01
Vendor fixes protect the future, not the past.
When suppliers switch on post-quantum encryption, it protects traffic from that day on. Anything recorded before stays exposed.
Confidentiality Review · for UK law firms
Your clients' secrets outlive today's encryption.
A three-week Confidentiality Review that maps your longest-lived client data, checks what your suppliers are doing about post-quantum risk, and gives you evidence for clients and insurers.
“Harvest now, decrypt later”: encrypted traffic recorded today can be read once quantum computers break RSA and ECC. Wills, trusts and M&A files must stay confidential far longer than that.
Why firms call us
It usually starts with a question someone else asks.
- A client security questionnaire asks about post-quantum readiness
- Your cyber insurer's renewal form has a new question
- SRA or ICO expectations on protecting client data
- A supplier incident or change of platform
- A partner asks, simply: “are we exposed?”
What most firms don't know
Six facts that change where you spend effort.
02
The weak point isn't your stored files.
AES-256 at rest holds up. The problem is key exchange in transit and digital signatures.
03
Bigger keys don't help.
RSA-4096 falls to a quantum computer just as RSA-2048 does. This is a change of algorithm, not a setting.
04
Deletion is the cheapest control.
Data you no longer hold can't be decrypted later. Retention policy is a security tool.
05
E-signatures have a long tail.
Deeds signed today must remain provably authentic for decades — longer than today's signature algorithms.
06
It's a supplier and governance job.
The NCSC expects mainstream IT to be updated by vendors. Your job is to know who, what and when.
How it works
Three weeks, fixed fee, five clear stages.
Stage 1
Entry
Free external snapshot, or a 30-minute partner briefing.
Stage 2
Week 1 · Discover
Data shelf-life workshop, supplier map, light external scan of verified domains.
Stage 3
Week 2 · Prioritise
Risk = data lifetime × exposure in transit × supplier readiness. Banded ACT NOW, PLAN FOR 2028, or MONITOR.
Stage 4
Week 3 · Deliver
Six written outputs, peer-reviewed, ready to share.
Stage 5
Maintain
Quantum Watch: a monthly check as suppliers move.
The six outputs
Written for the people who have to act on them.
| Output | For |
|---|---|
| Partner briefing | Managing partner / board |
| Supplier question pack | IT lead / COO |
| Client & insurer statement | COLP / business development |
| Retention quick wins | COLP / records |
| Technical quick wins | IT provider |
| 12-month plan mapped to NCSC 2028 / 2031 / 2035 | Whole firm |
Offer
Start free. Commit when it's useful.
Free External Snapshot
Free
48 hours · up to 3 verified domains · 2-page summary
Partner Briefing
£750
A 30–60 minute plain-English session for partners
Core
Confidentiality Review
from £2,950
3 weeks · fixed fee · all six outputs
Quantum Watch
from £195/mo
Rescans, supplier status alerts, questionnaire answers kept current, annual partner refresh
Prices exclude VAT; founding-firm pricing being validated.
Founding firms: three places at 30% off in exchange for a case study.
Safeguards
Trust is the product.
- We never claim anything is “quantum-safe”.
- Written authorisation and verified domain ownership before any scan (Computer Misuse Act 1990).
- NCSC and NIST quoted exactly — 2028, 2031 and 2035 are targets, not deadlines.
- Every report peer-reviewed by a second founder.
- Professional indemnity cover and a clear liability cap.
- Minimal data, encrypted, deleted on schedule.
NCSC timeline
Targets, not deadlines.
2028
Discover & plan
2031
Priority migrations
2035
Migration complete
Source: NCSC, “Timelines for migration to post-quantum cryptography” (March 2025).