- If procurement requires documented compliance evidence
- If SOC 2 / ISO 27001 and related cloud control attestations are strict procurement requirements, the vendor does not publicly document these certifications, which can impede approval.
- If the primary need is a comprehensive crypto-discovery and governance platform
- For large-scale cryptographic asset inventory, automated policy enforcement, and migration orchestration across thousands of applications, established crypto-agility platforms may be more appropriate.
- If the buyer requires extensive third-party reviews and enterprise references
- Absence of accessible listings on major review platforms and limited public case studies will make independent validation more difficult.
- If brand-reputation ambiguity is a concern
- A similarly named consumer brand has a public review history that may be encountered during diligence; organizations should confirm the contracting entity and product scope to avoid confusion.
- Limited public technical transparency
- Public materials provide high-level descriptions but limited detail on specific PQC algorithm implementations, key management design, hybrid modes, certificate integration, and performance characteristics.
- Statements that align with NIST post-quantum cryptography activities are present in marketing language; procurement should validate claims against specific NIST publications and algorithm mappings.
- Security and compliance disclosure gaps
- No public SOC 2 or ISO 27001 certifications were identified; organizations should request current compliance documentation and security assessment summaries.
- Brand ambiguity risk
- Distinct similarly named consumer brands create potential for confusion; contract and entity verification are recommended.