Company
Sovereignty is a design decision.
A messenger answers to whoever holds its keys, its names, and its clocks. We are building to hold our own — and this page states, layer by layer, what is built and what is still road.
Hold less, and there is less to compel
The server is a dumb encrypted blob relay. It cannot read messages. We engineer the instrument to its maximum, hand it to you, and walk away — the math forbids us from reaching over your shoulder, and we built the math on purpose.
Why an operator would choose to hold less
Whatever an operator holds, an operator can be compelled to produce. A subpoena, a hostile acquisition, a pressure campaign — each one resolves against what is actually on disk. Our design goal is that the answer is ciphertext and opaque routing identifiers, with undelivered messages queuing under a published retention ladder.
The zero-knowledge page walks the whole model, including what the relay does hold and for how long.
Read every layer with its state on it
Every dependency is a door someone else holds. This ledger names each layer we are taking ownership of — in the present tense where it is built, as roadmap where it is not. No row ships on faith.
-
Relay
BuiltSealed ciphertext will move through it; the relay cannot read it.
-
Stack
Builtcrypto-core, our own cryptographic library, over a database, cache, and object store we will run ourselves — MixcoatlDB, GlyconCache and QSFS are our names for those deployments and their hardening, not new engines.
-
Jurisdiction
BuiltOur own hardware in an EU data center.
-
Builds
PartialThe build-attestation manifest format is in the tree (ML-DSA-87, ctx QERYX-attest-v1) and signs build outputs; the endpoint that serves it answers when a release provisions one, and the update-authenticity trust-root registry is not yet claimed.
-
Names
RoadmapOur own DNS and DoH resolution, so no registrar decides whether we resolve.
-
Certificates
RoadmapA post-quantum root CA path with DANE/TLSA pinning.
-
Time
RoadmapMultiple independent time sources — Roughtime, an NTP quorum, our own clock.
-
Distribution
RoadmapMore than one road to the binary; each channel is listed here only once it opens.
How to read BUILT, PARTIAL, ROADMAP
BUILT means in place on our own hardware. PARTIAL means built in part, with the gap named in the row. ROADMAP means a commitment we have made and not yet met. When a row changes state, the ledger changes — never the other way around.
Take the floor at maximum, for everyone
The security of a session is the minimum of the security of both ends, so the floor is maximal for everyone. New instruments arrive beside it; none upgrades the crypto you start with.
Read Armed as a state, never as a uniform
Armed is a state of protection, not a uniform. Families, founders, journalists, and the people who defend them get the same floor, the same primitives, the same maximum parameters — protection is not a demographic.
And the arrival stance matches: when QERYX arrives, it arrives worldwide or not at all — no country ladder, no waitlist by passport.
05 / THE HARD QUESTIONS
Ask the three that test a mission.
Is this a military product?
It is a civilian messenger with an engineering bar high enough that governments can evaluate it — the evaluation surface exists for exactly that review. The face of the product is peace-forward and for everyone; the discipline underneath is what makes that face honest.
Why build your own database, cache, and file store?
Because a dependency is a decision someone else makes about your threat model. The Sovereign Stack pages — MixcoatlDB, GlyconCache, QSFS, crypto-core — document each component and what it replaces.
What happens when a claim stops being true?
The page changes the same day the truth does. Status here is stated true-or-absent — a stale badge is treated as a defect of the same class as a failing test.