ARQIT LIMITED

Symmetric Key Agreement Platform

The Symmetric Key Agreement Platform creates quantum-safe, computationally secure symmetric encryption keys between endpoints, allowing them to exchange data with quantum-safe security. The platform integrates with proprietary or commercially available off-the-shelf solutions, applications, network infrastructure, and common network protocols like IPsec and TLS to enable PQC migrations using quantum-safe VPNs.

Features

• PQC migration using PQAs and a symmetric key overlay
• Quantum-safe keys generated for VPN sessions
• Keys generated for trusted device authentication
• Integrations with many leading OEM vendors and open source VPNs
• Quantum-safe use cases for OTNsec, MACsec, IPsec, Wireguard, TLS
• Quantum-safe MQTT and AES payload encryption
• High-grade encryption for mobiles, laptops, drones, networking devices, firewalls
• API-driven policy control for automation with external orchestrators
• High-availability key generation for protection against system failures
• Device endpoint keep-alive health check and environment monitoring

Benefits

• Encryption use cases where traditional physical encryptors are sub-optimal
• Software only encryption solution that reduces size, weight and power
• Agile encryption deployment options tightly aligned to specific requirements
• Secure by design device authentication ensuring zero trust implementations
• Significant cost and flexibility improvements over alternative QKD solutions
• Multi-vendor integration benefits removing OEM lockin scenarios
• Adaptability for enterprise, government and defence quantum-safe use cases
• Future-proofed quantum-resilient cryptography reducing rip and replace scenarios
• Expandable into most networking OSI stack requirements
• Provides protection for SNDL, HNDL data-in-transit quantum threats

• Free trial available

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at tomos.morgan@arqit.uk. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

571585742707090

Contact

Tomos Morgan
07389836637
tomos.morgan@arqit.uk

About the service

• Service categories:

  Systems Infrastructure Software

  Security

  • Cloud native application protection platform
  • Endpoint security

  Network security

  • Trusted network access and protection
  • Active application security

  Data security

  • Information protection
  • Digital trust
• Multi cloud support: Yes

Service scope

• Software add-on or extension: No
• Cloud deployment model:
  • Public cloud
  • Private cloud
• Service constraints: None
• System requirements: Runs on COTS physical infrastructure on standard Linux operating systems.

User support

• Email or online ticketing support: Yes
• Support response times: Support is offered UK time 08:30 – 17:30 weekdays only and excluding bank holidays. Target initial response time is 60 minutes for P1, 90 minutes for P2, and 180 minutes for P3 and P4.
• User can manage status and priority of support tickets: Yes
• Online ticketing support accessibility: None or don’t know
• Phone support: Yes
• Phone support availability: 9 to 5 (UK time), Monday to Friday
• Web chat support: No
• Onsite support: Yes, at extra cost
• Support levels: Registered Arqit customers have access to our online support knowledgebase and incident handling website (Zendesk). Incidents can be raised 24x7 via the website and will be responded to during Business Hours (Mon-Fri 08:30-17:30 UK time, excluding Public Holidays). Incidents will be prioritised, with target response and resolution times dependent upon impact and priority. There is no additional cost for this support. Additional support options including 24x7, and on-site assistance are available at additional cost, based on the provided SFIA rate card.
• Support available to third parties: Yes

Onboarding and offboarding

• Getting started: At Arqit we want our customers to get the most out of using our service from the outset, and as such we provide a comprehensive set of planning and onboarding services. Prior to deployment our customer success team will engage with the buyer technical team to gain an understanding of the buyer's infrastructure, and with our deployment guide, help to size and scope the deployment. We provide a simple self-deployment process for the buyer technical team to get up and running quickly, and we have a suite of documentation to enable customers to deploy and start using the product effectively. If required we can provide remote support to assist with self-install, on-site installation and deployment services at extra cost, from SFIA rate card. Arqit also offers a G-Cloud Lot 3 service called PQC Migration Services which includes a set of professional services to assist with PQC migration on a time and materials basis.
• Service documentation: Yes
• Documentation formats: HTML
• End-of-contract data extraction: All data can be extracted from the system via extraction from the system DB or log files. Extraction of data is likely to be needed only for historical archiving purposes.
• End-of-contract process: The SKA Platform will cease to operate when the subscription contract ends if the activation key is not renewed. There is no charge for regular end of contract processing but certain additional activities such as assistance with data transformation for long-term archive may be available as services at rates described in the supplied SFIA rate card.
• Documentation accessibility standard: None or don’t know
• How the documentation is accessible: The SKA Platform supports a timed expiry activation process. The system will cease operation should the activation period expire without a renewal.

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
• Application to install: No
• Designed for use on mobile devices: No
• Service interface: Yes
• User support accessibility: None or don’t know
• Description of service interface: The SKA Platform service interface allows the Buyer to define key policy and monitor the health of key agreement operations with device endpoints.
• Accessibility standards: None or don’t know
• Description of accessibility: The SKA Platform user interface is web-based and so leverages the accessibility capabilities of major web browsers, including zoom magnification, high-contrast modes, ability to change fonts, text-to-speech, keyboard navigation, etc.
• Accessibility testing: None
• API: Yes
• What users can and can't do using the API: The REST API provided is primarily for integration with other systems to configure key rotation policy and to provide notifications and alerts to other systems (such as SIEM).
• API documentation: Yes
• API documentation formats: HTML
• API sandbox or test environment: Yes
• Customisation available: Yes
• Description of customisation: Arqit provides an SKA Platform SDK so users can build their own use cases.

Scaling

• Independence of resources: Arqit's SKA Platform is often provided as a dedicated private cloud instance for each customer deployment. The operator can determine the level of isolation for each installed instance based on infrastructure usage design rules.

Analytics

• Service usage metrics: No

Supplier type

• Supplier type: Not a reseller

Staff security

• Staff security clearance: Conforms to BS7858:2019
• Government security clearance: Developed Vetting (DV)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations: United Kingdom
• User control over data storage and processing locations: Yes
• Datacentre security standards: Supplier-defined controls
• Penetration testing frequency: At least once a year
• Penetration testing approach: In-house
• Protecting data at rest: Other
• Other data at rest protection approach: End customers determine data protection policy for their own private cloud deployment options.
• Data sanitisation process: Yes
• Equipment disposal approach: A third-party destruction service
• Data sanitisation type: Data Erasure

Data importing and exporting

• Data export approach: Data can be extracted from the system via export from the system DB and log files. Arqit can provide knowledge transfer services where needed, at additional cost based on the provided SFIA Rate Card
• Data export formats: Other
• Other data export formats: Customisable output determined by the nature of DB extraction process
• Data import formats: Other
• Other data import formats: Readable text log files

Data-in-transit protection

• Data protection between buyer and supplier networks:
  • Private network or public sector network
  • TLS (version 1.2 or above)
• Data protection within supplier network:
  • TLS (version 1.2 or above)
  • IPsec or TLS VPN gateway

Availability and resilience

• Guaranteed availability: Arqit does not offer specific availability guarantees for the SKA Platform product because the system is most commonly deployed in the customers own private or public cloud tenant. The availability target is set and owned by the customer.
• Approach to resilience: The SKA Platform has high-availability deployment options. These are designed and implemented by the customer often with consultancy from Arqit's Professional Services team. The system can run on resilient, highly available hardware and middleware options based on the design of the customers private cloud environment.
• Outage reporting: Outages are notified via system logs and other notification interfaces to external systems such as a SIEM.

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • Multi-Factor Authentication (MFA)
  • Username or password
• Access restrictions in management interfaces and support channels: User Role-Based Access Control ensures that only administrative users can access certain functions within the application. ; Support channels (raising and managing tickets) is restricted to named and authenticated users of the Buyer organisation and named and need-to-know individuals within Arqit. Access to software repositories and product documentation is controlled using access tokens provided to authorised Buyer representatives.
• Access restriction testing frequency: At least every 6 months
• Management access authentication:
  • Dedicated link (for example VPN)
  • Username or password

Audit information for users

• Access to user activity audit information: Users have access to real-time audit information
• How long user audit data is stored for: User-defined
• Access to supplier activity audit information: Users have access to real-time audit information
• How long supplier audit data is stored for: User-defined
• How long system logs are stored for: User-defined

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: Yes
• Security governance standards:
  • ISO/IEC 27001
  • Other
• Other security governance standards: Cyber Essentials / Cyber Essentials +
• Information security policies and processes: Information security is the responsibility of the Chief Security Officer. Detailed policies and procedures are contained within the Arqit Information Management Security System (ISMS) which has been audited and certified to ISO 27001:2022 and Cyber Essentials +; Compliance to policies is ensured through staff training, job procedures, and internal as well as external audits not less than annually.
• Software Security Code of Practice: No

Operational security

• Configuration and change management standard: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Configuration and change management approach: Complies with ISO 27001:2022.; All assets (Arqit software, third-party software, cloud infrastructure) subject to rigorous change control procedures. All changes tracked via tickets in project or service management systems, with independent review and authorisation required before implementation. Regular change control board meetings are held with cross-functional representation including senior leadership to discuss and review changes. Changes to Arqit software are tracked and controlled in a source control system with mandatory independent review and test requirements. Software and configuration changes to production environments must be staged and thoroughly tested before being applied to production environments, and appropriate ticket-based authorisations are required.
• Vulnerability management type: Supplier-defined controls
• Vulnerability management approach: Arqit's vulnerability management process complies with ISO 27001:2022. ; Our vulnerability management combines automated scanning, prioritised patching, and proactive threat response. Microsoft Defender continuously scans endpoints and servers, while critical and high-risk patches are applied immediately after testing; medium and low-risk updates follow monthly cycles. We use CI/CD tools to automatically triage and update software dependencies, reducing exposure from outdated components. Threat intelligence from multiple sources is investigated promptly, ensuring timely action. This integrated approach keeps systems secure and resilient against evolving risks.
• Protective monitoring type: Undisclosed
• Protective monitoring approach: The customer defines the level of protective monitoring deployed within their private cloud deployment.
• Incident management type: Supplier-defined controls
• Incident management approach: Arqit's Incident Management Process is documented as part of the ISMS, and is based on ISO/IEC 27035:2023. ; Security incidents can be reported to a dedicated email address or direct to the Security Team. All reported incidents are logged and assigned a severity classification to guide appropriate response. Responses are coordinated using service management systems, with tickets raised to track investigation, containment, remediation, communication, and closure activities, ensuring accountability and traceability. ; ; The Security Incident Management Procedure describes the activities carried out by the appropriate functions within the business, coordinated by the assigned Incident Lead within the Security Team.
• Post-quantum cryptography secure: Yes

Secure development

• Approach to secure software development best practice: Conforms to a recognised standard, but self-assessed

Public sector networks

• Connection to public sector networks: No

Pricing

• Discount for educational organisations: No
• Free trial available: Yes
• Description of free trial: Arqit runs a SKA PaaS system for trial user access.

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 0%
• Between £250,000 and £500,000: 5%
• Between £500,001 and £1,000,000: 10%
• Between £1,000,001 and £2,500,000: 20%
• Between £2,500,001 and £5,000,000: 25%
• Over £5,000,001: 30%

Standards and certifications

• ISO/IEC 27001 certification: Yes
• ISO/IEC 27001 accredited by: NQA Certification Ltd
• ISO/IEC 27001 accreditation date: Thursday 11 January 2024
• What the ISO/IEC 27001 doesn’t cover: Operations outside the UK are not covered.
• ISO 28000:2022 certification: No
• ISO 9001 certification: No
• Quality management systems (QMS): Yes
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: Yes
• Cyber Essentials Certificate Number: 572eb417-6877-4000-84a9-2337b4cd5a63
• Cyber essentials plus: Yes
• Cyber Essentials Plus Certificate Number: 67ae2f92-a403-4383-b843-091753d4d204
• Other security certifications: No

Social value

• Mission: Kick start economic growth:

  To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

  Policy Outcome 1: Fair work: That offers fair wages and good working conditions. Help people get a job, stay in work, and progress in their careers, with good employment opportunities across the country. Notes: Where there is a large proportion of labour costs in the contract, commercial teams should consider MAC in Outcome 1 as a priority

  • New or retained jobs on the contract workforce in the relevant area that meet the criteria set out in MAC 1b, 1c and 1d
  • Providing opportunities for, and measuring and monitoring of, staff workforce conditions over time, including employee engagement, involvement in decision-making and satisfaction and adapting to any changes in the results, with clear processes for acting on issues identified
  • Monitoring of employee engagement rates (by protected characteristic) and, where necessary, the development of actions to ensure all voices are heard across the diversity of the workforce
  • Activities that support an environment where staff are educated about, and feel empowered to, address their physical wellbeing
  • Activities that support an environment where staff are educated about and feel empowered to report and address bullying and harassment
  • Payment of more than the National Minimum Wage or National Living Wage (as appropriate) to the contract workforce
  • Entitlement to sick pay for the contract workforce, with provision in place for any staff who do not meet the earnings threshold for statutory sick pay, payment of sick pay from day one of absence and payment of staff on the contract workforce who are off sick a replacement income of 100% of their usual earnings for as long as possible
  • Measures to support in-work progression to help people in the contract workforce, to move into higher paid work by developing new skills relevant to the contract
  • Support for educational attainment relevant to the contract, including training schemes that address skills gaps and result in recognised qualifications
  • Understanding of the modern slavery risks and issues affecting the market, industry, sector or country (of origin or of source) relevant to the contract, and the workforce in the supplier’s own organisation and those of its key subcontractors
  • Outline policies and practices to be applied to or put in place for the contract to mitigate and manage modern slavery risks, including: Pre-employment checks, recruitment practices. Workplace conditions, safeguarding plans and processes in place and regular monitoring with relevant groups considered, which may include sampling
  • How to ensure business decisions re: price/cost, short lead times, payment timescales do not create modern slavery risks in the supply chain

  Policy Outcome 2: Skills for growth: Supporting growth sectors and addressing skills gaps.

  • Support for educational attainment relevant to the contract, including training schemes that address skills gaps and result in recognised qualifications

  Policy Outcome 3: Resilient, innovative and flexible supply chains: Support economic growth through enabling resilient businesses, opportunities for small businesses and voluntary, community and social enterprises

  • Understanding of the types of businesses in the market and the level of participation by new businesses, entrepreneurs, start-ups, SMEs, VCSEs and mutuals
  • Activities to identify opportunities to open up sub-contracts under the prime contract to a diverse range of businesses, including new businesses, entrepreneurs, start-ups, SMEs, VCSEs and mutuals
  • Advertising of supply chain opportunities openly and to ensure they are accessible to a diverse range of businesses, including advertising all subcontracting opportunities on Contracts Finder
  • Structuring of the supply chain selection process to ensure fairness (e.g. anti-corruption) and encourages participation by a diverse range of businesses, including with regard to new businesses, entrepreneurs, start-ups, SMEs, VCSEs and mutual
  • Understanding of local demographics, needs and opportunities for the co-design of the goods, services and works to be delivered under the contract
  • Measures to involve local stakeholders and/or users in design (e.g. in the design of services, systems, products or buildings)
• Mission: Make Britain a clean energy superpower:

  To cut bills, create jobs and deliver security with cheaper, zero-carbon electricity by 2030, accelerating to net zero

  Policy Outcome 4: Sustainable procurement practices: Reducing carbon footprints, minimising waste, and promoting the use of clean energy and green technologies.

  • Understanding of opportunities for additional environmental benefits delivery in the performance of the contract, including working towards net zero carbon emissions and use of clean energy and green technologies
  • Understanding of how to influence staff, suppliers, customers, communities and/or any other appropriate stakeholders through the delivery of the contract to support climate and nature protection and improvement
• Mission: Break down barriers to opportunity:

  By reforming our childcare and education systems, to make sure there is no class ceiling on the ambitions of young people in Britain

  Policy Outcome 6: Employment and training: For those who face barriers to employment

  • Understanding of employment and skills issues, and of the skills and employment shortages of high growth sectors relating to the contract
  • Understanding of the issues affecting the representation of disabled people in the workforce in the market, industry or sector relevant to the contract, and in the supplier’s own organisation and those of its key sub-contractors
  • Working conditions which promote an inclusive working environment and promote retention and progression
  • Understanding of the issues affecting inequality in employment, skills and pay in the market, industry or sector relevant to the contract, and in the supplier’s own organisation and those of its key sub-contractors. Measures to tackle inequality in employment, skills and pay in the contract workforce

  Policy Outcome 7: Creating a pipeline of opportunities: For the contract workforce, reducing barriers to entry for under-represented groups.

  • Understanding of the underlying factors affecting improvements to reduce barriers to entry and training schemes for the target cohort(s) related to the contract workforce
  • Understanding of issues relating to entering the contract workforce
• Mission: Build an NHS fit for the future:

  That is there when people need it; with fewer lives lost to the biggest killers; in a fairer Britain, where everyone lives well for longer.

  Policy Outcome 8: Increasing productivity through physical and mental wellbeing: In the supply chain and communities in the relevant area.

  • Understanding of issues relating to health and wellbeing, including physical and mental health, in the contract workforce
  • Understanding barriers to access to health and social care services or employment opportunities e.g. digital inclusion
  • Actions to invest in the physical and mental health and wellbeing of the contract workforce

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at tomos.morgan@arqit.uk. Tell them what format you need. It will help if you say what assistive technology you use.