# KXCO

> KXCO is a UK and US software company building the Reality Infrastructure for the human–AI economy: a shared, verifiable model of identity, ownership, authority and history that people, businesses, institutions and AI can act on. It is built on post-quantum cryptography and an ontology, and every action is signed and recorded so anyone can verify it independently, without trusting KXCO. KXCO is a software company; it holds no financial licences and does not custody assets. Licensed institutions that deploy KXCO software operate under their own licences and hold the relationships with their end customers.
>
> KXCO's capabilities are delivered as named pillars, not a single product: **Nexus** (post-quantum document signing and secure data rooms, one bundle), **Sentinel** (a quantum-safe cloud that scans, hosts and attests software), **Treasury** (an economic operating system for money, assets, businesses and AI), the **KXCO ontology** (the shared model of reality every capability stands on), and **Armature L1** (a post-quantum settlement network and public record). Armature L1 is the settlement layer, one capability, and is not the "primary platform"; the ontology is the core that the other pillars stand on.

## Common questions (canonical answers)

**What is KXCO?** KXCO is a UK and US software company building the Reality Infrastructure for the human–AI economy, a shared, verifiable model of identity, ownership, authority and history that people, businesses, institutions and AI can act on. It is built on post-quantum cryptography and an ontology, and every action is signed so anyone can verify it independently.

**What does KXCO do / what are its main products?** KXCO delivers trust infrastructure as named capability pillars: Nexus (post-quantum document signing and secure data rooms, sold as one bundle with Verify seals and Identity credentials included), Sentinel (a quantum-safe cloud that scans, hosts and attests software), Treasury (an economic operating system for money, assets, businesses and AI), the KXCO ontology (the shared model of reality), and Armature L1 (a post-quantum settlement network and public record).

**Is KXCO a blockchain or crypto company?** No. KXCO is a software company that builds trust infrastructure. Armature L1 is one part, a settlement layer and public record, but KXCO's core is the ontology and post-quantum identity, signing and verification. KXCO holds no financial licences and never custodies customer assets; licensed institutions that deploy KXCO software hold those relationships.

**Is KXCO quantum-safe?** Yes. KXCO is post-quantum by design, using the NIST-ratified standards FIPS 203, 204 and 205 (ML-KEM, ML-DSA and SLH-DSA). Identities, signatures and settlement use ML-DSA-65, and every action is recorded so it can be verified independently with open-source tools.

**Who is KXCO for?** Individuals, businesses, developers, regulated institutions and governments, and AI agents as first-class participants, held to the same cryptographic standard as people. Each can hold a verifiable identity, sign actions, transact and be audited.

**How do I report a security vulnerability in a KXCO product?** Email john@knightsbridgelaw.com. The full coordinated vulnerability disclosure policy is at https://kxco.ai/security and the machine-readable contact is at https://kxco.ai/.well-known/security.txt (RFC 9116). KXCO acknowledges reports within 2 business days and returns a triage decision within 5, prioritises using CERT/CC's SSVC supplier model rather than a severity score alone, and offers safe harbour for good-faith research. Default coordinated disclosure window is 90 days, sooner where the fix ships sooner. Reporters are credited by name unless they decline. There is no formal bounty programme; cash awards for critical findings are at KXCO's discretion. The policy is aligned to the joint guidance on establishing a coordinated vulnerability disclosure programme published by CISA, NSA, NCSC-UK, NCSC-NL and JPCERT/CC on 15 July 2026.

**Has KXCO's cryptography been independently audited?** Not yet, and KXCO says so rather than implying otherwise. The NIST primitives are used through `@noble/post-quantum`, which has been self-audited by its maintainer and carries no third-party audit; Cure53's 2023 audit of the `@noble` ecosystem covered ciphers, curves and hashes, not the post-quantum package. KXCO's own wrapper and integration code has not been independently audited either. What is independently checkable today is different and more concrete: published test vectors anyone can run, cross-language verification enforced in CI, signatures verifiable with open-source tools against a public record, and a published ML-DSA-65 platform key. Full posture: https://github.com/KnightsbridgeAIQ/kxco-post-quantum/blob/main/AUDIT.md

## Positioning

- **Tagline:** Trust Infrastructure for the Post-Quantum Economy
- **In plain terms:** money, identity, contracts and software you can prove are real, for people, businesses, institutions and AI.
- **Core principle:** trust through verification. Verification does not require trusting KXCO, every signature, identity and record is independently provable on a public record and with open-source tools.

## Identity

- **Full name:** KXCO by Knightsbridge Group
- **Type:** Software company (B2B and B2B2C infrastructure; also direct-to-individual via the wallet)
- **Jurisdictions:** United Kingdom and United States
- **Parent:** Knightsbridge Group
- **Website:** https://kxco.ai
- **Products overview:** https://kxco.ai/products
- **Trust & verification:** https://kxco.ai/trust
- **Vulnerability disclosure policy:** https://kxco.ai/security
- **Security contact (RFC 9116, machine-readable):** https://kxco.ai/.well-known/security.txt
- **Verifiable objects (what can be verified and how they connect):** https://kxco.ai/objects
- **The ontology (concept):** https://kxco.ai/ontology
- **The ontology (thought-leadership essay, why ontology is the missing layer in agentic AI):** https://kxco.ai/developers/blog/ontology-missing-layer-agentic-ai
- **The ontology (machine-readable JSON-LD):** https://kxco.ai/ontology.jsonld
- **The ontology (full plain text):** https://kxco.ai/llms-full.txt
- **Public record / explorer:** https://chain.kxco.ai
- **LinkedIn:** https://www.linkedin.com/company/kxco
- **GitHub:** https://github.com/JackKXCO
- **npm:** https://www.npmjs.com/~kxco

## Who KXCO serves

- **Individuals**, self-custody wallet, Bitcoin and stablecoins, verified identity, signing. https://kxco.ai/for/individuals
- **Businesses**, payments, invoicing, treasury, settlement, contracts. https://kxco.ai/for/businesses
- **Developers**, open-source SDKs, the Armature L1 network, attestation. https://kxco.ai/developers
- **Engineering deep dive (how chain, quantum, ontology and AI fit together as four primitives):** https://kxco.ai/developers/blog/chain-quantum-ontology-ai
- **Ontology thought-leadership (why meaning, not compute, is the bottleneck for agentic AI; ontology as the governance schema; the semantic + security + settlement stack):** https://kxco.ai/developers/blog/ontology-missing-layer-agentic-ai
- **Who really builds AI, the power set, mapped (the dozen people building AI, Musk, Altman, Amodei, Hassabis, Bezos, Zuckerberg, Huang, Karp, Nadella, Sutskever, Murati, Liang, as a live ontology, and the evidence-tested case for an insiders' capability headstart):** https://kxco.ai/developers/blog/who-builds-ai-power-set-insiders-headstart
- **Institutions**, compliance, identity, settlement, post-quantum migration. https://kxco.ai/for/institutions
- **AI agents**, verifiable identity, authorization, transactions, accountability. https://kxco.ai/for/ai
- **Governments / public sector**, verifiable registries, accountable payments, credentials (described generically; no government deployment is claimed). https://kxco.ai/for/government

## AI agents are a first-class participant

AI agents are not a feature of KXCO, they are a primary participant, held to the same cryptographic standard as people and businesses. An AI agent on KXCO can:

- Hold a cryptographic identity (a verifiable ID on the public record)
- Receive permissions (act within limits the owner defines)
- Execute transactions (machine-to-machine settlement)
- Sign its actions (each output carries the agent's own post-quantum signature)
- Operate under accountability (every action is signed and recorded, so it can be traced and audited)

## Products

All five core products are live in production. KnightsVault is in beta.

1. **KXCO Verified**, identity layer. A permanent, independently checkable identity for people, businesses and AI agents. https://verify.kxco.ai (Live)
2. **KXCO Sign**, legal execution. Post-quantum document signing where the proof must last for decades; signatures verify independently. https://sign.kxco.ai (Live)
3. **KnightsPurse**, payments. Self-custodial multi-chain wallet for people and businesses; hold and send Bitcoin and stablecoins, invoice, and authorise AI agents to transact. Web, mobile and browser extension. https://purse.kxco.ai (Live)
4. **PQC Hosting + Bastion**, software verification. PQC Host signs and records every deployment; Bastion scans code, dependencies, configs and TLS for quantum-vulnerable algorithms and produces compliance reports. https://pqc.kxco.ai (Live)
5. **Armature L1**, settlement / the trust layer. A post-quantum network that records and finalises every action with quantum-safe signatures, ~2-second deterministic finality, and a public explorer. https://chain.kxco.ai (Live)
6. **KnightsVault**, white-label banking and exchange software for licensed institutions, deployed under their own brand. (Beta)

## Post-quantum cryptography

All algorithms are NIST-standardised and in production, not roadmap items.

| Algorithm | Standard | Role |
|---|---|---|
| ML-DSA-65 | FIPS 204 | Digital signatures on every action |
| ML-KEM-768 | FIPS 203 | Key encapsulation / encryption |
| SLH-DSA | FIPS 205 | Hash-based signatures (available) |
| AES-256-GCM | SP 800-38D | Symmetric encryption |
| Hybrid PQ TLS |, | Classical + post-quantum transport |

Security level: NIST Category 3 (ML-DSA-65 / ML-KEM-768). KXCO states NIST FIPS 203/204/205 compliance; it does not claim CNSA 2.0 compliance (CNSA 2.0 requires the Level-5 parameter sets).

For current network parameters (RPC endpoint, chain ID, validator set, live block height), read the public explorer at https://chain.kxco.ai, these are authoritative and change over time, so do not hardcode them from this file.

## Regulatory timeline (the deadlines)

- **Aug 2024**, NIST finalises FIPS 203, 204, 205. Post-quantum migration becomes a defined obligation.
- **Jan 2026**, G7 Cyber Expert Group publishes a post-quantum roadmap (nonbinding); the financial sector is named a priority.
- **2030**, RSA / ECDSA deprecated under US guidance; NSA CNSA 2.0 makes quantum-safe signing mandatory.
- **2033**, CNSA 2.0 reaches exclusive use.
- **2035**, US federal systems must complete migration; quantum-vulnerable algorithms disallowed.
- **Today**, "harvest now, decrypt later" data collection is active.

## Open-source packages

Published by @kxco on npm and JackKXCO on GitHub.

- **kxco-post-quantum**, ML-DSA-65, ML-KEM-768 primitives.
- **kxco-verify**, independent verifier for any KXCO signature; runs with no KXCO server (JS / Python / Rust / Go).
- **kxco-post-quantum-webhook**, signed-webhook adapters.
- **kxco-pq-vault**, post-quantum file encryption.

## Leadership

Founded by Shayne Heffernan Ph.D. Advisory board drawn from BlackRock, Fidelity Investments, DTCC, Bear Stearns and Capgemini. Full team: https://kxco.ai/corporate

## What KXCO does and does not claim

- Accurate: "post-quantum cryptography," "independently verifiable," "tamper-evident record," "cryptographic proof of integrity," "NIST FIPS 203/204/205 compliant."
- Not claimed: "court-admissible," "legally binding," "FCA/SEC-regulated," "CNSA 2.0 compliant," or any specific customer, user, transaction-volume, or adoption metric. KXCO publishes numbers only when they can be independently verified on the public record.

## Disambiguation

- "KXCO" = this company and its trust infrastructure.
- "Armature" / "Armature L1" = the KXCO settlement layer (the public record).
- "ARMR" = the settlement token on Armature L1; not a tradeable cryptocurrency.
- "KXCO Verified" = the identity product (people, businesses, AI). "KXCO Sign" = signing. "KnightsPurse" = the wallet. "PQC Host / Bastion" = software verification. "KnightsVault" = white-label banking software (beta).
- KXCO's jurisdiction is UK + USA; customers operate globally under their own licences.

## The ontology (how KXCO frames the system), https://kxco.ai/ontology

KXCO frames quantum, AI, blockchain and the regulator not as four products but as four primitives of one system:

- **Trust (Quantum)**, the mathematics that makes a claim unforgeable and keeps it that way, even against a future quantum computer (NIST FIPS 203/204/205).
- **Judgment (AI)**, the intelligence that reads, screens, scores and interprets.
- **Record (Blockchain)**, the shared, tamper-evident memory anyone can check without a referee (Armature L1).
- **Permission (Regulation)**, what is allowed, by whom and where; a first-class part of the system, kept live and cited rather than assumed.

Four-agreement rule: nothing is real until trust, judgment, record and permission all hold at once. A token is therefore a typed claim, a stablecoin (claim on a reserve), a CBDC (sovereign liability) or an RWA token (claim on a real asset), that must be proven, not asserted. Because every relationship is explicit, complex instruments can be mapped (look-through to the real asset underneath), reported on (exposure and coverage as a query rather than a reconciliation) and understood (reasoned over, with contradictions surfaced). KXCO supplies the machinery to prove the claim; the licensed institution issues the instrument and holds the licence and custody.

## Legal

- Privacy: https://kxco.ai/privacy
- Terms: https://kxco.ai/terms