Encryption Proxy

ARCHITECTURE OVERVIEW

Client / App

↓ HTTPS (plaintext payload)

QuantaShield Proxy

↓ ML-KEM-768 encrypted payload

Upstream API / S3

API Gateway

Encrypt all data in transit between microservices

S3 / Object Store

Application-layer encryption before cloud storage

Database Proxy

Encrypt sensitive fields on the wire to Postgres / MySQL

AI Model API

Protect prompt/response data to LLM endpoints

Transparent HTTP Proxy

Sits in front of any API or service as a Fastify-based reverse proxy. Request and response payloads are encrypted and decrypted on the fly — your upstream service sees plaintext, your network sees ciphertext.

ML-KEM-768 Payload Encryption

Every intercepted payload is encrypted using ML-KEM-768 key encapsulation + AES-256-GCM authenticated encryption. Post-quantum resistant against harvest-now-decrypt-later attacks.

S3-Compatible Store

Deploy the proxy in front of any S3-compatible object store (AWS S3, MinIO, Cloudflare R2, Backblaze B2) to transparently encrypt all objects at the application layer before they reach storage.

Key Rotation

Keys rotate automatically on a configurable schedule without downtime. Re-encryption of existing payloads runs as a background job — zero service interruption.

Audit Logging

Every encrypt and decrypt event is logged with timestamp, source IP, key ID, and payload hash. Export to stdout, file, or a syslog endpoint for SIEM ingestion.

Easy Deployment

Ships as a single Docker image and a Helm chart for Kubernetes. Configuration via environment variables or a YAML file. No code changes required in the upstream service.