INVITE ONLY
OBSERVATORY

Company

Sovereignty is a design decision.

A messenger answers to whoever holds its keys, its names, and its clocks. We are building to hold our own — and this page states, layer by layer, what is live and what is still road.

Carrier, not keeper Status: true or absent

Hold less, and there is less to compel

The server is a dumb encrypted blob relay. It cannot read messages. We engineer the instrument to its maximum, hand it to you, and walk away — the math forbids us from reaching over your shoulder, and we built the math on purpose.

Why an operator would choose to hold less

Whatever an operator holds, an operator can be compelled to produce. A subpoena, a hostile acquisition, a pressure campaign — each one resolves against what is actually on disk. Our design goal is that the answer is ciphertext and opaque routing identifiers, with undelivered messages queuing under a published retention ladder.

The zero-knowledge page walks the whole model, including what the relay does hold and for how long.

Read every layer with its state on it

Every dependency is a door someone else holds. This ledger names each layer we are taking ownership of — in the present tense where it is live, as roadmap where it is not. No row ships on faith.

  1. Relay

    Live

    Sealed ciphertext moves; the relay cannot read it.

  2. Stack

    Live

    MixcoatlDB, GlyconCache, QSFS, crypto-core — our own database, cache, file store, and crypto library.

  3. Jurisdiction

    Live

    Our own hardware in an EU data center, Nuremberg.

  4. Builds

    Partial

    Build-attestation manifest published (ML-DSA-87, ctx QERYX-attest-v1); update-authenticity trust-root registry not yet claimed.

  5. Names

    Roadmap

    Our own DNS and DoH resolution, so no registrar decides whether we resolve.

  6. Certificates

    Roadmap

    A post-quantum root CA path with DANE/TLSA pinning.

  7. Time

    Roadmap

    Multiple independent time sources — Roughtime, an NTP quorum, our own clock.

  8. Distribution

    Roadmap

    More than one road to the binary; each channel is listed here only once it is live.

How to read LIVE, PARTIAL, ROADMAP

LIVE means running in production today. PARTIAL means shipped in part, with the gap named in the row. ROADMAP means a commitment we have made and not yet met. When a row changes state, the ledger changes — never the other way around.

Take the floor at maximum, in every tier

The security of a session is the minimum of the security of both ends. A higher tier cannot buy its way out of a lower-tier counterparty — so the floor is maximal for everyone, in every tier. Higher tiers unlock new instruments; they never upgrade the crypto you already have.

Why every tier will be paid

A free tier funds itself with the people on it. We refuse that economics entirely: you pay, so you are the one we answer to. Nothing is purchasable in this build; when the tiers open, the entry tier carries the full messenger at maximum capability — the tier ladder states the rest plainly.

What retiring a tier means

A downgrade is a billing-state change, not a data event. Identity keys, conversation history, contacts, and memberships are preserved; only the higher-tier instruments lock, visibly, with the reason on the tile.

Read Armed as a state, never as a uniform

Armed is a state of protection, not a uniform. Families, founders, journalists, and the people who defend them get the same floor, the same primitives, the same maximum parameters — protection is not a demographic.

And the launch stance matches: QERYX ships worldwide or not at all. One launch, every region — no country ladder, no waitlist by passport.

Ask the three that test a mission.

Is this a military product?

It is a civilian messenger with an engineering bar high enough that governments can evaluate it — the procurement surface exists for exactly that review. The face of the product is peace-forward and for everyone; the discipline underneath is what makes that face honest.

Why build your own database, cache, and file store?

Because a dependency is a decision someone else makes about your threat model. The Sovereign Stack pages — MixcoatlDB, GlyconCache, QSFS, crypto-core — document each component and what it replaces.

What happens when a claim stops being true?

The page changes the same day the truth does. Status here is stated true-or-absent — a stale badge is treated as a defect of the same class as a failing test.