, managed service providers: any business that runs links of its own.
If you control both ends, the link crosses a network you don’t own, and the data must stay secret for years, PacketLoq fits.
- Confidential forAs long as you need
- Sits underneathWhatever protects the link today
- Runs onServers you already run
Tell us about the link. We’ll tell you if it fits.
Talk to us about your linkOne binary, on servers you already run.
PacketLoq sits at the edge of each site. Everything behind it stays the same.
Running in an afternoon
Install it from one ISO, with no new appliance to buy or rack.
- One binary, one ISO
- Zero dependencies
- amd64, arm64, riscv64
Keys you control, custody you can prove
Your auditors see who touched which key and when. Destroyed keys are gone for good.
- Encrypted vault
- Crypto ignition key
- Full audit log
- Three-pass zeroize
Invisible to your applications
No changes to your apps, and users won’t notice it’s there.
- Layer 3
- Application-transparent
- NAT-traversable
- ~5% overhead
One link, or your whole network
Start with a single branch and grow to every site, without redesigning anything.
- Up to 32 tunnels per appliance
- Hub-and-spoke
- Automatic OSPF routing
Runs quietly, reports everything
Your operations team gets live status and alerts in the tools they already use.
- Web interface
- Serial console
- 25-command API
- Prometheus
- Four alert channels
Cryptography your auditors already trust
Standard, heavily studied ciphers. The difference is in how the keys are handled.
- AES-256-GCM
- ChaCha20-Poly1305
- High-assurance mode
PacketLoq isn’t sold off the shelf. We start with a conversation, then a live capture on a link you pick.
Built from experience. Shaped by what’s at stake.
PacketLoq is a small, senior team based in Seattle and working remotely.
Our founding engineers built their careers in satellite ground systems and defense communications, where security and reliability are operational requirements, not selling points. Our product and GTM leaders have taken cloud platforms and enterprise software to market at scale.
The product began with a problem on the founders’ own network: a large transfer between two sites could bring the connection to a crawl. Solving it led them to rethink how they protected data in transit. That work became the foundation for PacketLoq.
Those roots shape the product today: deliberate engineering, uncompromising key custody, and an approach to operations built for people who cannot afford surprises.
- Based inSeattle, Washington
- What we buildEncryption for data in motion
- PatentPending in the US, Canada and the EU
- Team biosAvailable to customers and investors under NDA
- Design partnersTaking a small number now. Get in touch
- Talk to us[email protected]
Bring us a link and a packet analyzer
Tell us which link you’re responsible for and what runs on it today. If a capture demo isn’t worth your afternoon, we’ll tell you.
Include the link type, the throughput and what sits at each end. We’ll let you know whether we’re a fit, even if the answer is no.
Request a demonstration