# Crypto Collectors

Most connectors bring Mesh **identities** — people, service accounts and the
access they hold. Crypto collectors bring something different: the
**cryptographic assets** in your estate, such as certificates and the issuers
that sign them.

They exist because post-quantum readiness is measured over things that are easy
to lose track of. Somebody sets a cluster certificate up — as a `Certificate`
resource, or an annotation on an Ingress — and from then on it is issued and
renewed without anyone looking at it again. It never appears in an identity
system, and its key algorithm is decided by configuration written once, which
is exactly what makes it easy to miss when you need to know what is in use.

What a crypto collector gathers feeds the same place your other data does: the
crypto asset inventory, and the **PQC Readiness Index** on your dashboard.

## Available collectors

| Collector | What it inventories |
|---|---|
| [Kubernetes](./kubernetes/index.md) | cert-manager `Certificate` and issuer resources in your clusters, and the container images of the workloads running there |
| [Amazon Web Services](./aws/mesh-setup.md) | Certificates in ACM and IAM, KMS encryption keys and their rotation, load balancer TLS settings, and optionally S3 storage encryption, in the regions you name |

## What they have in common

Every crypto collector in this section is **read-only**, and each one asks for
the narrowest access that lets it do its job:

- **Credentials you create and control.** You provide the credential, scoped as
  narrowly as you want, and you can withdraw it at any time.
- **No private key material.** Collectors read certificate *metadata* — key
  algorithm, key size, validity, issuer — never the private keys themselves.
- **No changes to your systems.** Collection reads. It never creates, modifies
  or deletes anything in the system it is collecting from.

Where a specific collector narrows this further, its own page says so.

## Adding one

Crypto collectors are added the same way as any other connector, from
**Settings › Connectors**. See [Add a connector](../index.md#add-a-connector)
for the general flow, then the collector's own page for the fields it needs.