Site directory

The paid product surface. Post-quantum certificate issuance, PKI engagements, CMMC readiness and the vCISO retainer. Pricing, contracts and the customer console live here.

• sanctumsecops.comApexCommercial site and product marketing
• login.sanctumsecops.comLoginIdentity entry point for every gated host
• kb.sanctumsecops.comKnowledge BasePublic self-service articles and the llms-full.txt export for retrieval
• web3.sanctumsecops.comWeb3sanctum-chain: evidence ledger, anchoring, SCN and chain-as-a-service
• qzt.sanctumsecops.comQZT Control PanelQuantum-safe zero-trust overlay operator surfaceRequires an identity check
• ecc.sanctumsecops.comEnterprise Control CenterMaster control for every Sanctum systemRequires an identity check
• admin.sanctumsecops.comAdminAdministrative console — folds into the ECCRequires an identity check
• soc.sanctumsecops.comSOCSecurity operations views — folds into the ECCRequires an identity check
• stage.sanctumsecops.comStageStage loader control panel and gate previewsRequires an identity check
• support.sanctumsecops.comService DeskCustomer service desk and ticket portal — BoldDesk-hosted, CNAME onlyRequires an identity check
• investors.sanctumsecops.comInvestor RoomCapital-raise prospectus, diligence index and the unredacted risk registerRequires an identity check
• portal.sanctumsecops.comCustomer PortalCustomer accounts, certificate inventory, the issuance order path, evidence lookups and invoicesRequires an identity check

The open tier. Anyone may verify a timestamp, check a certificate chain or run a readiness scan without an account; heavier work is billed per transaction rather than by subscription. No seat, no contract, no sales call.

• sanctumsecops.orgApexFree tools and per-transaction services
• research.sanctumsecops.orgResearchPublished research and datasets

The internal infrastructure surface. Node inventory, the MCP fleet, address allocation across the public block, tunnel ingress and the operator runbook index. Written for an operator inside the estate, not a buyer outside it. The earlier record of this apex as the federal surface was wrong: federal moved to sanctumsecops.us on 2026-09-10.

• sanctumsecops.netApexInternal infrastructure and operator runbook index

The technical and standards surface. IETF drafts, the OID tree under the Sanctum Private Enterprise Number, CA policy documents, CRL and OCSP endpoints, and the interoperability harness results. Must stay machine-readable.

• sanctumsecops.ioApexStandards, drafts and the OID tree
• pki.sanctumsecops.comPKICA certificates, policy and practice statements
• crl.sanctumsecops.comCRLRevocation distribution points
• trust.sanctumsecops.comTrustTrust anchors and attestation roots

The lab bench. Pre-release work, the CygnetLib cryptographic library, the Scryptorium and CygnScrypt compilers, prototype nodes and anything not yet fit for the commercial surface.

• sso-labs.comApexLabs, library and prototype work
• arena.sanctumsecops.comValidation ArenaPQC validation and interop arena

The operational transparency surface. Service status, uptime history, incident record and the public PULSE feed. Deliberately separate from the commercial apex so an outage there does not take the status page with it.

• sanctumsecops.techApexStatus page and incident history

The federal-facing surface. Capability statement, UEI and CAGE, NAICS and PSC coverage, CMMC 2.0 Level 2 posture, CNSA 2.0 alignment and teaming information. Written for a contracting officer, not a CTO. This apex previously served the commercial build; that was drift, corrected 2026-09-10.

• sanctumsecops.usApexFederal capability and procurement surface

Internal infrastructure for the labs line, and the entry point for the MCP server fleet. The apex still 301s to sso-labs.com; the value of this domain is the mcp host under it, which fronts the estate MCP servers to authorised AI clients.

• sso-labs.netApex301 to sso-labs.com
• mcp.sso-labs.netMCP FleetEntry point for the estate MCP servers — Cloudflare, PKI and Vault, RMM, knowledge. No DNS or tunnel ingress cut over yet.Requires an identity check

The commercial storefront for certificate issuance. In-house composite issuance under FIPS 203, 204 and 205 including the ALBIREO composite at 1.3.6.1.4.1.65953.8.1, alongside the theSSLstore reseller catalogue for conventional DV, OV, EV and code-signing lines. Separate from the commercial apex because a storefront that takes orders has a different risk and uptime posture than a marketing site.

• cygnetssl.comApexQuantum issuance line, reseller catalogue and the order path
• www.cygnetssl.comApex (www)Serves the same artifact as the apex