In these post-Snowden times a lot has changed. Big picture stuff, like politicians legislating to curtail intelligence agency capabilities (or not). And smaller stuff. Like a ‘post-quantum’ encryption startup no longer being laughed out of meetings when they pitch their business.

While U.K.-based PQ Solutions is technically a startup the team has actually been plugging away on their post-quantum encryption and data access software for some six years. The underlying encryption algorithms they’re using date back even further, to the 1970s — aka the (established but not widely used) McEliese cryptosystem.

What’s changed now is the climate around data security, says PQ CEO and co-founder Andersen Cheng. So the notion of selling encryption that’s intended to be futureproofed against cracking by quantum computers now, before anyone has built a quantum computer, doesn’t sound quite so crazy.

“We have been laughed at by all the VCs,” says Cheng. “People were still laughing at us up to 12 months ago. People were showing us the door. I have been shouted at by people saying ‘stop scaremongering; it’s science fiction, it will never happen’. But the whole world has changed completely in the last seven, eight months. Because now Google has come out saying it’s building [a quantum computer]. Microsoft is saying it’s building one. All the good and bad countries are building one.”

“[The McEliese cryptosystem] came out at the same as [the widely used encryption system] RSA, in 1978. It was never adopted because during that time desktops did not even have hard disks. So people thought there’s no way a computer could crack RSA so no one adopted the McEliese system. And it also has some drawbacks. Now we have three patented improvements on top to make it truly NP-hard. And… semantically secure,” he adds.

“The original McEliese system was NP-hard, was post-quantum secure, but it was not semantically secure. So there was a slight bias that people could guess when you look at a digit. The holy grail is you can’t tell whether it’s right or wrong. But the original parameters you could still have a slight bias there. So that’s something that we have got rid of.”

Cheng sums up PQ’s informal mission as: “protect the world’s information before it’s too late”. It’s not just intending to sell its McEliese-hardened post-quantum encryption; it’s aiming to offer a security layer that can be applied in multiple ways, across different products and industry sectors.

This means a portfolio of products, including a secure messaging app called PQ Chat, a “video selfie” authentication tech for detecting (and thus preventing) man-in-the-middle attacks, and a key splitting technology for managing access to data via consensus authentication (i.e. requiring multiple key fragment holders to agree to any decryption). Its core ‘post-quantum’ thinking runs through all the products, coupled with a focus on data access and compliance for its target enterprise customers.

“We have a number of these ideas and products,” says Cheng. “Our company is beyond just encryption. Whatever we want to develop now — whether it’s products or solutions for customers — it has to be PQ. Because otherwise there’s really no need, or no point doing it anymore. Because when [quantum] computers come in it will just wipe everything out.”

He sees particular (and timely) potential for the key splitting technology — which PQ calls Quorum — to offer a way forward for governments now grappling publicly with maintaining overreaching surveillance capabilities as adoption of strong encryption grows. Deliberately weakening encryption isn’t so tenable when your actions are no longer cloaked in perfect secrecy. (Not to mention also being loudly condemned as stupidity.)

A third way for this ‘surveillance vs security’ loggerheads could be to use “sidedoors”, argues Cheng — meaning a system whereby encrypted data can only be decrypted when multiple stakeholders, who each hold a piece of a fragmented key, all agree that access should be granted. For example key pieces could be held by the service operator, the regulator, a court that signs off surveillance requests, the government agency wanting the information, and even the account holder themselves.

Consensus authentication would offer an alternative to government-mandated backdoors in Internet services. So instead of a single ‘master key’ that poses privacy or data compliance risks by allowing unchecked access, decrypted data can be managed and safeguarded by third party access being locked to multi-stakeholder consensus.

“It would address that master key problem,” says Cheng. “Our solutions can work for the government. The NSA came out the other week saying they do not want a ‘golden key’. They want to encourage the regulators and the industries and even the account holders all to have a fragment. So it’s very similar to what we’re saying.”

“What we’re doing is to translate the physical thinking that the police cannot come to visit me in my house at will. But if they have a court warrant then I have to comply,” he adds.

He also argues that existing multi-factor authentication systems that do not split up each of the factors themselves remain at risk from hacking, since the entire biometric (for instance) is still in play and thus that honeypot of data remains vulnerable to theft/compromise. Whereas fragmenting every authenticating factor means “you don’t have a complete picture [so] no quantum computer can crack it”.

“If you have a normal multi factor, multi key, they are still the three keys that people can try. If we only have fragments no one in the world can recover it, including myself,” he notes. “It’s this fragmentation which is the key — which is the solution to the problem.”

PQ is not the first or only company to come up with key splitting as a way to tighten the security screw but Cheng argues it’s PQ’s own multi factored approach — and its focus on integrating its thinking with business processes — that makes it stand out here.  “People already do some kind of key splitting on the server level, and they use hardware — and all the other stuff — but what we do is to blend it into a business flow, which is entirely different.”

The startup has just been through the Barclays TechStars fintech bootcamp program in London, presenting at their latest Demo Day today. Thus far, the team has been bootstrapping the business, using money raised by two of the co-founders from a prior startup they sold, as well as taking in a small amount of investment from four super angels. It’s now aiming to raise between £1 million and £2 million more to expand the team and follow through on all the calls Cheng says it’s getting as security escalates up the enterprise agenda.

“For most startups they would be now at the stage of searching for clients, and trying to sign them and so on. But we have been inundated with enquiries… These are all very big firms. We just don’t have enough people to follow up and follow through. So we have a slightly different problem from other startups.”

On the competition front, in the messaging space Cheng names Silent Circle and Wickr as rivals but again he argues there’s a difference of emphasis, with PQ’s sales pitch being b2b from the start, multi-sector focused, and concerned more broadly with data access compliance needs, controls and processes, rather than just aiming to offer privacy peace of mind via highly robust encryption.

“If you talk to all the banks and insurers it’s all compliance they are after. It’s all about security and privacy and compliance. It’s not about secrecy,” he says. “We are actually offering a complete solution for enterprises. So this is why I would want to claim we are unique in that respect. All the other companies only sell just one product. They do not sell a solution.

“We have spent a long time working in banking, insurance and all the other sectors and we focus a lot on the processes, in order to offer solutions.”

Despite this enterprise focus, PQ’s intention is not to become a managed services software house. It’s aiming to scale up by choosing what Cheng terms an “anchor client” for each sector and customizing its software for that business, before going on to sell a standardized solution — derived from the work with the core client — to other companies in the sector.

In banking, PQ is working with Barclays as its anchor client, having gained “high level” access to the bank via the accelerator program; in insurance Cheng says it has a “large company” selected although he’s not disclosing who at this point; in law it has a Magic Circle law firm. It is also working with certain bits of the U.K. government (as you might suspect) and doing trials with NATO. PQ also counts the former technical director of the NSA, Brian Snow, as a technical advisor.

In terms of scaling up from here in on, PQ is focusing on four main sectors. “In a year’s time I want to have done something for each of my anchor clients in each critical sector — so at least one client with some solutions in banking, some in legal, some in insurance. And some in cloud, in the cloud provision as well,” says Cheng. “Healthcare we can tackle but that really is… It’s a huge market but it’s huge bureaucracy there.”

Cheng says NHS Trusts have been making enquiries about PQ’s software — specifically seeking a fix for the problem of A&E staff WhatsApping each other as a path of least resistance option to try to quickly locate specialists or medicines. “There is potential in using something like PQ Chat for the medical world, so they can at least transmit data securely. These were genuine requests from the Trusts. But we just haven’t got time to address. But I think in a year’s time I will be very happy if I can really address the banking, insurance and legal.”

So there you have it: building a post-quantum encryption business that spans multiple verticals is one thing. Willingly walking into the entangling embrace of reams of red tape quite another.