Quantum transition
Long-duration sensitive data needs protection before cryptographically relevant quantum systems arrive, not after an attack can be detected.
Harvest-now riskSecure communications for the quantum era
Communications that reveal less.
Haechi is building an enterprise network platform that separates identity from connection activity, reinforces tunnels for the post-quantum transition and adapts safely to hostile networks.
Engineering preview. Advanced privacy and adaptive-transport capabilities remain subject to independent review and measured release gates.
EndpointDevice attested
AccessCapability issued
GatewayLON · healthy
Identity at gatewayNot retained
Key posturePQ reinforced
TransportDirect / adaptive
Designed for
Enterprise
Government contractors
Critical infrastructure
High-assurance teams
The security gap
Encryption alone does not hide the whole story.
Modern adversaries target long-lived cryptography, traffic metadata and centralised identity systems. Haechi is designed around all three pressure points.
Metadata exposure
Timing, volume, routes and protocol fingerprints can reveal structure and intent even when an attacker cannot read the payload.
Traffic analysisCentralised trust
Identity-linked gateway sessions and broad provider logs create high-value correlation points for compromise, coercion and insider risk.
Correlation risk
One integrated platform
Three engineering pillars
01
Post-quantum transition
Reinforce proven tunnels without a reckless rewrite.
A proven, conservatively chosen data plane stays in place while a post-quantum key exchange continuously refreshes the keys protecting it. Control-plane cryptography follows standardised, interoperable algorithms, and a required reinforcement that cannot be negotiated fails the connection rather than quietly downgrading it.
02
Privacy-separated access
Verify entitlement without handing identity to the gateway.
Enterprise identity stays in the identity plane. Short-lived connection capabilities are designed so regional gateways can admit an authorised session without retaining a durable user identity.
03
Adaptive transport
Respond to network conditions inside strict policy bounds.
Direct mode is the stable baseline. Approved protected transports, bounded traffic shaping and signed route policies can be activated when operating conditions require them.
System architecture
Five layers. Explicit trust boundaries.
Explore how a connection moves from enterprise identity to protected egress without collapsing every responsibility into one privileged service.
Layer 01 · Endpoint
A policy-controlled agent on every device.
The Haechi agent is the only component that coordinates tunnel state on a device. It sequences enrolment, key reinforcement, DNS protection, kill-switch enforcement and signed updates behind native platform adapters, holding no ambient privilege of its own.
- Hardware-backed device keys where supported
- Windows, macOS, Linux, Android and iOS
- Fail-closed networking with rapid rollback
Engineering spine
The security properties come from the seams.
Encryption and identity are solved problems. What decides whether a system actually protects anyone is the spine that joins them: which component learns what, what happens at each boundary when something fails, and which guarantees survive a compromise. That spine is Haechi’s, and it is where the engineering effort goes.
Every dependency sits behind a boundary Haechi owns, is pinned to a reviewed version, and is replaceable without changing product behaviour. No single component is trusted to hold the security property on its own.
Integration boundaryOne adapter per dependency
Trust separationIdentity never reaches the gateway
Failure behaviourDeny by default, fail closed
Cryptographic postureNo silent downgrade
Telemetry boundaryProhibited fields cannot cross
Release evidencePinned, reviewed, reproducible
Assurance before adjectives
Security claims should come with evidence.
Haechi’s release process treats measurable assurance as part of the product, not a document created after development.
Independent review
External cryptographic design review, penetration testing and resolution of production-blocking findings.
Minimal telemetry
No payload collection, durable user identifiers or raw DNS activity in the Global Intelligence Mesh.
Signed supply chain
Pinned inputs, reproducible CI, software bills of materials and verified signatures from build to deployment.
Controlled adaptation
Models and network policies are evaluated, versioned, signed, constrained and reversible.
Deployment flexibility
One architecture, three operating models.
Managed
Multi-tenant SaaS
Regional service with tested tenant isolation, managed upgrades and dedicated gateway pools where required.
- Fastest route to pilot
- Enterprise identity federation
- Managed availability and updates
Dedicated
Enterprise & CNI
A single-tenant control and data plane in a customer-approved account or region, with customer-controlled keys.
- Isolated infrastructure
- Customer-managed trust roots
- Contract-defined telemetry boundary
Restricted
Disconnected network
Self-contained operation with signed offline release, policy and intelligence promotion workflows.
- No public SaaS dependency
- Offline update verification
- Controlled export of health data
Delivery sequence
A working product at every phase.
The direct enterprise network ships first. Advanced privacy features move through isolated engineering and assurance gates before they can affect production traffic.
-
01
Secure network foundation
Managed encrypted transit, gateway, endpoint agent and kill switch.
-
02
Enterprise control
Federated identity, policy, tenancy and dedicated deployment.
-
03
Privacy & PQ transition
Unlinkable access prototype and post-quantum key reinforcement.
-
04
Adaptive transport
Protected-network adapters and bounded traffic-shaping profiles.
-
05
Intelligence & hardening
Signed adaptive policy, red-team validation and production readiness.
Enterprise pilot
Define the environment. Test the evidence.
Tell us what you need to protect, where it must run and which assurance requirements matter. We’ll shape a controlled pilot around a documented threat model.
01
Discovery
Architecture and threat-model
workshop.
02
Deployment
Bounded pilot in an approved
environment.
03
Evidence
Measured results and an
explicit risk register.