BenchmarksStack RankingAPIsPricingDocsWhite PaperTokenBlogAboutSecurity Demo
Intelligent FHE Routing

One API Call.
The Right Backend. Every Time.

FHE-IQ automatically selects the optimal encryption backend — BFV-64, CKKS, or BFV-32 — based on your workload, security requirements, and hardware. You write one line of Rust. We handle the cryptographic complexity.

3
FHE Backends
5
Product Tiers (H0–H256)
<500ns
Routing Decision
0
Config Required

FHE Is Hard.
Choosing the Right FHE Is Harder.

Three encryption schemes. Five security tiers. Four hardware platforms. Dozens of parameter combinations. One wrong choice and your ciphertexts are incompatible, your latency blows up, or your security is insufficient.

Every other FHE library forces you to be a cryptographer.

  • 1 BFV for integers, CKKS for floats — pick wrong, silent data corruption
  • 2 N=4096 vs N=16384 — 3x latency difference for the same operation
  • 3 ARM NEON vs AVX-512 — 32-bit paths 2x faster on mobile, useless on x86
  • 4 Ciphertexts are backend-locked — mix BFV and CKKS and everything breaks
// Without FHE-IQ: you manage everything
let tier = ProductTier::H33;
let config = tier.resolve();
let ctx = BfvContext::new(config.poly_degree, &config.coeff_moduli, config.plain_modulus);
let keygen = KeyGenerator::new(&ctx);
let (pk, sk) = (keygen.public_key(), keygen.secret_key());
let encoder = BatchEncoder::new(&ctx);
let encryptor = Encryptor::new(&ctx, &pk);
let decryptor = Decryptor::new(&ctx, &sk);
let evaluator = Evaluator::new(&ctx);
// Hope you picked the right scheme...
// Hope the parameters match your security needs...
// Hope your hardware can handle it...
let pt = encoder.encode(&values)?;
let ct = encryptor.encrypt(&pt)?;

Describe Your Workload. We Handle the Rest.

Tell us what you're computing on — integers, floats, the security tier you need. FHE-IQ's policy router selects the optimal backend in under 500 nanoseconds.

Your Request
data_type: "integer"
tier: "h33"
needs_rotation: true
Policy Router
Phase 1: Hard filters
Phase 2: Weighted scoring
<500ns
BFV-64 Selected
N=4096 · 128-bit security
Score: 0.92 · Session created
Ready to encrypt
40%
Latency Fit
How close is the backend's observed latency to your budget? Tighter fit = higher score.
25%
Security Margin
Excess bits beyond your requirement. 128-bit when you asked for 86-bit = headroom.
20%
Hardware Affinity
BFV-32 on ARM NEON = 1.0. BFV-64 on AVX-512 = 1.0. Mismatched = penalized.
15%
Health Signal
Live error rates and p99 latency from the telemetry layer. Unhealthy backends get routed around.
Streaming Mode New

FHE-IQ now supports streaming mode — adaptive batch sizing for latency-sensitive workloads. Instead of routing based on workload type alone, FHE-IQ routes based on latency targets, dynamically adjusting batch dimensions to meet your real-time requirements.

streaming: true
API Flag
1–32
Adaptive Batch Size
Latency-First
Routing Priority

Three Engines. Automatic Selection.

Each backend is a full FHE implementation. FHE-IQ knows which one to use based on your data type, security tier, and hardware.

Backend Data Type Product Tiers Integers Floats Rotation Multiply Hardware
BFV-64 Default Integer (u64) H0, H1, H2, H33, H-256 x86 AVX-512, ARM
CKKS ML / Float Float (f64) H0, H1, H2, H33 x86, ARM
BFV-32 Mobile Integer (u32) H0, H1 ARM NEON native
Hard filters eliminate ineligible backends instantly. Float data → only CKKS. H-256 → only BFV-64. ARM NEON + low security → prefer BFV-32.

One Line to Encrypt. Zero Cryptographic Decisions.

FHE-IQ exposes a clean Rust API. Create a session, encrypt, compute, decrypt — the router handles backend selection, parameter tuning, and session stickiness.

use h33::{FabricSessionStore, RoutingRequest, DataType, ProductTier, SecurityTier};

// Initialize the fabric (typically at server startup)
let fabric = FabricSessionStore::new(Default::default());

// Create a session — FHE-IQ picks the optimal backend
let request = RoutingRequest {
    data_type: DataType::Integer,
    product_tier: ProductTier::H33,      // 128-bit NIST Level 1
    security_tier: SecurityTier::Q128,
    needs_rotation: true,
    needs_bootstrapping: false,
    latency_budget_us: 5_000,            // 5ms budget
    multiplicative_depth: 3,
    ..Default::default()
};

let session = fabric.create_session(request, "user-42")?;

// Router selected BFV-64 with score 0.92
println!("Backend: {:?}", session.backend_id);   // Bfv64
println!("Session: {}", session.session_id);      // "fab_a1b2c3..."
println!("Tier: {:?}", session.product_tier);     // H33
// Encrypt integers — the session knows which backend to use
let values = vec![42, 100, 7, 255];
let ct_a = fabric.encrypt(&session.session_id, &values)?;

// Encrypt a second vector
let ct_b = fabric.encrypt(&session.session_id, &[10, 20, 30, 40])?;

// Homomorphic addition (on encrypted data)
let ct_sum = fabric.add(&session.session_id, &ct_a, &ct_b)?;

// Homomorphic multiplication
let ct_prod = fabric.multiply(&session.session_id, &ct_a, &ct_b)?;

// Decrypt — results computed entirely on ciphertext
let sum: Vec<i64> = fabric.decrypt_integers(&session.session_id, &ct_sum)?;
let prod: Vec<i64> = fabric.decrypt_integers(&session.session_id, &ct_prod)?;

assert_eq!(sum[0], 52);   // 42 + 10
assert_eq!(prod[0], 420); // 42 * 10

// Check noise budget (how many more operations before decryption fails)
let budget = fabric.noise_budget(&session.session_id, &ct_prod)?;
println!("Noise budget remaining: {} bits", budget);
// Request float computation — router auto-selects CKKS
let request = RoutingRequest {
    data_type: DataType::Float,           // This triggers CKKS selection
    product_tier: ProductTier::H33,
    security_tier: SecurityTier::Q128,
    needs_bootstrapping: true,          // Unlimited depth
    ..Default::default()
};

let session = fabric.create_session(request, "ml-pipeline")?;
assert_eq!(session.backend_id, BackendId::Ckks);

// Encrypt floating-point data (ML embeddings, scores, etc.)
let embeddings = vec![0.85, 0.92, -0.31, 0.67];
let ct = fabric.encrypt_floats(&session.session_id, &embeddings)?;

// Homomorphic dot product, scoring, aggregation...
let ct_doubled = fabric.add(&session.session_id, &ct, &ct)?;

// Decrypt
let result: Vec<f64> = fabric.decrypt_floats(&session.session_id, &ct_doubled)?;
// result[0] ≈ 1.70  (0.85 + 0.85, CKKS gives approximate results)
// Stateless recommendation — see what FHE-IQ would pick
// without creating a session (zero cost, useful for planning)

let decision = fabric.recommend(&RoutingRequest {
    data_type: DataType::Integer,
    product_tier: ProductTier::H256,     // Maximum security
    security_tier: SecurityTier::Q256,   // NIST Level 5
    needs_rotation: true,
    ..Default::default()
})?;

println!("Recommended: {:?}", decision.backend_id);  // Bfv64
println!("Score: {:.2}", decision.score);              // 0.87
println!("Disqualified:");
for (id, reason) in &decision.disqualified {
    println!("  {:?}: {}", id, reason);
    // Ckks: "Integer data type requires integer backend"
    // Bfv32: "H-256 tier not supported (max: H1)"
}

// Check all backend capabilities
let backends = fabric.list_backends();
for b in &backends {
    println!("{:?}: max_tier={:?}, floats={}, rotation={}",
        b.id, b.max_product_tier, b.supports_float, b.supports_rotation);
}

HTTP Endpoints for Every Language

The same intelligence is exposed via REST. Nine endpoints under /api/v1/fhe/fabric/* — fully compatible with the existing H33 API.

MethodEndpointDescription
POST/api/v1/fhe/fabric/sessionCreate session (router selects backend)
DELETE/api/v1/fhe/fabric/session/:idDestroy session (zeroize keys)
GET/api/v1/fhe/fabric/session/:idSession info (backend, tier, stats)
POST/api/v1/fhe/fabric/encryptEncrypt integers or floats
POST/api/v1/fhe/fabric/decryptDecrypt ciphertext handle
POST/api/v1/fhe/fabric/computeHomomorphic op (add / multiply / rotate)
POST/api/v1/fhe/fabric/batch-encryptBatch encrypt multiple vectors
POST/api/v1/fhe/fabric/recommendStateless: what would the router pick?
GET/api/v1/fhe/fabric/backendsList backends + capabilities
Included with every API call

FHE-IQ Is Noise Pilot's Routing Engine

Every recommendation FHE-IQ makes is noise-aware. When the router picks a backend, it's optimizing for noise budget, not just data type. Noise Pilot coordinates noise management across all three FHE engines simultaneously.

Cross-Scheme Coordination
Noise Pilot tracks noise budgets across BFV, CKKS, and H33-256 backends simultaneously. When one engine's noise budget runs low, IQ can re-route operations to a fresh context.
Workload-Aware Optimization
The router doesn't just pick a scheme — it picks the scheme + parameter set that maximizes computational depth for your specific workload pattern.
Real-Time Health Monitoring
AI Crypto Health agent runs at 0.52µs per assessment, continuously monitoring noise distribution, parameter integrity, and operational health across all active sessions.

FHE-IQ + ZK + Dilithium — One Pipeline

FHE-IQ is the compute layer. Combine it with H33's zero-knowledge proofs and post-quantum signatures for a complete encrypted identity pipeline.

FHE-IQ Compute
Intelligent encrypted computation. BFV for biometrics, CKKS for ML scoring, BFV-32 for mobile. Auto-selected per request.
Latency~1,109µs / batch
Throughput2.21M auth/sec
Routing<500ns
ZK Proof Layer
STARK lookup proofs verify computation integrity without revealing inputs. SHA3-256 — fully post-quantum.
Proof Time0.067µs
Verify Time<1µs
PQ SecureSHA3-256
Dilithium Attestation
ML-DSA digital signatures attest every computation result. FIPS 204 compliant. Batch attestation: 1 sign per 32 users.
Sign + Verify~240µs
StandardFIPS 204
Batch Savings31×
Total Pipeline: ~42µs per auth
FHE encrypt + match + ZK proof + Dilithium attestation — fully post-quantum, single API call

Built for Real Workloads

FHE-IQ handles the routing complexity so your team ships encrypted features — not cryptographic plumbing.

01

Multi-Tenant SaaS

Different customers need different FHE backends. Integer workloads route to BFV, float analytics to CKKS, ARM edge devices to . One API, zero per-tenant configuration.

BFV CKKS Multi-Tenant
02

Hybrid ML Pipelines

Feature extraction on integers (BFV), inference on floats (CKKS), results aggregation (BFV). FHE-IQ routes each stage to the optimal engine automatically.

ML Inference Mixed Types Auto-Route
03

Cross-Platform Deployment

x86 servers use BFV/CKKS with full polynomial degree. ARM edge (Graviton, Apple Silicon) automatically routes to with NEON acceleration. Same API call.

ARM NEON AVX-512 Graviton Apple Silicon
04

Security-Tiered Workloads

Route PII to H33-256 (Level 5), general analytics to H33-128 (Level 3), ML inference to CKKS turbo. FHE-IQ enforces security policy at the routing layer.

H33-256 H33-128 Policy Engine

Frequently Asked Questions

Everything you need to know about FHE-IQ's intelligent routing layer.

What is FHE-IQ?
An intelligent routing layer that automatically selects the optimal FHE backend (BFV, CKKS, or ) based on your workload type, security tier, and hardware.
How fast is the routing decision?
Sub-500 nanoseconds. The policy engine uses a pre-compiled decision tree — no ML inference, no network calls. Pure in-process logic.
Can I override FHE-IQ's routing decision?
Yes. Pass backend: "bfv" or backend: "ckks" to force a specific engine. FHE-IQ respects explicit hints over automatic routing.
What happens if isn't available on my hardware?
FHE-IQ gracefully falls back to BFV with software emulation. You get the same API response, slightly higher latency on non-ARM hardware.
Does FHE-IQ add latency to my requests?
Effectively zero. The routing decision (~400ns) is negligible compared to FHE operations (~967µs–5.98ms). It's a compile-time policy lookup, not a runtime inference.
How does FHE-IQ determine data type?
From the data_type field in your API request: "integer" routes to BFV, "float" routes to CKKS, "biometric" routes to BFV with SIMD batching.
Can FHE-IQ route different fields to different backends?
Yes. In a single request with mixed fields (integer IDs + float scores), FHE-IQ splits the workload and encrypts each field with the optimal backend.
What security tiers does FHE-IQ support?
Three tiers: h33-128 (Level 3, fastest), h33-256 (Level 5, max security), and ckks-turbo (N=8192, fast float). Set via the security_level parameter.
Is FHE-IQ a separate service?
No. It's compiled into the H33 binary. Zero network hops, zero deployment overhead. Every H33 API call goes through FHE-IQ's routing layer.
How do I monitor which backends are being selected?
The API response includes backend_selected, routing_reason, and latency_breakdown fields. Dashboard analytics show routing distribution over time.
TECHNICAL DEEP DIVES

Go Deeper

Stop Configuring FHE Parameters.
Start Encrypting.

One API call. Optimal backend. Post-quantum security. Your data never decrypted.

View Per-Auth Pricing →
🧠 AI-Adaptive Routing
🔒 128-bit NIST Level 1
<500ns Routing Decision
62 Fabric Tests
🛡 Session-Sticky Ciphertexts
H33 FHE Deep Dive →
Verify It Yourself