Compare — QERYX

01 / THE VERDICTS — NINE WORKLOADS, THREE ARCHITECTURES

Run nine real workloads against three architectures.

Workloads, by architecture — categories, never brands
When the state comes asking
	QERYX	Classical E2E	SMS & carrier
A subpoena for your words	Yields sealed ciphertext and opaque routing identifiers. The relay cannot read messages — there is no plaintext to produce.	Content is end-to-end encrypted; queued ciphertext and account records exist to produce, under each operator’s retention policy.	Message content is available in plaintext from the carrier.
A subpoena for who you talk to	Sender identifiers are stripped from the stored message row (sealed sender), though the relay authenticates the sender at send time. Undelivered messages queue with routing metadata under a published retention ladder.	Delivery routing and account metadata are visible to the operator; sealed-sender designs narrow this for some traffic.	Numbers, timestamps, and cell locations are core carrier records.
The server itself, seized	A seized relay yields ciphertext it cannot open. Group names, descriptions, and all content are end-to-end encrypted; the roster it delivers to and the group avatar are held for routing, and each photo or file is held, encrypted, with an upload record that names its uploader, for up to 45 days after upload.	A seized server yields ciphertext plus whatever queues and metadata the operator holds.	The carrier core is the record — content and metadata both.
When the future attacks the past
Your traffic, recorded today, decrypted later	Every session is keyed by hybrid ML-KEM-1024 (FIPS 203) + X25519. Reading a recorded session requires breaking both.	Classical elliptic-curve agreement is the class boundary: a recorded handshake becomes readable once a cryptographically relevant quantum computer exists.	There is no end-to-end encryption to break. The recording is already readable.
A key stolen from your device today	Q-Ratchet advances a fresh key for every message: yesterday stays sealed, and the session heals forward.	Double-ratchet designs heal the same way — forward secrecy is this class’s real strength.	There are no message keys. Content is plaintext in carrier custody.
When you live your day
Signing up	No phone number. Identity keys (ML-DSA-87) are generated on your device.	Most of the class requires a phone number; some offer usernames above it.	Your identity is the phone number.
A group of your people	Group names, subjects, and every word sealed end-to-end; the relay holds opaque routing identifiers and the group's avatar image.	Group content is generally encrypted; roster and group-metadata handling varies by operator.	Group texts fan out in plaintext.
A voice call	Keyed by the same hybrid handshake as your messages and routed through the relay, keeping your address out of your peer’s view.	Calls are encrypted; direct peer-to-peer paths can expose your IP address to the other side.	Carrier calls are unencrypted on the network core.
Deleting a message	The relay deletes a delivered message within about 25 minutes of its delivery receipt; a group message, sealed to each member by default, and one read with Stealth Mode on or read receipts off wait for the 30-day horizon, and a photo or file stays stored apart up to 45 days after upload. A disappearing message will leave each phone on your schedule; the timer opens once a two-phone test passes.	Disappearing timers are common; server queues persist under operator policy.	There is no deletion. The carrier copy remains.

Column definitions: "Classical E2E" is the class of messengers whose key agreement is classical elliptic-curve cryptography with operator-held delivery queues; "SMS & carrier" is telephone-network messaging and calling. Products that add post-quantum key encapsulation on top of a classical design sit between the first two columns — the rows above describe each class boundary, not any single product.

Hold nothing readable, and the subpoena column writes itself

The server is a dumb encrypted blob relay. It cannot read messages. Delivered envelopes are deleted within about 25 minutes of their delivery receipt; undelivered ones, group messages sealed to each member, and ones read without a receipt queue with routing metadata under a published retention ladder; photos and files are stored apart, encrypted, for up to 45 days after upload. Every answer in the subpoena column follows from that one design decision.

Key every session hybrid, and the past is included

Hybrid ML-KEM-1024 + X25519 keys every session, so the recording attack — capture now, decrypt when quantum computers mature — has to beat both the post-quantum and the classical component. National migration deadlines exist because that recording is already happening; the floor here is built for it.

Read the rows where the classical class stands equal — or ahead

A comparison that cannot lose is marketing. Three rows where the other column earns its mark:

01

Forward secrecy

Double-ratchet designs in the classical class heal from key theft the same way Q-Ratchet does. That row is a tie, and we print it as one.
02

Multi-device

Mature linked-device support ships across the classical class. QERYX is one device per identity at first; linked devices are on the roadmap, and the carrier model makes them harder to build well.
03

Published formal proofs

Parts of the classical class carry machine-checked proofs of their handshakes. Our security arguments anchor to standards and test evidence; formal modeling of the full ratchet is in progress, not in hand.

05 / THE HARD QUESTIONS

Ask the four that break a comparison.

Why are there no brand names on this page?

Because the argument is architectural, and architectures are what you can verify. A named competitor provokes a version war over yesterday's feature list; a class boundary stays true as products move. Every QERYX cell anchors to the security overview and the Trust Center.

Is SMS really that exposed?

Yes, structurally: carrier messaging is not end-to-end encrypted, and the network that carries it also records it — content, numbers, timestamps, and tower locations. That is a description of the architecture, not an accusation against any carrier.

Some classical messengers added post-quantum keys. Does the column still hold?

The column describes the classical class boundary, and the note under the table says exactly that: products adding post-quantum encapsulation sit between the columns. The rows that separate QERYX remain the carrier model — what the server holds — and the hybrid floor on every session, not a single primitive swap.

Where does QERYX trail?

Multi-device (one device per identity at first) and published formal proofs of the full ratchet (in progress). They are printed above, in the same type size as the wins.

The architecture is the argument.

Read the primitives, then decide — that order, always.

Security overview

Next: the security overview