Quantum-proof security
built for AWS

Better together

AWS provides world-class infrastructure. PRIVATE.ME provides a security guarantee that no single-provider cloud can offer by definition. Together, they deliver what neither can alone.

PRIVATE.ME does not run servers. Does not provide compute. Does not offer storage or networking. Every ACI deployment runs on top of existing cloud infrastructure — and AWS is the natural home.

When you deploy xStore, your XorIDA shares land in Amazon S3 buckets. When you run xCompute, your MPC nodes execute on EC2 instances. When xWall inspects traffic, that traffic flows through AWS networking. Every PRIVATE.ME deployment drives more AWS consumption, not less.

What AWS cannot provide

AWS invests heavily in security. AES-256, TLS 1.3, post-quantum hybrid key exchange, Nitro Enclaves, CloudHSM — all excellent engineering. But every one of these is built on computational assumptions.

Computational vs. information-theoretic

Computational security means an attacker would need unreasonable computing power to break the system. This covers AES-256, RSA, ECC, and the new lattice-based post-quantum algorithms (ML-KEM, ML-DSA). If a faster algorithm or more powerful computer appears, the guarantee breaks.

Information-theoretic security means an attacker with unlimited computing power — including quantum computers — still learns nothing. The guarantee comes from mathematics, not from computational hardness. XorIDA threshold sharing provides this guarantee: possessing fewer than K shares reveals exactly zero bits of information about the original data.

The harvest-now-decrypt-later threat

Nation-state adversaries are already intercepting and storing encrypted traffic today, waiting for quantum computers capable of breaking current cryptography. AWS addresses this with post-quantum TLS (hybrid ML-KEM key exchange). But ML-KEM is lattice-based — a computational assumption. If lattice problems turn out to be easier than expected, every stored communication is exposed.

XorIDA-split data is immune to this attack regardless of future breakthroughs. K-1 shares contain exactly zero information. Not computationally hard to extract — literally zero information to extract.

14 AWS services, enhanced

Each AWS service maps to one or more PRIVATE.ME ACIs. Your existing AWS infrastructure stays in place. ACIs add a security guarantee on top.

Tier 1 — Direct security upgrades

Tier 2 — Security layer additions

How it deploys on AWS

PRIVATE.ME ACIs deploy as containers, sidecars, or SDK integrations on your existing AWS infrastructure. No new accounts. No new VPCs. No architectural changes.

Deployment model

ACIs integrate at three levels depending on the use case:

Code examples

Integrating PRIVATE.ME ACIs with AWS services requires minimal code. Most operations are single-function calls.

xStore + Amazon S3

import { XStore } from '@private.me/xstore';
import { S3Client, PutObjectCommand } from '@aws-sdk/client-s3';

// Split secret across 3 S3 buckets in different regions
const store = new XStore({
  k: 2, n: 3,
  backends: [
    { type: 's3', bucket: 'shares-us-east-1',     region: 'us-east-1' },
    { type: 's3', bucket: 'shares-eu-west-1',     region: 'eu-west-1' },
    { type: 's3', bucket: 'shares-ap-southeast-1', region: 'ap-southeast-1' },
  ]
});

// Store — each share goes to a different region
await store.put('api-key-production', secretData);

// Retrieve — any 2 of 3 shares reconstruct the secret
const secret = await store.get('api-key-production');

xCompute on EC2

import { XCompute } from '@private.me/xcompute';

// MPC nodes on EC2 instances — replaces single CloudHSM
const mpc = new XCompute({
  nodes: [
    { endpoint: 'https://mpc-1.internal:3500' },  // EC2 us-east-1a
    { endpoint: 'https://mpc-2.internal:3500' },  // EC2 us-east-1b
    { endpoint: 'https://mpc-3.internal:3500' },  // EC2 eu-west-1a
  ],
  threshold: 2
});

// Compute on shares — no node sees the full input
const result = await mpc.evaluate(circuit, splitInputs);

xLink replacing ACM certificates

import { Agent } from '@xail/agent-sdk';

// Create DID identity — no certificates, no CA
const agent = await Agent.create();
console.log(agent.did); // did:key:z6Mk...

// Mutual authentication + encrypted channel
const channel = await agent.connect(remoteDid, {
  transport: awsTransport,  // Uses AWS networking underneath
});

// Send — V3 hybrid PQ (X25519 + ML-KEM-768)
await channel.send(payload);

AWS native vs. AWS + PRIVATE.ME

Side-by-side comparison showing what changes when you add the PRIVATE.ME security layer.

AWS Marketplace

PRIVATE.ME ACIs will be available on AWS Marketplace as SaaS products. Purchase through your existing AWS account, billed on your existing AWS invoice.

Procurement advantages

GovCloud & FedRAMP

PRIVATE.ME ACIs are designed for the most security-sensitive deployments. AWS GovCloud provides the infrastructure. PRIVATE.ME provides the information-theoretic guarantee.

Government deployment model

XorIDA shares distribute across GovCloud regions (us-gov-west-1, us-gov-east-1) for geographic redundancy while maintaining IT-security within the FedRAMP boundary. Air-gapped mode supports classified environments with QR-based share distribution.

Compliance positioning

Add quantum-proof security to your AWS

Talk to Sol, our AI platform engineer, to design a deployment architecture for your AWS environment.