Since our April update we’ve focused on one theme above all: security and compliance. This is the work we previewed back then — the new ID server, API-key authentication, and stronger account controls — all shipped in summer 2026.
Stronger account security#
We rolled out a set of changes to how accounts and access work on the platform. Several of these were driven by a customer preparing for PCI-DSS compliance, but every account benefits.
- API keys instead of passwords. Username/password login is gone. Access to the platform now runs through API keys, so every action is tied to a named key and its owner.
- Keys expire. API keys default to a 12-month lifetime and can be set shorter per organization (for example, 90 days) where compliance demands it.
- Stricter passwords where passwords still apply: minimum 12 characters, mixed letters and numbers, and you can’t reuse a recent password.
- Monthly API-key reports. Organization owners and admins now receive a monthly report listing every key, its owner, last usage, and expiry date — so nothing lingers unnoticed.
Together these cover the account and authentication requirements for PCI-DSS — unique IDs per user, immediate revocation for terminated users, key expiry, and every action attributable to an individual.
If you’re on your way - please get in touch. We can customize most of the knobs to your compliance needs.
Audit trail across the infrastructure#
If your compliance criteria require it, we can now provide a full audit trail of what we do on the infrastructure on your behalf. That means we can show who accessed what, and when, across the platform we operate for you — a level of transparency that stricter frameworks increasingly ask for. If this is relevant to you, get in touch and we’ll walk you through what we can document.
Other notable updates#
Install quantum-cli with Homebrew#
We released quantum-cli a couple of times, mostly addressing maintenance tasks — most notably re-working our Docker integration to move from the retired docker/docker module to moby/moby.
While we were at it, we also added another installation method: quantum-cli is now available through a Homebrew tap. On macOS and Linux you can install and upgrade it the way you already manage everything else:
brew install --cask hostwithquantum/tap/quantum-cliNo more grabbing binaries by hand.
Own your chat: Mattermost on Quantum#
If you’d rather not hand your team’s conversations to a third party, we’ve published a ready-to-run Mattermost stack.
It deploys Mattermost Team Edition with a PostgreSQL backend, persistent volumes, and S3-compatible object storage for file uploads — with TLS handled at the edge by quantum-caddy. Copy the example config, set your variables, and make deploy.
Your chat, your data, on infrastructure you control.
More releases#
As you may or may not be aware, 2026 is (once more) the year of supply chain security. With the advent of AI models that find vulnerabilities, this has been a priority for us as well. So we’ve refined a lot of releases processes (private and public) and added scanners to the mix. If you haven’t done it yet, a few tools of interest should be dependabot and zizmor for the GitHub ecosystem.
Powered by these tools, here are some additional releases:
- We released updates to quantum-caddy (our Caddyserver distribution); the latest is
v2.11.4+pq.1. - We released a new version of our drone.io plugin:
v0.2.0.
Meanwhile, on Runway#
Runway is our PaaS — it runs your apps and managed databases, hosted entirely in the EU. It’s been moving in the same direction as everything above: more control, less credential-sharing, a clearer audit trail. A quick tour of the last three months:
May — Deploy your own Docker/OCI images. Bring a pre-built (hardened, non-root) image straight from your own pipeline, next to our buildpacks.
June — Fully async deployments under the hood (paving the way for more deploy sources and auth options), a reworked, more transparent app status, and a batch of UI improvements — registry management, routing status, and in-UI config editing.
July — API keys with flexible expiration (use them for CI/CD or MCP instead of username/password — set an hour or a year), deploy sources so every deployment records where it came from (a handy audit trail, carrying SBOM data for what’s next), and PostgreSQL storage expansion — grow a database volume without downtime.
Full details are in the Runway news.
As always, feedback and questions are welcome. Get in touch.