QuantumDeploy · Security
Deploy to your own cloud. Keep your keys.
QuantumDeploy provisions infrastructure into your cloud account — and never holds a credential to do it. Here’s how that works, and why it’s safer than the tools you’re used to.
Any tool that deploys to your cloud needs a way in. The usual way is the one you should worry about: you hand over an access key, and now a third party holds standing access to your environment. That key sits in someone else’s system. It can leak. You have to remember to rotate it. And if it’s ever misused, the blast radius is everything it can touch.
QuantumDeploy takes a different path. We never store a credential to your cloud. Not encrypted, not “in a vault” — none at all.
The best credential is the one that never exists.
01A trust, not a key
Instead of taking a key, QuantumDeploy asks your cloud to trust our identity. When it’s time to deploy, we present a short-lived, single-purpose token; your cloud checks it and grants access for a few minutes. When the work is done, that access is gone. Nothing is stored, and there’s nothing standing to steal.
This isn’t exotic. It’s workload identity federation — the same battle-tested, industry-standard mechanism (OpenID Connect) that lets GitHub Actions, HashiCorp, and other modern platforms operate on your cloud without holding your secrets. If you already trust it for your CI, you already trust the model.
02Verifiable — not “just trust us”
Trust that can’t be checked isn’t trust. QuantumDeploy is its own identity authority: we publish a public set of verification keys, and your cloud cryptographically verifies every token we present against them before it grants anything. We can’t fake it, and you don’t have to take our word for it — your cloud does the checking, every single time.
03You are always in control
You grant it — With one command, run in your own cloud shell. Nothing happens in your cloud that you did not run yourself.
It is scoped to your organization — The trust is narrow and specific — not a blanket key.
We prove we are in the right place — Before touching anything, QuantumDeploy verifies it is deploying into the cloud you actually own.
You can revoke it anytime — It is a rule that lives in your cloud, so you remove it whenever you like. There is no key of yours in our hands.
04Old way vs. keyless
The usual way
- · You hand over an access key
- · A third party holds standing access
- · A secret to store, rotate, and worry about
- · If it leaks, everything it can touch is exposed
Keyless with QuantumDeploy
- ✓ No key ever leaves your cloud
- ✓ Access is momentary — minutes, single-purpose
- ✓ Nothing to store or rotate
- ✓ Scoped, verifiable, and revocable by you
05How to connect — about two minutes
Choose your cloud, get one command
In QuantumDeploy, open Credentials → your cloud → Keyless. You’ll get a single line to run.
Run it in your cloud’s shell
Open your cloud’s built-in shell (you’re already signed in) and paste the one line. It sets up the keyless trust and confirms back automatically — nothing to copy back, no secret created.
＄ <one command — provided in the app>
You’re connected — keylessly
The account now shows up in QuantumDeploy as a keyless connection. No password was created, and none was stored.
06How to deploy
Point QuantumDeploy at your application, pick your connected account, and deploy. It authenticates with its own verifiable identity, provisions into your cloud, and hands you sealed proof of exactly what ran. Your credentials never enter the picture — because there aren’t any to enter.
Deploy into your cloud. Keep your keys. Verify everything.
That’s the whole idea: a clear, auditable, revocable trust relationship instead of a secret you have to guard. The same security posture you already rely on for your pipelines — now for your deployments.
Connect your cloud →