Trust centre
Built for confidential files, and for the computers of the next decade.
Nebraska PR handles passports, licences and shareholder records for high-profile clients. This page sets out, plainly, what protects them.
- Transport
- TLS 1.3
- At rest
- AES-256
- Document links
- 5 min
Hybrid post-quantum key exchange
Encrypted storage and backups
Signed, single-purpose, expiring
Standards in force
Quantum-resistant key exchange
Our sessions negotiate a hybrid key agreement: the classical X25519 curve combined with the ML-KEM-768 lattice scheme standardised in NIST FIPS 203. A future quantum computer breaking the classical half still leaves the lattice half unbroken — and a session recorded today cannot be decrypted later.
Encryption at rest
Files, stage records and case metadata are encrypted with AES-256-GCM before they touch durable storage, with keys held separately from the data and rotated on schedule.
No public document links
Client uploads go to private storage. There is no permanent URL to guess or forward: access is issued as a signed link that expires in five minutes and only opens the single file it was issued for.
Least standing access
A consultant sees the files assigned to them; the desk sees the desk. Administrative rights are held by named people, not shared accounts, and every read of a document is logged against the file.
Auditable stage trail
Every stage closure records who closed it, when, and with what note. The trail is append-only from the case engine and is the version we hand over in a dispute.
Data minimisation
We collect what a government process needs and nothing more — no passport copies kept after a file closes, no marketing profiles built from case data.
Why quantum
A passport copy has a thirty-year life. The hardware does not have to break today.
Traffic recorded now can be decrypted later, once a cryptographically relevant quantum computer exists. For a firm holding identity documents, that is the risk worth designing around first — not the risk of an attack this quarter.
That is why every session negotiates a hybrid handshake rather than a purely classical one, and why we track the NIST post-quantum standards (FIPS 203 for key encapsulation, FIPS 204 for signatures) as they move from publication into the libraries we depend on.
Encryption is the floor, not the whole answer: the controls above — private storage, expiring links, scoped consultant access, an append-only stage trail — are what stop a document being read by the wrong person in the first place.
Document lifecycle
- 01
Collected
Only the documents the open stage requires, uploaded by you into a private vault.
- 02
Stored
Encrypted at rest, indexed to one file, visible to the consultant on that file.
- 03
Retained
Kept for the statutory period the government process requires, then reviewed for deletion.
- 04
Deleted
Purged on request where no retention obligation applies, with written confirmation.
Need our security statement?
We complete vendor questionnaires for corporate and government clients, under NDA.