Open-Source Software Licenses

Qpher uses open-source software components in its platform. We are grateful to the open-source community and committed to complying with all applicable license terms. This page lists the key open-source dependencies used by Qpher, organized by category. Full license texts are available in the respective project repositories. Qpher's own platform code is proprietary and not open-source, but we contribute back to the open-source ecosystem where possible.

The following open-source libraries provide the cryptographic foundation for Qpher's post-quantum services: - **liboqs** (Open Quantum Safe Project) - MIT License. Provides C implementations of Kyber768 (ML-KEM-768) and Dilithium3 (ML-DSA-65) algorithms. Repository: github.com/open-quantum-safe/liboqs. - **liboqs-python** (Open Quantum Safe Project) - MIT License. Python bindings for liboqs used by Qpher's backend services. Repository: github.com/open-quantum-safe/liboqs-python. - **cryptography** (Python Cryptographic Authority) - Apache 2.0 / BSD 3-Clause. Provides AES-256-GCM encryption for private key storage at rest and HKDF-SHA256 key derivation for the hybrid KEM-DEM scheme. Repository: github.com/pyca/cryptography. - **bcrypt** - Apache 2.0. Provides password hashing with configurable cost factor. Repository: github.com/pyca/bcrypt. - **PyJWT** - MIT License. JSON Web Token implementation for User Portal session management. Repository: github.com/jpadilla/pyjwt.

The following open-source frameworks and libraries power the Qpher platform: **Backend**: - **FastAPI** - MIT License. Async web framework for all Qpher microservices. - **SQLAlchemy** - MIT License. ORM and database toolkit. - **Alembic** - MIT License. Database migration tool. - **Pydantic** - MIT License. Data validation and settings management. - **uvicorn** - BSD 3-Clause. ASGI server for FastAPI applications. - **redis-py** - MIT License. Redis client for rate limiting and caching. - **prometheus-client** - Apache 2.0. Prometheus metrics instrumentation. **Frontend**: - **Next.js** - MIT License. React framework for User Portal and marketing site. - **React** - MIT License. UI component library. - **Tailwind CSS** - MIT License. Utility-first CSS framework. - **Radix UI** - MIT License. Accessible component primitives. - **Lucide React** - ISC License. Icon library. - **Recharts** - MIT License. Charting library for dashboard visualizations. - **Zod** - MIT License. TypeScript schema validation. **Testing**: - **pytest** - MIT License. Python test runner. - **Jest** - MIT License. JavaScript test runner. - **Testing Library** - MIT License. React component testing utilities.

The post-quantum cryptographic algorithms used by Qpher (Kyber/ML-KEM and Dilithium/ML-DSA) have been standardized by NIST as FIPS 203 and FIPS 204 respectively. The algorithm designers have committed to royalty-free licensing for the NIST-standardized versions. Specifically: - **CRYSTALS-Kyber (ML-KEM)**: The Kyber team has stated that they do not hold patents on the algorithm and have committed to not filing patents. The NIST standardization process includes IPR (intellectual property rights) declarations. - **CRYSTALS-Dilithium (ML-DSA)**: The Dilithium team has similarly committed to royalty-free availability of the algorithm. Qpher uses these algorithms exclusively through the liboqs library (MIT licensed), which implements the NIST-standardized versions. Qpher does not implement custom or modified versions of these algorithms. Users of the Qpher platform do not need separate patent licenses to use the cryptographic operations provided by the Service.

If you have questions about the open-source components used by Qpher, or if you believe there is a license compliance issue, please contact legal@qpher.ai. Qpher is grateful to the open-source community and is committed to responsible use of open-source software. We actively monitor our dependencies for security vulnerabilities using automated scanning tools and address critical issues promptly. Qpher, Inc. Registered in the State of Delaware, United States. Effective Date: February 16, 2026