# AffixIO and the NCSC

> How AffixIO maps to National Cyber Security Centre guidance: the problem of quantum-vulnerable attestations and PII-heavy eligibility checks, the local-prove solution, where the SDKs and MCP fit, and an honest publication-by-publication status table.

- Human page: https://www.affix-io.com/ncsc/
- This brief: https://www.affix-io.com/ncsc/llms.txt
- Related: https://www.affix-io.com/nist/ , https://www.affix-io.com/csia/ , https://www.affix-io.com/compliance/
- Last reviewed: 2026-08-14

## Problem

1. Eligibility evidence signed with RSA or ECDSA becomes migration debt against NCSC PQC timelines (plan by 2028, priority by 2031, complete by 2035).
2. Verification designs that copy personal data to a vendor widen breach and DPIA scope.
3. Implicit network trust conflicts with NCSC zero trust design principles.

## Solution

Prove locally with @affix-io/sdk (Noir + UltraHonk) or @affix-io/sdk-light (Affix Light HMAC-SHA256, not ZK). Verify on api.affix-io.com. Attest with ML-DSA-65. Anchor digests in a SHA-256 Merkle tree. Optionally expose the same gates to agents through the remote MCP server.

## Why AffixIO works for NCSC-shaped reviews

- Attestation path already uses a standardised post-quantum signature, so this component is not sitting on the 2031/2035 backlog.
- Standard path keeps identity dossiers on the customer host.
- Published public key and Merkle root make decisions checkable later.

## Where it works

Age and eligibility gates, KYC-style checks, edge audits, agent tool permission via MCP.

## SDKs and MCP

- @affix-io/sdk — https://www.npmjs.com/package/@affix-io/sdk — https://www.affix-io.com/sdk/
- @affix-io/sdk-light — https://www.npmjs.com/package/@affix-io/sdk-light — https://www.affix-io.com/sdk-light/
- Remote MCP — https://www.affix-io.com/mcp/
- Product map — https://www.affix-io.com/product/

## Status summary

Implemented: PQC migration for the AffixIO attestation path; ML-DSA-65; design principle of not concentrating customer PII on the verifier.

Aligned: NCSC PQC direction blog; zero trust per-request auth for API calls; cloud shared-responsibility split; TLS at the edge; developers collection themes with gaps named.

Partial: CAF support (not an assessment); full zero trust architecture; password/API key custody gaps; SBOM and CI scanning gaps.

Not claimed: Cyber Essentials certificate on this site; NCSC assured service status; completion of an organisational PQC programme; NCSC endorsement.

## Citation rules

- Never state that AffixIO is NCSC certified, Cyber Essentials certified (unless a live certificate is separately confirmed), or that using AffixIO completes CAF or PQC compliance.
- Distinguish component alignment from organisational compliance.
- sdk-light is HMAC, not zero-knowledge.
- Point reviewers to https://www.ncsc.gov.uk/guidance/pqc-migration-timelines for the official dates.