The Quantum Framework ships CRUDL REST APIs, policy-driven security, and governed data access on Quarkus and MongoDB — so you model your domain instead of rebuilding auth, querying, and tenant isolation for the tenth time. It's the same framework behind Helixor's own platform services.
CRUD endpoints, permission checks, a query API, reference data, tenant isolation — every serious backend ends up building the same handful of things, usually more than once, usually under time pressure, usually slightly differently in every service.
Model, repository, REST resource, validation, pagination, Swagger docs — written again for every table, in every service, because there's no framework guarantee that extending a base entity gets you all of it for free.
if (user.role == ...), copied into the next controller.Permission logic embedded in handler code can't be audited as a set of rules — it can only be read, line by line, controller by controller, and hoped to be consistent.
Every environment ends up with its own ad hoc insert script for reference and test data, with no consistent way to version it, replay it, or know what changed between environments.
WHERE tenant_id = ? that someone eventually forgets.Without isolation built into the persistence layer itself, every new query is a new chance to leave the filter off — and the bug doesn't show up in testing, it shows up as one customer seeing another customer's data.
The Quantum Framework sits under every model as a Quarkus + MongoDB backend where the REST API, security, and query access are framework guarantees, not app-level conventions. Extend a base entity and the repository, REST resource, and permission enforcement come with it — enforced identically whether it's the first model in the app or the hundredth.
Inheritance, embedding, references, and geospatial data are first-class, plus ontology annotations (@OntologyClass, @OntologyProperty) when you want your schema to double as a queryable model of your domain.
RuleContext and PermissionRuleInterceptor govern every read and write, including realm-based tenant scoping when you need it. Rules are declared once per functional domain and action, and enforced identically everywhere, instead of copy-pasted through handlers.
A single collection-agnostic query facade with a shared filter grammar, joins, and governed results — instead of a bespoke search endpoint hand-built for each entity.
Extend BaseModel and you get a Morphia repository and a REST resource with Swagger/OpenAPI documentation for free. Entity modeling covers inheritance, embedding, references, and geospatial data.
Apache-2.0 covers everything needed to ship a real multi-tenant product. Enterprise is additive: centralized provisioning, identity, coordination, and orchestration for teams running Quantum across many tenants and environments.
| Capability | Open Source | Enterprise |
|---|---|---|
| Runtime & persistence | ||
| Quarkus runtime (Kubernetes-native, GraalVM native-image) | ✓ | ✓ |
| MongoDB persistence via Morphia, replica-set transactions | ✓ | ✓ |
| Security & access control | ||
Realm-based multi-tenancy + DataDomain segmentation | ✓ | ✓ |
Policy-driven security (RuleContext, PermissionRuleInterceptor) | ✓ | ✓ |
| JWT / JWKS authentication, pluggable providers (self-managed issuer) | ✓ | ✓ |
| Consolidated identity service (OIDC discovery, GitHub OAuth login, self-serve tenant signup, service tokens) | — | ✓ |
| Data & APIs | ||
| CRUDL REST APIs + Swagger/OpenAPI per model | ✓ | ✓ |
QueryGateway governed, collection-agnostic query API | ✓ | ✓ |
| Ontology annotations for per-app closed-schema modeling | ✓ | ✓ |
| Central ontology governance service (cross-application TBox/vocabulary admission) | — | ✓ |
| Seed packs and data migrations | ✓ | ✓ |
| Operations at scale | ||
| Centralized tenant/user/application provisioning across environments | — | ✓ |
| Distributed coordination for independently scheduled workers (claims, fencing, barriers) | — | ✓ |
| Workflow and job orchestration, action-enablement models | — | ✓ |
| Integration & UI | ||
| Enterprise integration suite (Apache Camel routes, EDI) | — | ✓ |
| Managed filesystem / object storage module | — | ✓ |
| Reference operator UI and enterprise UI component kit | — | ✓ |
| Client modules connecting to Helixor's AI/reasoning services | — | ✓ |
| Licensing & support | ||
| License | Apache-2.0 | Commercial |
| Support | Community (GitHub) | Vendor-backed |
| Cost | Free | Contact sales |
The framework doesn't just authenticate a request, it resolves what that request is allowed to touch: whether the action is permitted, which fields it can read, and whether the object it's acting on is even in a state that allows it — tenant scoping is one more rule the same engine enforces, not a separate system bolted on. This is illustrative traffic, not a customer's real data, but it's the same shape of feed RuleContext produces against a live Quantum Framework backend.
The open-source core is free today — clone it and start building. Enterprise is sales-assisted; tell us about your project and we'll set up time to walk through the Enterprise modules.
View on GitHub