Q-Fortress is encrypted storage. Records are sealed with AES-256-GCM, and its two data ports use only ML-KEM-1024 key exchange and ML-DSA-87 certificates.
Every record is sealed on its own with AES-256-GCM. Change a single byte and it will not open.
Internal services prove who they are with an ML-DSA-87 certificate before any data moves, and tools with an API key. Everything else is refused.
Encryption keys rotate while the vault keeps answering. If a rotation is cut short, the previous key still works.