Every question, answered.

A post-quantum encrypted messenger and the ecosystem around it. Every conversation is sealed end-to-end: a hybrid ML-KEM-1024 + X25519 key agreement, ChaCha20-Poly1305 (RFC 8439) authenticated encryption, ML-DSA-87 identity signatures. The server is a carrier — it moves ciphertext it cannot read.

We carry the message. We hold nothing.

Κῆρυξ — kêrux — is ancient Greek for herald: the messenger whose word was inviolable by divine law. Intercepting a herald was sacrilege. QERYX is Q + Kéryx, the post-quantum stamp on the herald. The word survives in kerygma — the proclamation of truth.

Entangled describes what the protocol does. The four-chain Q-Ratchet advances a session secret that exists on both devices at once and is mathematically inseparable between them — a copy of one side without the other is dead bytes.

We do not claim literal quantum-mechanical entanglement. The primitive is named, and the claim stops where the code stops.

QERYX is founder-operated: one engineer of record signs every commit. The audits, protocol specs, and evaluation evidence are published so you never have to take the builder's word for it. Start at About and the Trust Center.

On our own stack — MixcoatlDB, GlyconCache, QSFS — on servers in Nuremberg, Germany, under EU jurisdiction. Infrastructure details belong to the Trust Center.

Nobody pays for v1. It is an invited cohort, the app carries no purchase surface, and every invited account carries every capability in this build.

When the tiers open there is no free seat — three paid tiers, Philanthropic, Armed, Shadow, every one of them carrying the full crypto. Higher tiers unlock new tools, never better locks. See pricing.

Yes. End-to-end encryption is a property of both ends: the hybrid ML-KEM-1024 + X25519 handshake runs between two QERYX devices, and the keys exist nowhere else. There is no SMS bridge and no gateway into other networks — a downgraded lane would become the lane an adversary picks every time.

Bringing someone in is one step: share your public Profile ID, and the first sealed message is the moment the conversation exists.

One account per person, one device per identity. Each person needs their own invite code, and every conversation runs the same hybrid ML-KEM-1024 + X25519 handshake regardless of whose seat it is. See the tiers.

iOS registration is invite-gated: the relay refuses a registration without a code. Get codes for the people you message, since the seal needs both ends. Share Profile IDs, open a group, and names, subjects, and every word travel sealed end-to-end.

A hybrid handshake: ML-KEM-1024 (FIPS 203) and X25519 together, so reading a session requires breaking both. Message keys ratchet forward with Q-Ratchet — one fresh key per message — derived through HKDF-SHA-512. Content is sealed with ChaCha20-Poly1305 (RFC 8439). Identities are signed with ML-DSA-87 (FIPS 204).

ML-KEM-1024 is a lattice-based key encapsulation standardized in FIPS 203 at Category V, chosen because traffic recorded today can be stored and decrypted by a future quantum computer. The classical X25519 half stays in the handshake so the hybrid never rests on a single assumption.

For recorded traffic, they already do: harvest-now-decrypt-later is a present-tense collection problem, and the CNSA 2.0 national-security gate lands 2027-01-01. The hybrid ML-KEM-1024 floor answers the deadline, not a mood.

Every session key can additionally be bound to a CHSH-verified, Tsirelson-window-validated Bell-game transcript both peers seed and any auditor can verify — and to an operator-signed transcript from real quantum processors where the v2 lane is active. Bell-binding sits above the hybrid floor, never below it: breaking a session requires breaking both X25519 and ML-KEM-1024.

CNSA 2.0 — asymmetric core conformant (ML-KEM-1024 + ML-DSA-87 at Category V; SHA-512 at or above the hash floor). Production AEAD today is ChaCha20-Poly1305 (RFC 8439), a documented deviation; the AES-256-GCM NSS suite is implemented and reserved as suite 0x0002, staged for rollout. Pre-evaluation checklist: 0 non-conformant findings, 3 documented deviations (NIAP ETR, 2026-05).

CNSA 2.0 disallows QKD for national security systems. QERYX's quantum work binds a KDF to a verifiable measurement and never replaces the classical floor.

Constant-time performance on every device, with or without AES hardware, and a smaller side-channel surface. The deviation is documented, not hidden — the CNSA statement above carries it verbatim, and the AES-256-GCM suite is implemented and staged as suite 0x0002.

Algorithm-conformant; implemented via a library lineage holding FIPS 140-3 cert #4631. QERYX's own module is not yet CMVP-certified. Test vectors are pinned; module validation is a different claim, and we do not make it.

The NIAP Common Criteria pre-evaluation (ETR, 2026-05) closed at READY WITH DEVIATIONS — not a completed EAL 4+ certification. Deviations are enumerated; formal evaluation is in progress. The evidence bundle an evaluator would read lives in the Trust Center.

Key encapsulation runs on the FIPS-lineage library, clear of the KyberSlash class of decapsulation-timing flaws published against early lattice reference code. Verify paths use constant-time comparison, and leakage is measured with test-vector leakage assessment (TVLA); the evidence sits in the evaluator bundle at /trust.

Protocol drafts are authored (draft-qeryx-*-00/-01); submission packages are prepared. Wire formats, test vectors, and design specs publish at /research as they land — dated, versioned, with a what-changed log.

Not yet, and we say so. Machine-checked symbolic modeling of the handshake and ratchet composition is planned; today the security arguments anchor to the standards and the published analyses. When a proof exists it will be linked, not paraphrased.

No. The server is a dumb encrypted blob relay. It cannot read messages. Keys exist only on your devices.

Live, undelivered messages: ciphertext blobs plus routing metadata under the published retention ladder. Delivered messages: erased rows. Destroyed conversations: a retired envelope epoch — the wrap key no longer exists. Reading content requires breaking both X25519 and ML-KEM-1024.

Group names, subjects, avatars, and all content are end-to-end encrypted; the relay holds only opaque routing identifiers; sender identifiers are stripped from the stored message row (sealed-sender v2), though the relay still authenticates the sender at send time. Undelivered messages queue with routing metadata under a published retention ladder.

The outer envelope is addressed to the recipient alone; the sender's identity is readable only after decryption. Sender identifiers are stripped from the stored message row (sealed-sender v2), though the relay still authenticates the sender at send time, and the relay routes by opaque identifiers.

There is no lawful-access endpoint because there is no plaintext or metadata store to endpoint. Formal posture: NIAP READY WITH DEVIATIONS — not a completed EAL 4+ certification. Deviations are enumerated; formal evaluation in progress.

Deleting a conversation retires its envelope epoch — the wrap key stops existing. Deleting your account revokes your keys in the transparency log and hard-deletes your server-side record with no grace period.

Messages already delivered to your contacts live on their devices. Deletion cannot reach into someone else's phone, and we will not pretend otherwise.

You hold two identifiers. The Profile ID is public — share it with anyone you want to reach you. The SERPENT ID is secret: it never appears in chat and never leaves ceremony surfaces. Discovery is by what you choose to share.

No. Backups are encrypted on your device, and the recovery passphrase is stretched with Argon2id (m=512 MiB, t=2, p=4) before it touches a key. Without your passphrase the backup is noise to everyone — including us.

With an invite code. Registration is gated: the app takes an XXXX-XXXX code before it will create an identity, and the relay refuses a registration without one. A used or expired code is refused at the gate, before you have chosen a name.

Nothing about the code says who you are. Your identity is an ML-DSA-87 keypair generated on your device. Request an invite.

We cannot recover your messages or your account if you lose your device and your Secret Phrase. There is no key-escrow and no master reset.

With the passphrase, recovery is three steps: recover your access.

No. Only you hold it. A reset path for us would be a reset path for anyone who could compel us — the absence is the feature.

Install QERYX on the new device, choose Restore, and enter your Secret Phrase; the backup decrypts on-device. The full procedure with its honest limits: recover your access.

One device per identity today; linked devices are on the roadmap. The carrier model makes multi-device harder on purpose — recovery state cannot be centralized server-side.

Open the chat, tap your contact, and compare the safety number in person or over a call you already trust. Key changes surface in the key transparency log, so a swapped key is a visible event, not a silent one. Full ceremony: verify your keys.

Settings → Account → Delete. This revokes your keys in the transparency log and hard-deletes your server-side record with no grace period. Step by step: delete and rotate.

Yes. Settings → Identity rotates your secret SERPENT ID or your public Profile handle; the old identity is retired in the transparency log. Your history stays on your device.

Nobody pays for v1 — it is an invited cohort, and every invited account carries every capability in this build. The question is about the ladder that opens after it.

When the tiers open there is no free seat: no ads, no data sales, and no telemetry product to fall back on, so the subscription is the entire business model. A free seat is paid for somewhere, and the currency is usually the person sitting in it.

Nothing yet. v1 is an invited cohort and the app sells nothing — no purchase screen, no checkout, no receipt path. Philanthropic, Armed, and Shadow are the shape of the ladder; the numbers publish here the day they are real.

The ladder is additive either way — every tier carries the full messenger at maximum capability. See the tiers.

No. A session between two people is as strong as its weakest end, so every existing feature runs at maximum capability for everyone. Higher tiers unlock new capabilities — apps, tools, modes — and never upgrade a primitive you already had.

Nothing is billed in this build, so nothing downgrades yet. When the tiers open, retiring one is a billing-state change and never a data event: identity keys, IDs, history, contacts, vault, mail, and memberships are preserved. Locked ecosystem tiles stay visible with the unlock named on the face — the app never shrinks behind your back.

Government and defense enrollment runs through procurement: fleet agreements with an evidence package your evaluators can verify line by line. It is a lane, not a fourth price card. Start procurement.

There is nothing to manage. v1 takes no money: the app carries no purchase surface, and the checkout rail refuses before a session is minted. When billing opens it runs in-app, in Settings, and a web checkout and account area follow.

Billing questions still reach a human at support@qeryx.com — billing, stated plainly.

The ecosystem around the messenger: QLEAP VPN, Qaduceus, QVault, QMail, QWallet, and bundled HydraSIM data. Of those, Qaduceus is the one in this build; QLEAP, QVault, QMail, and QWallet are not.

Armed is for everyone — the name means readiness, and when the ladder opens it funds the floor tier's independence from ads and data sales.

The Underground: QSeal, Shadow ID, and Ghost Serpent — sealed work above the messenger floor. The compartment is not in this build; it opens after v1.

The messenger itself gains nothing it did not already have. Shadow adds rooms, never better locks.

Three-hop onion-routed circuits with a fresh ML-KEM-1024 encapsulation per hop and an ML-DSA-87-signed relay directory your device checks against a pinned key. Each hop peels exactly one layer.

It is not in this build: iOS gates the packet-tunnel provider entitlement on an Organization Team ID. The relays, the directory, and the per-hop KEM are in the tree today. QLEAP.

An eSIM provisioned through QERYX with pay-as-you-go data — load what you need, when you need it. Live carrier provisioning is not enabled on this server yet: the courier reports the server’s provisioning rung honestly and never invents a session.

When the ladder opens, Armed bundles 3 GB/month and Shadow carries unlimited data. Capabilities ship at the tier the code implements, and the page says which. HydraSIM.

The QERYX assistant, shipped as a research preview and mapped to Armed on the ladder. The framing is deliberate: it does what the build does, and the page claims nothing past that. Qaduceus.

The QERYX browser, in development. The page is a waitlist and a spec, and it says so plainly. Wadjet.

Email support@qeryx.com with what you did, what you expected, and what happened. Crash reports are opt-in and processed on-device — you attach only the details you choose to share.

Email security@qeryx.com — the address published in our security.txt. We practice coordinated disclosure and will not pursue good-faith researchers. Procedure and safe harbor: report a vulnerability.

press@qeryx.com. The press kit and materials live at /press.

Write to support@qeryx.com. A human reads every message, and the questions we keep receiving get added to this page.