Your VPN was designed for 1998. Quartz is a modern ZTNA platform — pure QUIC data plane, hybrid ML-KEM + ML-DSA cryptography, controller out of the data path. Production-grade remote access for networks that will still be secure in 2045.
Most "ZTNA" vendors repackaged VPN concentrators with a policy dashboard. Quartz starts from a different architecture — one where transport, cryptography, and trust boundaries are all first-class.
All traffic rides QUIC — the IETF-standardized protocol that powers HTTP/3. No TCP fallback, no TLS-over-TCP legacy. Independent streams, 0-RTT resumption, native connection migration.
Hybrid ML-KEM-768 + X25519 for key exchange. ML-DSA-65 + Ed25519 for signatures. Both classical and quantum algorithms must break for a connection to compromise.
The control plane authenticates, authorizes, coordinates. It never terminates QUIC streams. It never decrypts user data. If the controller is compromised, the attacker gains metadata — not your traffic.
Authentication, discovery, direct peer connection, hybrid handshake, continuous verification. Five stages — and after that first setup, subsequent resumes cost zero round trips.
The numbers matter. A lost packet in a file sync stalls only that file sync — your interactive terminal, API calls, and video streams continue. Walk from Wi-Fi to cellular: the session doesn't drop.
| Capability | TCP VPN | WireGuard | Quartz |
|---|---|---|---|
| Connection setup (new) | 2–3 RTT | 1 RTT | 1 RTT |
| Connection setup (resumed) | 2–3 RTT | 1 RTT | 0 RTT |
| Connection migration (IP change) | ✗ breaks | ✗ breaks | ✓ survives |
| Stream multiplexing | ✗ HoL blocking | ✗ n/a (L3) | ✓ independent |
| Post-quantum crypto | — none | — none | ✓ ML-KEM + ML-DSA |
| Userspace (no kernel modules) | partial | optional | ✓ native |
Every connection is authenticated, authorized, and continuously re-verified. The cryptographic stack assumes a quantum attacker. The implementation assumes unsafe code is a bug class.
Every Quartz connection combines classical and post-quantum primitives via a KDF with domain separation. Both must break — independently — to compromise a session.
Every agent carries a continuously-updated device posture score. Policies can gate access on exact thresholds.
Policies are Ed25519-signed by the controller and verified by the agent before enforcement. First-match-wins. Works offline.
The entire codebase denies unsafe_code at the workspace level. No buffer overflows, no use-after-free, no data races. Keys are zeroed on drop. HMAC comparisons run in constant time.
Tailscale and Netbird are mature, excellent products. If you need a mesh VPN today and PQC isn't a priority, use them. Quartz is for teams who need QUIC-native transport, hybrid PQC, and auditable self-hosted infrastructure.
| Aspect | Tailscale | Netbird | Cloudflare WARP | Quartz |
|---|---|---|---|---|
| Transport | WireGuard · L3 | WireGuard · L3 | WireGuard / MASQUE | QUIC · L4 |
| Post-quantum crypto | — none | — none | — none | ✓ hybrid, shipped |
| Open source | partial (client) | ✓ yes | ✗ no | ✓ MIT / Apache-2.0 |
| Controller in data path | DERP sees metadata | relay sees metadata | cloud-hosted | ✓ out of path |
| Self-hosted | Headscale (community) | ✓ yes | ✗ no | ✓ first-class |
| Connection migration | via DERP | via relay | yes | ✓ native QUIC |
| Stream multiplexing | — no | — no | — no | ✓ yes |
| Maturity | ★★★★★ excellent | ★★★★ good | ★★★★★ excellent | ★★★ growing |
| Mobile clients | all platforms | all platforms | all platforms | Q1 2027 |
Quartz is at Milestones 1–3. Core networking, cryptography, and policy enforcement are functional today. Multi-platform agents and managed cloud are on a dated roadmap — here is exactly what's where.
Each subsystem is its own crate. The workspace denies unsafe code. The dashboard is React 19 + TypeScript. The protocol definitions are five .proto files, versioned and stable.
Quartz is a deliberate choice, not a default. It's the right fit when post-quantum cryptography is insurance you need, when you audit your tools, and when you care about how packets actually move.
If your data must stay confidential for decades, post-quantum crypto isn't optional. It's insurance against harvest-now-decrypt-later.
The 2033 NSA CNSA 2.0 deadline is closer than it looks. Hybrid PQC deployments take years to validate and operationalize.
Self-hosted control plane, local policy enforcement, auditable open-source code — maps directly to compliance requirements.
MIT / Apache-2.0. Full source available. No black-box binaries. Verify every claim in this page against the code.
If you understand why 0-RTT, connection migration, and stream multiplexing matter, Quartz is built for you.
If you need all platforms today with zero engineering overhead and PQC isn't relevant, use Tailscale or Cloudflare WARP. We'll say so.
Quartz is self-hostable today. Managed cloud is on the roadmap (M4–M6). Clone the repo, bring up the stack, point your agent at it.
Docker Compose with controller, DERP relay, Prometheus, and Grafana. Multi-stage builds on Debian Bookworm slim, non-root containers, systemd hardening templates. SQLite by default; PostgreSQL migration path in M4.
# clone & start the stack $ git clone https://github.com/quartz-ztna/quartz.git $ cd quartz $ docker-compose -f docker/docker-compose.yml up -d ✓ quartz-controller running :8443 ✓ quartz-derp running :3478/udp :443/tcp ✓ prometheus running :9090 ✓ grafana running :3000 # configure & run your first agent $ cp config/agent.toml.example config/agent.toml $ cargo run --bin quartz-agent -- --config config/agent.toml [INFO] identity: OIDC → google-workspace ✓ [INFO] handshake: ML-KEM-768 ⊕ X25519 ✓ [INFO] session opened in 78ms · trust=92/100 [INFO] SOCKS5 listening on 127.0.0.1:1080
No marketing dodges. If you need more, the docs go deeper and the source goes deeper still.
CAP_NET_ADMIN is needed.classical crypto mode disables PQC algorithms. We don't recommend this for new deployments, but it's available for compatibility testing.Clone the repo, run the stack, point your first agent at it. If Quartz isn't the right fit, we'll tell you where to look instead.