Quantum-safe today, not “on the roadmap.”

A pure post-quantum scheme is a single bet on young algorithms; a pure classical scheme is a known bet against a future quantum adversary. Neither is prudent for data you must protect for decades.

Glassbreak runs the standardised post-quantum primitives in hybrid with battle-tested classical ones, and an attacker must break BOTH halves of a pair to win. Secret shares cascade RSA-OAEP-4096 under ML-KEM-1024. Chat and call keys combine ML-KEM-1024 with X25519 through a single HKDF, and group messaging runs MLS on the X-Wing suite. Every identity signature is made twice, with ML-DSA-65 and Ed25519, and both must verify. Recovery-kit manifests — the artefacts that outlive everything else — add a third, hash-based SLH-DSA signature, so forging one means breaking lattices and elliptic curves and SHA-2. You inherit the quantum resistance without giving up the classical assurance.

Adversaries are already capturing encrypted traffic and archives to decrypt once a cryptographically-relevant quantum computer exists. For long-retention secrets, the threat is today even though the decryption is years out.

Because the key-establishment is already hybrid post-quantum, ciphertext harvested today is not decryptable by a future quantum machine — and, just as importantly, not by an adversary who breaks the lattice assumption instead. The 2026 Dihedral-Coset-Problem work aimed at Module-LWE is unproven, but a design that would collapse if it held is a design that made a bet. Ours does not: either half standing is enough. The protection has to be in place before the adversary captures the data — and on Glassbreak it already is.

Quantum-safe transport is hollow if the server can read the plaintext. The strongest algorithm does not help if the provider holds a decryption key.

Content is encrypted on the client before it ever reaches Glassbreak, and the service holds zero decryption keys. Even with full database access, a Glassbreak operator — or a future quantum adversary who compromised the provider — sees only ciphertext.

Post-quantum standards will keep evolving. An encryption design welded to one algorithm becomes a migration project the day the parameters change.

The key model is versioned and algorithm-aware, so primitives can be rotated and re-wrapped as standards mature — without re-architecting. Key blobs and signatures are self-describing and versioned, which is how the platform added classical seatbelts alongside its post-quantum primitives without re-enrolling a single key or re-wrapping a single stored secret. Crypto-agility is a property of the design, not a future ticket.

The encryption only matters if access control is just as strong. A quantum-safe vault with a single phishable unlock is not quantum-safe in practice.

Long-retention secrets are protected by T-of-N multi-party approval with WebAuthn-gated approvers. The cryptography and the access policy are both hardened — there is no weak link to pull.

Finance, government, and defence buyers increasingly have to show a credible post-quantum migration posture, not just claim one.

The encryption model is documented publicly, and every key event is recorded in the append-only audit log — the artefacts an assessor or supervisory authority asks for when reviewing cryptographic controls.