Is HSBC quantum-safe?
Partly. 154 of 225 public servers under hsbc.com use post-quantum key exchange, the protection against traffic recorded today being decrypted once a large quantum computer exists. Grade B. Scanned October 18, 2026.
Grade
B
Quantum-safe
68%
Servers reached
225
Fix first
9
Fix first
Production login, API, VPN, payment and developer servers that still rely on key exchange scheduled for retirement.
- api-platform-pprd.business.us.hsbc.com
- api.expressfinance.business.hsbc.com
- api.ob.hsbc.com.cn.gslb-hk1.hsbc.com
- app-ukivr.business.hsbc.com
- app.mail.insight.business.hsbc.com
- secure-mail.hsbc.com
- secure-mail1.hsbc.com
- secure-mail2.hsbc.com
- secure-mail3.hsbc.com
62 other servers without post-quantum key exchange
- ac3.vpn.us.hsbc.com
- aimax.gbm.hsbc.com
- aimax5.gbm.hsbc.com
- aipex.gbm.hsbc.com
- aipex5.gbm.hsbc.com
- aipex6.gbm.hsbc.com
- aipexar.gbm.hsbc.com
- apply.careers.hsbc.com
- assetmanagement.hsbc.com
- cdntm.ciiom.hsbc.com
- cdntm.expat.hsbc.com
- cdntm.us.hsbc.com
- consent.sandbox.hsbc.com
- create-library.hsbc.com
- develop.hsbc.com
- email.ciiom.hsbc.com
- emailalerts.hsbc.com
- engineering.hsbc.com
- events.business.hsbc.com
- events.data.hsbc.com
- events.hsbc.com
- evlayer-dev.gbm.hsbc.com
- evlayer-sit.gbm.hsbc.com
- evlayer-uat.gbm.hsbc.com
- evlayer.gbm.hsbc.com
- evolve.us.hsbc.com
- exconnect.us.hsbc.com
- expatexplorer.hsbc.com
- fps.dms.gbm.hsbc.com
- getmtgquote.us.hsbc.com
- gis.hsbc.com
- history.hsbc.com
- homeandaway.hsbc.com
- hsbc.com
- identify.expat.hsbc.com
- inclusion.hsbc.com
- indices.gbm.hsbc.com
- mobiletunnel.hsbc.com
- mycareer.hsbc.com
- myday-preprod.hsbc.com
- myday.hsbc.com
- origin-nio-uat.hsbc.com
- origin-nio.hsbc.com
- origin-www.us.hsbc.com
- pac-info.us.hsbc.com
- privatebanking.hsbc.com
- rdc9.us.hsbc.com
- rdc9dev.us.hsbc.com
- rdc9uat.us.hsbc.com
- semfi-preprod.hsbc.com
- semfi-uat.hsbc.com
- stream.data.hsbc.com
- tools.us.hsbc.com
- tx-cds.fguk.hsbc.com
- tx-ftps.fguk.hsbc.com
- uk.api.evolve.hsbc.com
- virtualcard.eu.hsbc.com
- virtualcard.us.hsbc.com
- volunteering.hsbc.com
- www.gis.hsbc.com
- www.history.hsbc.com
- www.inclusion.hsbc.com
154 servers already protected
- about-sit.us.hsbc.com
- about-uat.us.hsbc.com
- account.ideahub.hsbc.com
- api-dev.dms.gbm.hsbc.com
- api.dms.gbm.hsbc.com
- api.hsbc.com
- api.securities-services.gbm.hsbc.com
- api.smartserve.hsbc.com
- apply-glcm.gbm.hsbc.com
- autopilot-rp-sy.hsbc.com
- autopilot-rp.hsbc.com
- bahrainservice.hsbc.com
- beta.developer.hsbc.com
- brokerage-ao.us.hsbc.com
- business-sit.hsbc.com
- business-sit.us.hsbc.com
- business-uat.hsbc.com
- business-uat.us.hsbc.com
- business.hsbc.com
- businessgo-sit2.hsbc.com
- businessgo-sit3.hsbc.com
- businessgo-uat1.hsbc.com
- businessgo-uat2.hsbc.com
- businessgo-uat3.hsbc.com
- businessgo.hsbc.com
- cdnbc-logs.us.hsbc.com
- cdnbc-wup.ciiom.hsbc.com
- cdnbc-wup.expat.hsbc.com
- cdnbc-wup.us.hsbc.com
- ciiom.hsbc.com
- clsplus.gbm.hsbc.com
- cop.openbanking.hsbc.com
- corporate-api.hsbc.com
- crs-uat.hsbc.com
- crs.hsbc.com
- currencyzone.hsbc.com
- cwasp-dev-01.hsbc.com
- cwasp-dev-02.hsbc.com
- dart.gbm.hsbc.com
- dco-ao-ntb.us.hsbc.com
- dco-ao.us.hsbc.com
- dco-cc-lp.ciiom.hsbc.com
- dco-cc.us.hsbc.com
- dco-form-cc-uat.hsbc.com
- dco-form-cc.hsbc.com
- dco-form-ccla.hsbc.com
- dco-form-cref.hsbc.com
- dco-form-cus.hsbc.com
- dco-form-loans.hsbc.com
- dco-form-plg.hsbc.com
- dcs.gbm.hsbc.com
- developer.hsbc.com
- direct.nio-uat.hsbc.com
- direct.nio.hsbc.com
- diva-client-ap.hsbc.com
- diva-client-eu.hsbc.com
- diva-client-us.hsbc.com
- diva-service-ap.hsbc.com
- diva-service-eu.hsbc.com
- diva-service-us.hsbc.com
- easyid-dev.us.hsbc.com
- easyid-int.us.hsbc.com
- easyid.us.hsbc.com
- ecom-was2s.fguk.hsbc.com
- egyptmarketing.hsbc.com
- egyptservice.hsbc.com
- europe.business.hsbc.com
- evlayer-nft.gbm.hsbc.com
- ews-hk.hsbc.com
- expat.hsbc.com
- fatca-uat.hsbc.com
- fatca.hsbc.com
- fr-int.gfx.gbm.hsbc.com
- fr.gfx.gbm.hsbc.com
- gbm-dart-sy.hsbc.com
- gbm-dart-wdc.hsbc.com
- gbm.hsbc.com
- gtff2.hsbc.com
- hrdirect-trsl.hsbc.com
- ico-ao-sit.us.hsbc.com
- ico-ao-uat.us.hsbc.com
- ico-ao.us.hsbc.com
- ideahub.hsbc.com
- insightshub.hsbc.com
- interact-uat.hsbc.com
- interact.hsbc.com
- kuwaitbusiness.hsbc.com
- lp.dco-form-cc.hsbc.com
- m.dev.mobile15.hsbc.com
- m.expat.hsbc.com
- m.mobile15.hsbc.com
- m.us.hsbc.com
- media.hsbc.com
- myassist.hsbc.com
- nio-uat.hsbc.com
- nio.hsbc.com
- omanmarketing.hsbc.com
- omanservice.hsbc.com
- partner-api.hsbc.com
- portal.careers.hsbc.com
- portal.dms.gbm.hsbc.com
- qatarmarketing.hsbc.com
- qatarservice.hsbc.com
- rbwm-api-nl.us.hsbc.com
- rbwm-api-vh.us.hsbc.com
- rbwm-api.us.hsbc.com
- research.hsbc.com
- rewards.us.hsbc.com
- safeguard.hsbc.com
- securemail.hsbc.com
- securemail.us.hsbc.com
- security-lp.us.hsbc.com
- sit.smartserve.hsbc.com
- smartserve.hsbc.com
- test.dcs.gbm.hsbc.com
- tfx.gfx.gbm.hsbc.com
- tfx2.gfx.gbm.hsbc.com
- tms.data.hsbc.com
- tx-https.fguk.hsbc.com
- tx-was2s.fguk.hsbc.com
- tx-whttps.fguk.hsbc.com
- tx-wssp.fguk.hsbc.com
- tx1-https.fguk.hsbc.com
- tx1-wssp.fguk.hsbc.com
- tx2-https.fguk.hsbc.com
- tx2-wssp.fguk.hsbc.com
- uae-marketing.hsbc.com
- uaemarketing.hsbc.com
- uaeservice.hsbc.com
- uat.research.hsbc.com
- uat.smartserve.hsbc.com
- us.hsbc.com
- wpb.ciiom.hsbc.com
- wpb.expat.hsbc.com
- www.about.us.hsbc.com
- www.bahrain.hsbc.com
- www.business.hsbc.com
- www.businessgo.hsbc.com
- www.ciiom.hsbc.com
- www.concierge.hsbc.com
- www.crs.hsbc.com
- www.dart.gbm.hsbc.com
- www.etf.hsbc.com
- www.expat.hsbc.com
- www.fatca.hsbc.com
- www.gbm.hsbc.com
- www.hsbc.com
- www.life.hsbc.com
- www.qatar.hsbc.com
- www.research.hsbc.com
- www.syndicate.hsbc.com
- www.uaeservice.hsbc.com
- www.us.hsbc.com
- www.ventures.hsbc.com
What this means
NIST has scheduled the key exchange most servers still use for retirement: deprecated after 2030, disallowed after 2035 (NIST IR 8547). Traffic recorded today can be decrypted once a large quantum computer exists. A server that offers hybrid ML-KEM key exchange closes that today; a server that does not is still open to harvest now, decrypt later.
Hostnames come from public certificate logs plus common service names, kept where the name resolves to a public address, and each is tested from the outside with post-quantum-only TLS 1.3 handshakes. A hostname shows what a server is called, not what traffic it carries; internal systems are out of scope. Method.
Work at HSBC?
Fleet Watch gives you this scan privately every week, with your suppliers and a report your auditor can verify. The first scan is free.
Scan your own domainBadge
Shows the current grade and updates itself. Anyone may embed it.
<a href="https://latticescan.com/readiness/hsbc.com"><img src="https://latticescan.com/badge/readiness/hsbc.com" alt="quantum readiness"></a>