PQC Hybrid Signing: answers to the questions buyers ask

Evidence for PQC Hybrid Signing: 1. Evidence pack · 2. Answers to buyer questions · 3. Figures & benchmarks · 4. Selling tools · IHVRK kit · Learn it · why these pages exist

Security reviewers send the same questions to every AI vendor (see what buyers ask). Here are true answers for PQC Hybrid Signing, each ready to copy into a questionnaire. YES = we have evidence and link it; PARTIAL = some evidence, limits stated; NO = we don't have it and say so; ASK = answered in writing per customer.

Can you show per-decision records, signed, that we can verify without your API or login? YES

Yes for this product's demo decisions: the IHVRK kit holds each request and answer, hashed and Ed25519-signed; verify.py checks it offline with the standard library only. Kit: https://cainstudio.online/proof/bundle/ihvrk-kits/cain42-ihvrk-pqc-hybrid-signing.zip

Do denials produce the same evidence as approvals? YES

Yes. 2 of the 3 recorded claims are attacks that must be refused or flagged; they are recorded, signed and re-checkable exactly like the 1 normal cases.

Can we reproduce the results ourselves? YES

Yes: python3 verify.py --live re-sends every request from your machine to the public service and compares the answers. Live demo page: https://cainstudio.online/guide-pqc-hybrid-signing-lab.html

What latency should we expect? PARTIAL

Time to get each demo answer, measured from our build host over the internet (can include several server steps): median 190 ms (min 84, max 535). That includes network time; it is not a load test or an SLA.

What are your false-positive and false-negative rates? PARTIAL

We publish only what we measured: the listed claims. Known misses: https://cainstudio.online/guide-pqc-hybrid-signing-limits.html We have no large independent benchmark for this product yet; we will not quote a rate we have not measured.

What does the product NOT do? YES

Written down here: https://cainstudio.online/guide-pqc-hybrid-signing-limits.html

Has it been red-teamed against the OWASP Top 10 for Agentic Applications by an independent party in the last 12 months? NO

Not by an independent party. The attack cases in the kit are our own. A third-party audit is scheduled (owner-attested) but has not been completed; we will say so until a report exists.

Which certifications do you hold (SOC 2, ISO 27001, ISO 42001)? NO

None today. We do not claim SOC 2, ISO 27001 or ISO 42001. What we offer instead is evidence you can verify yourself (this kit).

Who signs the evidence, and how do we know the key is yours? YES

A dedicated Ed25519 kit-signing key. Its fingerprint 1cacdfc1fc2024b6bb4f8fb02c7c80f4a57f44c5adb11c507190781b5d613de3 is published on three separate domains: https://cainstudio.online/evidence-kit-key.json, https://mcpgate.online/evidence-kit-key.json, https://clawx.click/evidence-kit-key.json.

Is the evidence tamper-evident? YES

Yes. Every file's SHA-256 is in the signed manifest; changing one character in any recorded answer makes verify.py report FAIL (we test this).

How are customers isolated from each other? PARTIAL

Demos run in separate demo tenants or throwaway sandboxes; production routes bind each API key to its own tenant. This is tested internally, not by an independent auditor.

Which subprocessors and AI model providers touch our data, and do you train on it? ASK

Answered in writing for your deployment by FIRME AI CORPORATION. We do not publish a blanket statement here that we have not verified for every product.

Who is the vendor? YES

FIRME AI CORPORATION, a California corporation (incorporation founder-attested); team of three: Vincent Noriega (founder), Lena Noriega, Monica Diaz.

Do you have a mapping to NIST AI RMF, ISO 42001 or the EU AI Act for this product? NO

Not a formal, reviewed mapping for this product. We will not hand you an unreviewed one.

All answers at once

Q: Can you show per-decision records, signed, that we can verify without your API or login?
A (YES): Yes for this product's demo decisions: the IHVRK kit holds each request and answer, hashed and Ed25519-signed; verify.py checks it offline with the standard library only. Kit: https://cainstudio.online/proof/bundle/ihvrk-kits/cain42-ihvrk-pqc-hybrid-signing.zip

Q: Do denials produce the same evidence as approvals?
A (YES): Yes. 2 of the 3 recorded claims are attacks that must be refused or flagged; they are recorded, signed and re-checkable exactly like the 1 normal cases.

Q: Can we reproduce the results ourselves?
A (YES): Yes: python3 verify.py --live re-sends every request from your machine to the public service and compares the answers. Live demo page: https://cainstudio.online/guide-pqc-hybrid-signing-lab.html

Q: What latency should we expect?
A (PARTIAL): Time to get each demo answer, measured from our build host over the internet (can include several server steps): median 190 ms (min 84, max 535). That includes network time; it is not a load test or an SLA.

Q: What are your false-positive and false-negative rates?
A (PARTIAL): We publish only what we measured: the listed claims. Known misses: https://cainstudio.online/guide-pqc-hybrid-signing-limits.html We have no large independent benchmark for this product yet; we will not quote a rate we have not measured.

Q: What does the product NOT do?
A (YES): Written down here: https://cainstudio.online/guide-pqc-hybrid-signing-limits.html

Q: Has it been red-teamed against the OWASP Top 10 for Agentic Applications by an independent party in the last 12 months?
A (NO): Not by an independent party. The attack cases in the kit are our own. A third-party audit is scheduled (owner-attested) but has not been completed; we will say so until a report exists.

Q: Which certifications do you hold (SOC 2, ISO 27001, ISO 42001)?
A (NO): None today. We do not claim SOC 2, ISO 27001 or ISO 42001. What we offer instead is evidence you can verify yourself (this kit).

Q: Who signs the evidence, and how do we know the key is yours?
A (YES): A dedicated Ed25519 kit-signing key. Its fingerprint 1cacdfc1fc2024b6bb4f8fb02c7c80f4a57f44c5adb11c507190781b5d613de3 is published on three separate domains: https://cainstudio.online/evidence-kit-key.json, https://mcpgate.online/evidence-kit-key.json, https://clawx.click/evidence-kit-key.json.

Q: Is the evidence tamper-evident?
A (YES): Yes. Every file's SHA-256 is in the signed manifest; changing one character in any recorded answer makes verify.py report FAIL (we test this).

Q: How are customers isolated from each other?
A (PARTIAL): Demos run in separate demo tenants or throwaway sandboxes; production routes bind each API key to its own tenant. This is tested internally, not by an independent auditor.

Q: Which subprocessors and AI model providers touch our data, and do you train on it?
A (ASK): Answered in writing for your deployment by FIRME AI CORPORATION. We do not publish a blanket statement here that we have not verified for every product.

Q: Who is the vendor?
A (YES): FIRME AI CORPORATION, a California corporation (incorporation founder-attested); team of three: Vincent Noriega (founder), Lena Noriega, Monica Diaz.

Q: Do you have a mapping to NIST AI RMF, ISO 42001 or the EU AI Act for this product?
A (NO): Not a formal, reviewed mapping for this product. We will not hand you an unreviewed one.

Never upgrade a NO to a YES in a questionnaire. Buyers check, and an honest NO with evidence elsewhere sells better than a claim that fails.