CONTINUUM AI announced that OrcaRouter, an OpenAI-compatible LLM gateway it developed, will implement quantum-resistant hybrid encryption for all user request logs starting September 25, 2026.
Key points
•Implemented quantum-resistant hybrid encryption for request logs.
•Blocked the risk of past log leakage by separating database credentials.
•Publicly disclosed the encryption layer as 'scuttle,' releasing specifications and code.
OrcaRouter stated that it will store all user request logs using quantum-resistant hybrid encryption. This feature will not be limited to enterprise plans, and users will not incur separate consent or additional fees.
Previously, storage encryption was limited to defense against disk theft. OrcaRouter has solved the problem of past prompts being exposed even if database credentials are leaked. While the application fleet can receive public keys to seal new logs, the structure has been separated so that already stored logs cannot be opened.
The encryption method encrypts the payload using AES-256-GCM, and applies a hybrid method (X-Wing) combining ML-KEM-768 and X25519 for the sealing stage, which requires quantum resistance. This is intended to prepare for future decryption capabilities due to the long lifespan of the ciphertext.
CONTINUUM AI publicly disclosed this encryption layer, named 'scuttle,' and released related materials such as code, specifications, threat models, and attack surfaces in a repository. This is to ensure the verifiability of the system.
Meanwhile, OrcaRouter is not currently in a release state, and the company specified that it is 'v0. Not independently audited.' It also disclosed a design risk that since the binding item of a record cannot be changed once written, data loss may occur during tenant migration.
