Compare — QERYX

01 / THE VERDICTS — NINE WORKLOADS, THREE ARCHITECTURES

Run nine real workloads against three architectures.

Workloads, by architecture — categories, never brands
When the state comes asking
	QERYX	Classical E2E	SMS & carrier
A subpoena for your words	Yields sealed ciphertext and opaque routing identifiers. The relay cannot read messages — there is no plaintext to produce.	Content is end-to-end encrypted; queued ciphertext and account records exist to produce, under each operator’s retention policy.	Message content is available in plaintext from the carrier.
A subpoena for who you talk to	Sender identifiers are stripped from the stored message row (sealed-sender v2), though the relay still authenticates the sender at send time. Undelivered messages queue with routing metadata under a published retention ladder.	Delivery routing and account metadata are visible to the operator; sealed-sender designs narrow this for some traffic.	Numbers, timestamps, and cell locations are core carrier records.
The server itself, seized	A seized relay yields ciphertext it cannot open. Group names, subjects, avatars, and all content are end-to-end encrypted.	A seized server yields ciphertext plus whatever queues and metadata the operator holds.	The carrier core is the record — content and metadata both.
When the future attacks the past
Your traffic, recorded today, decrypted later	Every session is keyed by hybrid ML-KEM-1024 (FIPS 203) + X25519. Reading a recorded session requires breaking both.	Classical elliptic-curve agreement is the class boundary: a recorded handshake becomes readable once a cryptographically relevant quantum computer exists.	There is no end-to-end encryption to break. The recording is already readable.
A key stolen from your device today	Q-Ratchet advances a fresh key for every message: yesterday stays sealed, and the session heals forward.	Double-ratchet designs heal the same way — forward secrecy is this class’s real strength.	There are no message keys. Content is plaintext in carrier custody.
When you live your day
Signing up	No phone number. Identity keys (ML-DSA-87) are generated on your device.	Most of the class requires a phone number; some offer usernames above it.	Your identity is the phone number.
A group of your people	Group names, subjects, avatars, and every word sealed end-to-end; the relay holds opaque routing identifiers.	Group content is generally encrypted; roster and group-metadata handling varies by operator.	Group texts fan out in plaintext.
A voice call	Keyed by the same hybrid handshake as your messages and routed through the relay, keeping your address out of your peer’s view.	Calls are encrypted; direct peer-to-peer paths can expose your IP address to the other side.	Carrier calls are unencrypted on the network core.
Deleting a message	Delivered messages are erased from the relay on acknowledgment; disappearing messages erase on both ends, on your schedule.	Disappearing timers are common; server queues persist under operator policy.	There is no deletion. The carrier copy remains.

Column definitions: "Classical E2E" is the class of messengers whose key agreement is classical elliptic-curve cryptography with operator-held delivery queues; "SMS & carrier" is telephone-network messaging and calling. Products that add post-quantum key encapsulation on top of a classical design sit between the first two columns — the rows above describe each class boundary, not any single product.

Hold nothing readable, and the subpoena column writes itself

The server is a dumb encrypted blob relay. It cannot read messages. Delivered envelopes are erased on acknowledgment; undelivered ones queue with routing metadata under a published retention ladder. Every answer in the subpoena column follows from that one design decision.

Key every session hybrid, and the past is included

Hybrid ML-KEM-1024 + X25519 keys every session, so the recording attack — capture now, decrypt when quantum computers mature — has to beat both the post-quantum and the classical component. National migration deadlines exist because that recording is already happening; the floor here is built for it today.

Read the rows where the classical class stands equal — or ahead

A comparison that cannot lose is marketing. Three rows where the other column earns its mark:

01

Forward secrecy

Double-ratchet designs in the classical class heal from key theft the same way Q-Ratchet does. That row is a tie, and we print it as one.
02

Multi-device today

Mature linked-device support ships across the classical class. QERYX is one device per identity today; linked devices are on the roadmap, and the carrier model makes them harder to build well.
03

Published formal proofs

Parts of the classical class carry machine-checked proofs of their handshakes. Our security arguments anchor to standards and test evidence; formal modeling of the full ratchet is in progress, not in hand.

05 / THE HARD QUESTIONS

Ask the four that break a comparison.

Why are there no brand names on this page?

Because the argument is architectural, and architectures are what you can verify. A named competitor invites a version war over yesterday's feature list; a class boundary stays true as products move. Every QERYX cell anchors to the security overview and the Trust Center.

Is SMS really that exposed?

Yes, structurally: carrier messaging is not end-to-end encrypted, and the network that carries it also records it — content, numbers, timestamps, and tower locations. That is a description of the architecture, not an accusation against any carrier.

Some classical messengers added post-quantum keys. Does the column still hold?

The column describes the classical class boundary, and the note under the table says exactly that: products adding post-quantum encapsulation sit between the columns. The rows that separate QERYX remain the carrier model — what the server holds — and the hybrid floor on every session, not a single primitive swap.

What does QERYX lose on today?

Multi-device (one device per identity today) and published formal proofs of the full ratchet (in progress). They are printed above, in the same type size as the wins.

The architecture is the argument.

Read the primitives, then decide — that order, always.

Get QERYX Security overview

Next: the security overview