# Post-quantum encryption for your bids | ReqFit Attackers record encrypted bid traffic today to decrypt it once quantum computers arrive. ReqFit now supports post-quantum encryption. Why it matters. URL: https://reqfit.com/blog/post-quantum-encryption-bids --- ## The short version - There is an attack on encrypted data that does not need to break your encryption today. Attackers record encrypted traffic now, store it, and wait for the technology that will unlock it later. - That technology is quantum computing, and it is expected to break most of the encryption protecting internet traffic today. The UK government has told every organisation to be fully migrated to quantum-resistant encryption by 2035. - Bid content is a prime target, because much of it stays sensitive for years: your pricing logic, your methodology, your supply chain, and your client's information. - ReqFit connections now support post-quantum encryption, a new generation of encryption designed to stay secure even against quantum computers. Your browser uses it automatically. - We deployed it deliberately, documented it plainly, and made it verifiable in your own browser in thirty seconds. Here is an uncomfortable fact about encryption: it can be broken retrospectively. We tend to think of security in the present tense. Your bid is encrypted when you submit it, nobody can read it, job done. But there is an attack that does not need to break your encryption today. It just needs to record it. The approach is called harvest now, decrypt later. An attacker intercepts encrypted traffic as it crosses the internet, cannot read a word of it, and stores it anyway. Then they wait. Not for a flaw in the encryption, but for the technology that will make the encryption irrelevant. ## The technology they are waiting for That technology is quantum computing. Without going anywhere near the physics, the practical point is this: a sufficiently powerful quantum computer will be able to break the mathematics that today's internet encryption relies on. Not weaken it. Break it. Nobody can say exactly when such a machine will exist, but expert estimates increasingly cluster in the early-to-mid 2030s, and they keep moving closer as the engineering improves. What security agencies agree on is that it is a matter of when, not if, and that the harvesting is happening now, precisely because the payoff comes later. On the day the technology matures, every archive of recorded traffic unlocks at once. Data that was safely encrypted in 2026 gets read in the 2030s, years after anyone stopped thinking about it. This is why governments are not waiting. The UK's National Cyber Security Centre has published a [national roadmap](https://www.ncsc.gov.uk/guidance/pqc-migration-timelines) requiring every organisation to migrate to quantum-resistant encryption, with the heavy lifting through the late 2020s and full migration complete by 2035. The defence has to be in place before the harvesting, not before the decryption. By the time the machine exists, the damage to anything transmitted with old encryption is already done. ## Why your bids are exactly the kind of data at risk A fair challenge: does this really matter for proposals? A bid price from 2026 is worthless to anyone in 2035. If the sensitive content goes stale before it can be decrypted, what has actually been lost? Some of it goes stale. A lot of it does not. Think about what travels inside a serious bid. Your rate structures and margin logic, which change slowly and reveal how you price everything. Your delivery methodology, the intellectual property your business actually runs on. Your win themes, your key personnel, your subcontractor and supply chain arrangements. And woven through all of it, your client's information: their environment, their requirements, their constraints, sometimes their security arrangements. Much of that is as sensitive in ten years as it is today. Some of it, particularly in defence and critical infrastructure supply chains, becomes more sensitive over time, because pieces gathered across years accumulate into a picture. If you bid into government frameworks, defence supply chains, or critical national infrastructure, you can already feel the direction of travel. Security questionnaires get longer every year, and buyers keep pushing expectations further down their supply chains. Post-quantum readiness is on its way to becoming a standard question, because the national deadline guarantees it. The suppliers who do best will be the ones who never have to caveat their answer, about their own systems or about any tool in their chain. ## What we have done about it Connections to ReqFit now support post-quantum encryption. Post-quantum encryption is the new generation of encryption designed to stay secure even against quantum computers. The specific method we use went through a years-long global competition run by the US government's standards body, in which cryptographers worldwide tried to break the candidate algorithms, and emerged as the approved standard now being adopted across the industry. For the procurement teams who need the formal citation: TLS 1.3 with hybrid post-quantum key agreement, X25519MLKEM768, built on the ML-KEM algorithm standardised in FIPS 203. Two things about how we deployed it matter as much as the technology itself. First, it protects you automatically. Every major modern browser already supports post-quantum encryption and negotiates it without you doing anything. No setting, no premium tier, no action required. If a post-quantum connection is not negotiated, it will not be our end that declined it. Second, and unusually for a security claim, you do not have to take our word for it. > Open ReqFit in Chrome, open DevTools, and look at the Security tab. The key exchange reads X25519MLKEM768. That is post-quantum encryption, live on your own connection, verified by you in thirty seconds. We think a security claim you can check yourself beats one you have to take on faith. We use hybrid encryption, meaning the new quantum-resistant method runs alongside the strongest current method on every connection, so security never rests on either one alone. And it runs on Google Cloud's global infrastructure, behind the same load balancing and Cloud Armour protection Google uses to defend its own services against denial of service attacks. This was a deliberate decision made at our infrastructure, years ahead of any requirement, because the bids our customers upload deserve protection scoped to how long their contents stay sensitive, not just to today. ## In writing, because that is where security claims count Anyone who has completed a supplier security questionnaire knows the difference between what a system happens to do and what a provider commits to. A commitment is documented, precise, and quotable. So alongside the deployment, we have written it down. Our [security page](/security) states exactly what is protected, by which method, at which layer, and against which threat, in wording deliberately built to be lifted straight into a security response. When your client asks about encryption in your supply chain, and increasingly they will, your answer about ReqFit is two sentences, already written, and verifiable by the person asking. That is the standard we think bid teams should hold every tool to. We set out the full checklist in [The data security questions to ask of any AI bid tool](/blog/ai-bid-data-security), five questions to ask of any AI tool before trusting it with a confidential bid. This deployment is our answer to the first of them, taken as far as current standards allow. ## Where this fits in how ReqFit treats your documents Post-quantum encryption protects your proposal on its way to us. The rest of our security model governs what happens when it arrives, and it follows one principle: your document is something to process, not something to keep. Your proposal is processed in memory and deleted once your report is delivered. It is never used to train any AI model, because the terms we hold with our processor prohibit it. Processing is automated, with no human review, and our support staff have no access to your document content. CASM Labs, the company behind ReqFit, is Cyber Essentials certified under the UK government backed scheme, and our full security detail, including sub-processors and your data rights, is published for anyone to read. Bids are trust documents. They carry your client's information and your own hardest-won thinking, and they exist to prove you can be trusted with more. The tools you use on them should meet the same bar. We built ReqFit to clear it, today and for the decade of bids still to come. Secure today, and tomorrow.