Nocturne Entropy

What people are actually buying

AES-256-GCM is free. It is in your standard library, it is correct, and it has been correct for a very long time. Nobody in this market is selling you the cipher, and a vendor whose pitch opens with the strength of its encryption is charging you for something you already have.

What has a price is custody and paperwork: who generates a key, who can rotate it, who can authorise a decrypt, who can revoke it when a contract ends, and whose name goes in the answer when a bank’s third-party risk team asks. The commercial layer — IronCore, Ubiq, Skyflow, Evervault, Thales CipherTrust, Fortanix, Protegrity — sells key lifecycle, per-tenant isolation and compliance scope reduction around a thin SDK. The free layer — the AWS Encryption SDK, Tink, libsodium, Themis — sells correctness, which is why it costs nothing.

Paid-layer pricing is mostly unpublished. IronCore is the exception at $1,954 a month plus $25 per tenant; Basis Theory starts at $995; VGS Starter is cited around $1,000. Entropy is priced by production environment — development, staging and CI free, the unit meters production — and never by tenant, key or operation, because every one of those meters bills you for the behaviour the product exists to encourage. AWS KMS is the published version of the alternative: $1 per key per month, capped at $3 once rotation is on, plus $12.00 per 10,000 RSA GenerateDataKeyPair calls against $0.03 per 10,000 symmetric requests. That meter gets worse exactly as your key population grows, which is to say exactly as your isolation improves.

What we charge is not on this page, and the reason is not coyness. An individual developer, a mid-sized bank and a payment network are two orders of magnitude apart in what this is worth to them and what it costs us to deliver, and a single number here would be a lie for at least two of the three. What we will publish is the shape of the meter, what it never counts, and what the top of the range obliges us to do — all three are further down, and all three are checkable.

Entropy adds four things to the envelope pattern rather than reinventing it: a keystore abstraction that reports the backing it obtained, a re-wrap pipeline for ciphertext already at rest, a signed crypto inventory emitted by your build, and a published wire format with a decryptor that does not depend on us. It is not a vault or a proxy — your plaintext has nowhere here to go — which forgoes the PCI scope-reduction story VGS and Evervault sell well, and equally keeps us out of your payment path on a day when we have an outage.

The abstraction that does not lie

Ask a cross-platform key-storage wrapper where your key lives and you get one of two answers: a handle, or an exception. What you do not get is the fact you needed — whether the key sits in hardware you can name, in hardware you are merely trusting an API about, or in a file. The open wrappers either degrade to software silently or throw, and neither survives an assessor asking what share of your fleet is actually hardware-backed.

The platforms differ enough that a single boolean is wrong three ways:

• Android. StrongBox is a discrete secure element; the TEE is not; software is neither. StrongBox is on select devices only, is slower, and Google advises against it for most applications.
• iOS and macOS. The Secure Enclave does P-256 and nothing else: no RSA, keys bound to the App ID, wiped by a clean install, absent from the simulator. Keychain with an accessibility class is weaker, and sounds similar.
• Windows. A CNG key storage provider backed by the TPM through the Microsoft Platform Crypto Provider, or the Microsoft Software KSP, which is a file with an access control list on it.

Entropy grades what it obtained, per key. Hardware-attested means a chain was verified server-side, which is not a formality: the Android attestation root began rotating on 1 February 2026, so a verifier must accept both roots and not hard-code chain length; the attestationChallenge must carry a fresh server nonce, since a chain from a clean device can otherwise be relayed to cover a compromised one; and hardwareEnforced is the authorisation list that means anything. Hardware-claimed means the API asserted backing and could not prove it — the honest label for much of any real fleet, and where the interesting failures live, including iOS reporting NSFileProtectionComplete on a passcode-free device while leaving the file readable.

This belongs in a compliance artefact rather than an exception log, because nobody reads exception logs and because the claim made downstream is about a fleet, not a device. “Hardware-backed key storage” in a questionnaire is a percentage, whether or not the person answering knows it. Entropy makes you look at the percentage before you write the sentence.

The wrapping layer is the quantum problem, not the data layer

The symmetric layer is fine. A 256-bit AES-GCM data key is not what a future quantum computer takes apart, and a vendor implying your file bodies need re-encrypting is either confused or selling a migration. The asymmetric layer above it — the RSA or ECDH wrapping those data keys — has a shelf life, and is the part absent from most people’s mental model of their own storage.

That distinction sets the size of the job. Harvest-now-decrypt-later is a real threat model for data with a long sensitivity horizon and nearly irrelevant at ninety days. NIST IR 8547, still a draft, would deprecate RSA, ECDSA and ECDH after 2030 and disallow them after 2035; CNSA 2.0 requires new national security system acquisitions to comply from 1 January 2027; OMB M-26-15 makes cryptographic agility a condition of federal migration plans due October 2026. None of those asks you to rewrite ciphertext. All ask about the wrapping layer.

Entropy does hybrid key agreement with X25519MLKEM768 and wraps with ML-KEM, standardised as FIPS 203 in August 2024 — hybrid rather than pure post-quantum, because a weakness found in a young lattice scheme should not leave you worse off than the construction you replaced. This is the least original part of the product; the choice is the consensus one.

The pipeline is the part nobody else ships. Inventory reads object headers, not bodies. Campaigns run in order of sensitivity horizon. A re-wrap unwraps the data key under the retired wrapping key and rewraps it under the new one, leaving the ciphertext body untouched, which is what makes it tractable at petabyte scale. Out comes a coverage percentage per key scope — what an auditor asks for, and what “inventory your ciphertexts for re-encryption”, universal advice with no product behind it, has never actually produced. Entropy can also be told to fail rather than downgrade: AWS is removing pre-standard Kyber from its endpoints during 2026, and a client advertising only the old draft group falls back to classical TLS without raising an error.

What FIPS means and what it does not

NIST does not recognise the phrase “FIPS-compliant”. It is a self-assertion, not a status. What exists is a CMVP certificate with a number, held by a named organisation, covering a specific module version in a specific operational environment, and meaningful only while that module runs in approved mode. Every part of that sentence is load-bearing, and claims collapse on each part.

A CAVP algorithm certificate is not a module certificate; it records that an implementation passed known-answer tests, which is necessary and nowhere near sufficient. The certificate often sits in an upstream library’s name rather than the vendor’s, which is fine until a contract requires it in yours. A validated module outside approved mode does not count. Certificates are pinned to code and environment, so a vendor that ships fast and validated once holds one describing software it no longer distributes. Virtru’s trust centre discloses this class of nuance voluntarily, and it reads as weakness only because so few others do.

The hard date has passed. On 21 September 2026 the remaining FIPS 140-2 certificates moved to NIST’s Historical list. They stay visible and stay usable for systems already relying on them, and they stop satisfying procurement for new ones. FIPS 140-3 is the live scheme and there is no longer a second answer: a vendor page still describing a 140-2 certificate as current is describing a record rather than a status, and an answer that passed a questionnaire last year is a finding on the next one with nothing about the software having changed.

Our own position, plainly rather than arranged: the validated provider Entropy ships in FIPS builds is in the CMVP queue. It is not certified yet. The Modules In Process entry is published inside the product, alongside the certificate numbers of the platform modules we call into where those do the work. The queue is the reason and not an excuse — the longest figure anyone has tracked for 140-3 is 728 days, against 388 to 402 for the scheme it replaced, and that measurement is from 2023–24 while the current published estimate runs twelve to eighteen months, so treat it as an order of magnitude rather than a date. For a CSPRNG the bottleneck is narrower still, because the SP 800-90B entropy-source assessment is where reviews of software modules stall. If your contract requires a certificate in your own organisation’s name today, Entropy is not the answer yet and we will say so on the call rather than in month four; that is the business SafeLogic, wolfSSL and DigiCert are in, and their pricing reflects a real cost — NIST cost recovery at $16,000 for Level 1 and $19,000 for Level 4 from 1 January 2026, $3,000 to $4,000 more when review runs long, a full ESV submission on top of that, and the lab fee, which nobody publishes and which SafeLogic will describe only as “well over $50,000 per module configuration”. A certificate in your name rather than ours is further down this page, because it is the obligation this product is actually sold on.

Searchable encryption and the queries you are about to lose

Encrypting a field stops it behaving like a column. Equality, range and text matching break. The optimiser can no longer reason about it. Foreign keys and referential integrity break wherever a shared identifier is obscured, pushing relationship validation into application code that was not written for it. This is the most common reason a pilot never reaches production, and it is found in week six rather than week one.

There are two workarounds and each costs something specific. Deterministic encryption preserves equality and leaks equality and frequency along with it — on a column with few distinct values, close to publishing the column. Blind indexes preserve lookup by storing a keyed hash alongside, which means an extra column or table per searchable field, key management for the index key, and a re-index whenever the search semantics change.

MongoDB Queryable Encryption is the fairest benchmark, because its constraints are documented rather than discovered in production: encrypted field names and query types immutable after collection creation, contention factor fixed, _id not encryptable, no views, time-series, capped collections, TTL or unique indexes, and no Atlas Search. Entropy is not better than this by magic. It supports deterministic fields and blind indexes, tells you which queries each choice keeps and which it removes, and declines to call the trade anything else.

Then the migration, which is the real project and never in the estimate. Data written before a field was encrypted does not match queries issued afterwards, because the driver now sends a different shape. Backfill is mandatory, and on a large table it is the schedule. Entropy ships a backfill runner with per-field completion reporting, so you can watch the job converge and pause it; that is useful, and it does not give you back the two weeks. The advice that follows costs us deals and is still correct: choose the fields before the product.

What the largest deployments oblige us to

Most of this page describes a product. This part describes a contract, because at the top of the range the two stop being the same thing, and because the arithmetic up there does not survive being explained as a bigger licence.

Start with the number that makes the case hard, since you will find it anyway. Keyfactor’s median contract is $175,400 a year. The highest point anyone has observed in machine identity is $275,406, and that one is CyberArk as a whole company rather than a product in this layer. The public record agrees: the largest US federal award matching “encryption software license” is $1,409,420 across three years, and the largest matching “key management service” is $8,787,326.96 across 5.93 years, which is about $1.48 million a year. Priced as a cryptographic library, this category has a ceiling around $1.5 million and that is the end of the argument. A top-tier Entropy agreement is a multiple of all of those, and anyone telling you the difference is features is selling you something. The difference is obligations, and they are specific enough to put in a contract:

• A CMVP certificate in your organisation’s name, kept Active at our cost. Not a letter from us citing ours. A FIPS 140-3 certificate number issued to you, listing your operational environments, re-validated when our code changes, extended when you add an environment, with the SP 800-90B entropy-source validation behind it. We absorb the queue and the fees — NIST cost recovery of $16,000 to $19,000 from 1 January 2026, $3,000 to $4,000 more on extended review, a full ESV submission, and a lab fee SafeLogic will characterise only as “well over $50,000 per module configuration”. Since 21 September 2026 this is not an upgrade; it is the difference between bidding and not bidding.
• Named responsibility for the migration, with an end date in the contract. Inventory of the cryptography in your estate, the plan, execution of the re-wrap over long-horizon data, and reporting in a form you can file with your regulator — performed, not advised. The market prices this work with no product attached at all: Deloitte bills the NIH $2,282,360.80 for one year of cryptographic inventory and logging, and ShorePoint bills the Department of Education $1,804,236.00 for the same scope over the same year. Neither is a contract we could hold, for reasons set out in the limits above; both price the work.
• The root-key ceremony as a witnessed, audited event, four times a year. Script published in advance, M-of-N quorum of shareholders, independent witnesses, video, a signed transcript an auditor will accept, your role-holders trained and attested by us, and the ceremony script itself sent out for external review — which is a thing that actually happens: Trail of Bits audited Calyx Institute’s HSM provisioning ceremony scripts in January 2026 as a discrete engagement. The benchmark for what this looks like at full scale is the DNSSEC root key: 32 serving Trusted Community Representatives from 22 countries, two facilities, roughly four ceremonies a year.
• An independent cryptographic audit every year, paid by us, published whole, with you naming the auditor. The entire report, unfixed findings included, from a firm you pick off an agreed list. Trail of Bits publishes level of effort rather than rates, and its 2026 cryptographic engagements run six to eight engineer-weeks each, so a full audit plus delta reviews across a year is a standing commitment rather than an event. Your own customers get to read the result, which is the part worth more to you than to us.
• A 5x super-cap on the security limb, your data outside the general cap, and no ceiling on the IP indemnity. Entropy compiles into your shipped product, so your downstream liability runs through our code — which is why the IP indemnity here is uncapped rather than gracious. The market on the general limit is not divided: Common Paper, across 16,140 signed agreements from 2,223 companies, finds 99% carry a multiplier and 96% set it at 1x.
• A security-fix clock with credits that are not your only remedy. A critical vulnerability acknowledged in fifteen minutes, a fix or a documented mitigation inside an agreed window, and a service credit of 25% of the monthly fee for each day past it — accrued automatically from our own tracking rather than on a claim from you, and expressly not your sole and exclusive remedy. The clause matters more than the percentage: AWS requires a credit claim by the end of the second billing cycle, Cloudflare requires notice inside five business days, caps cumulative credits at six months of fees and calls them the sole and exclusive remedy — and contract reviews find 60 to 80% of earned credits never claimed, because claiming is manual. The rate and the absence of a cap are published here; what counts as unplanned and where the hour starts are defined in the contract — a credit whose trigger only we could read would be the old trick in new clothes.

And three things that are not on that list, because they are not ours to charge twice. Source-code escrow with Independent Build & Replicate verification is a property of the Nocturne platform, priced once across the portfolio: our own contract research puts the entire nine-product escrow programme at $60,000 to $150,000 a year, a figure that does not survive being billed separately against each product that sits on the same deposit. The named engineer on duty in each of three time zones, with the fifteen-minute acknowledgement above, is one rota covering the suite rather than one per product; a single round-the-clock line costs $1.1 to $1.8 million a year to staff, and if you were billed for three of them you should ask why. Works-council clearance and the DORA Article 30(3) package are the same shape: you have one works council and one register of information, and you should be charged for one. Saying this costs us more than it costs you, and it is still the right way round.

And one thing that is not an obligation at all, though it was tempting. Adding a newly standardised NIST algorithm by configuration rather than by release is an architectural choice that lowers our future engineering cost. It is not a service performed for you, it belongs in the capabilities above where it already sits, and it does not appear in a contract as a line with a price on it.

Now the part that makes all of this fragile, before you find it yourself. Of everything above, exactly one obligation is something any market prices — the unlimited keys, rotations and operations, which you can check against AWS KMS in about four minutes. Every other line has no published comparator anywhere, because no market sells it. Close to three-quarters of a top-tier agreement is therefore priced against nothing external at all. We know that is the weakest thing on this page. The defence is not that the total is right; it is that every line above is separately specified, separately costed and separately terminable, so you can strike any one of them and we will tell you exactly what comes off the number.

The same goes for the comparison you are already making. Forty Azure Cloud HSM modules cost $1,681,920 a year on Microsoft’s own published API price, and a top-tier Entropy agreement is close to twice that. Our answer is that the modules are an addend rather than an alternative — forty HSMs do not inventory your estate, re-wrap your ciphertext, hold a certificate in your name or run a ceremony — and that Microsoft’s price list already concedes the underlying point: $6.06 an hour against $4.85 for Dedicated HSM in its government regions, a premium of about 25% for isolation alone. That is a hyperscaler pricing the property we are selling, on its own page, in public.

One last thing, and it is the line most likely to become a fight. Migration responsibility is the single largest component of a top-tier agreement, it is a service rather than a product, and by its nature it decays: when your migration completes it should cost less, not the same. A vendor who does not write that line’s lifetime and its replacement into the contract on the day it is signed is arranging an argument at the fourth renewal. We would rather have it now, in writing, while both of us still think the other is reasonable.

How it is priced, and why

The unit is one production environment, and every alternative meter for this layer is a dead model you can check against a published price. Per key is the one the market actually runs: AWS KMS charges USD 1 per key per month and caps it at USD 3 once automatic rotation is switched on — a meter that charges the most for the safest behaviour in key management, and gets more expensive as your key population and your discipline grow together. Per operation is worse: the step from USD 0.03 to USD 12.00 per 10,000 requests on the RSA path is a four-hundredfold price on choosing the stronger algorithm, which teaches buyers to use it less. Per device is the wrong denominator for a cryptographic product altogether — a per-device rate quoted in this category almost always belongs to an endpoint product. Per tenant is IronCore’s USD 25 on top of USD 1,954 a month, which prices isolation as a cost centre when isolation is the control being bought. And seats are a meter for tools people read; nobody reads their way into weaker cryptography.

What the environment unit buys you that the others do not: development, staging and CI are free — the unit meters production, and rehearsal on your own infrastructure is never a second invoice. A vendor who meters non-production environments is charging for exactly the behaviour a cryptography vendor should demand — more testing, more rehearsal of the migration, more failure on machines that do not matter. Rehearsal environments cancelled for budget reasons are how a migration arrives at its deadline unrehearsed, and the migration is the line above that we call the largest component of the whole agreement. The meter on production is checkable before you talk to us: count the environments that serve real data, and the qualification gate above tells you whether the top tier is aimed at you at all. In the contract the unit is the count of named production environments for the month — no fractional counting, and where a category could be argued, the contract decides.

There is no figure on this page, and the reason is stated here rather than left for the call. The distribution of what buyers pay in this layer runs from a published SDK licence at USD 12,000 to 23,000 a year to Keyfactor’s median contract at USD 175,400 to federal awards around USD 1.48 million a year — roughly two orders of magnitude between the ends, all of it for software in the same category. A single number printed on a page is a lie at one end of that distribution and an insult at the other. What is published instead is the unit, what it never meters, the checkable gate, and the composition of obligations the top tier carries; the figure is calculated from that composition in a commercial proposal, from the obligations rather than from your budget.

Leaving: the exit path, written down

Twilio acquired Ionic Security in 2021 and said at announcement that Machina would take no new standalone customers. Everyone who had embedded that SDK into shipped software then owned a ciphertext migration they had not planned for. It is the most-cited cautionary story in this category and it is the right one: the risk in a client-side encryption vendor is not usually that they are breached, it is that they are acquired.

So the format is published and versioned, and the header self-describing — version, wrapping scheme, key scope identifier, and enough structure that someone who has never read our documentation can parse it with the specification in front of them. That specification is a resource the MCP server hands your agent verbatim. It is not under NDA, and it does not change status on the day you stop paying us.

Every release ships a standalone decryptor: one binary, no network access, no dependency on any code of ours beyond itself, buildable from source. The test we ask prospects to run is the obvious one — export a bundle, carry it to a machine with nothing of ours installed, pull the network cable, get the plaintext back. Where you hold roots in your own KMS or HSM, we never held the key material to begin with and the exercise is purely mechanical.

Key custody on exit follows the same principle: escrow you run is yours and exportable, and per-tenant roots held by your customers stay with them. No step in that path requires us to be cooperative, responsive or still trading, which is the only form of portability guarantee that means anything — and it goes in the contract rather than on this page, because a promise living in marketing copy is worth roughly what Machina’s customers got for theirs.