7.0 HydraSIM
A sovereign eSIM with six-bearer failover.
Instant eSIM with global data and six-bearer failover, engineered to keep you reachable when a network disappears.
eSIM provisioning and data are live today. Automated number rotation is in development.
- eSIM provisioning — live
- Number rotation — in development
- Self-capping privacy audit
- Session floor ML-KEM-1024 + X25519
- AEAD ChaCha20-Poly1305
- 6-bearer registry HYDRA
- Honest rung rotationReal:false
01 / THE FAILOVER LADDER — LIVE
Take a bearer down. The message keeps moving.
One eSIM. Six ways to stay reachable.
Tap a bearer to take it down. The ladder re-ranks and the message keeps moving — when every bearer is gone, sends queue and deliver on the first one back.
Authored demo states — no live coverage or telemetry is drawn here. The six bearers are the shipped HYDRA transport registry. eSIM provisioning and data are live today. Automated number rotation is in development.
CELLULAR is carrying. 0 of six bearers down.
02 / THE SIM — LETTERED
Read the SIM, section by section.
The failover ladder
When one bearer dies, your traffic demotes to the next — down to radio meshes and ultrasound — without you touching anything. The six bearers are the shipped HYDRA transport registry.
- Cellular
- multi-MNO eSIM data
- Wi-Fi Direct
- peer link, no tower
- Satellite
- sky bearer, ground optional
- Epius mesh
- LoRa long-range mesh
- Bluetooth
- near-field hop
- QSONAR
- ultrasonic, when all RF is gone
When every bearer is gone, sends queue and deliver on the first one back.
The audit that caps its own score
The app runs a cellular privacy audit on itself. While the server
reports rotationReal: false, the audit caps its own score
at 94 of 1001
— the score cannot reach the rotation-dependent ceiling until number
rotation is real. The cap is enforced in the shipping code, not in
marketing copy.
- Server rung
- rotationReal: false
- Score ceiling
- 94 / 100 while rotation is off
- Enforced in
- HydraCellularPrivacyAudit.swift
No fabricated session, ever
Capability arrives as a server-reported rung. Where live carrier provisioning is not enabled on a server, the courier client renders its switching-on panel in exactly these words — and shows you no session:
Live carrier provisioning is not enabled on this server yet.
Number rotation follows the same law: it is roadmap, stated as roadmap, and the app itself says so.
What the cellular layer changes
The SIM layer is the classic compromise vector — SS7 lookups, IMSI catchers, SIM-swap, lawful-intercept gateways all key on your home-carrier binding. HydraSIM is designed to remove that binding: a cellular identity that answers to no home carrier.
It does not make cellular metadata vanish. Tower-side records exist wherever phones do — we say so — and QERYX traffic inside the tunnel stays sealed under ML-KEM-1024 + X25519 hybrid keys with ChaCha20-Poly1305, regardless of bearer.
What the eSIM layer holds
Provisioning and top-up records for the eSIM service exist and can be produced under legal process. QERYX message content stays end-to-end sealed regardless of bearer — reading a session requires breaking both X25519 and ML-KEM-1024.
The app caps its own score until the capability is real.
An audit that refuses to flatter you
Privacy scores are usually marketing. This one is a witness: it reads the server's capability rungs and locks its own ceiling below 100 while rotation is off.
When rotation ships, the cap lifts — in code, on the same screen.
The courier tells you the truth
The client never invents a session to look finished. Every capability it shows you arrived as a rung the server actually reported.
03 / THE NUMBERS — FOOTNOTED
Check every number against its receipt.
94/1001
the ceiling the app enforces on its own privacy score until number rotation is real
62
bearers in the shipped HYDRA transport registry
03
coverage figures invented for this page
| Parameter | Value | Where it lives |
|---|---|---|
| rotationReal | false — server-reported | capability rung, read by the client |
| Score ceiling | 94 / 100 while rotation is off | HydraCellularPrivacyAudit.swift |
| Switching-on panel | rendered when the provisioning rung is off | HydraCourierClient.swift |
| Session floor | ML-KEM-1024 + X25519 · ChaCha20-Poly1305 | crypto-core |
| Data model | pay-as-you-go top-up, no plan lock-in | in-app top-up |
04 / THE LAYER BENEATH — WHAT RIDES ON IT
Trace what rides on top of the bearer.
The layers above the SIM, with their own status
- QLEAP · THREE HOPS ABOVE ANY BEARER — The onion tunnel is built to ride whichever bearer is carrying, under a separate key per hop. Not in this build: the packet-tunnel provider requires an Organization Team ID.
- Q-RATCHET · SEALED REGARDLESS OF BEARER — Messages stay end-to-end sealed on cellular, mesh, or ultrasound; the bearer never touches the plaintext.
- CRYPTO-CORE · ONE RUST CORE — The same open library seals every blob before any bearer sees it.
05 / THE VERDICT — CATEGORY COLUMNS
Set a sovereign eSIM against the categories it replaces.
| QERYX HydraSIM | Classical carrier SIM | Travel eSIM class | |
|---|---|---|---|
| Real workloads | |||
| Network loss | Six-bearer demotion, down to radio meshes | Dead until coverage returns | Dead until coverage returns |
| Home-carrier binding | None | Total | Partial |
| Honesty about capability | Self-capping audit, server-reported rungs | Marketing tiers | Marketing tiers |
| Provider subpoenaed | Provisioning + top-up records; message content stays sealed | Full call records; content where lawful intercept applies | Provider-dependent |
| Number rotation | In development — said plainly | Not included | Not included |
06 / ACCESS — INSIDE THE APP
Get the SIM.
How do I get HydraSIM?
It ships inside QERYX. Install the app, open HydraSIM, and provision the eSIM in place — the same SIM at every tier, because your counterparty's weakest layer is your session's ceiling.
What does data cost?
Pay-as-you-go top-up: you see the price in the app before you confirm. No plan, no lock-in. Where a server has the provisioning rung off, the courier shows you the switching-on panel instead of a price.
What am I not getting yet?
Automated number rotation. It is in development, the app's own privacy score is capped below the rotation ceiling until it ships, and no copy on this page pretends otherwise.
07 / THE HARD QUESTIONS
Ask what the carrier still sees.
Does my number rotate?
Not yet. Rotation is in development, and the app refuses to pretend: its own privacy score is capped below the rotation ceiling until the capability is real.
What is live today?
eSIM provisioning, global data, top-up, and the failover ladder. Every claim on this page is one the shipping build makes about itself.
What does six-bearer failover mean?
When one bearer dies, traffic demotes to the next — down to radio meshes — without you touching anything.
Does HydraSIM hide me from the carrier?
It removes your home-carrier binding; it does not make cellular metadata vanish. Tower-side records exist wherever phones do — we say so — and QERYX traffic inside the tunnel stays sealed.
What can be handed over under subpoena?
Provisioning and top-up records for the eSIM service. QERYX message content stays end-to-end sealed regardless of bearer.
Why does a messenger sell a SIM?
The session floor: your counterparty's weakest layer is your session's ceiling. The cellular layer needed to come inside the trust boundary.