Company
Sovereignty is a design decision.
A messenger answers to whoever holds its keys, its names, and its clocks. We are building to hold our own — and this page states, layer by layer, what is live and what is still road.
Hold less, and there is less to compel
The server is a dumb encrypted blob relay. It cannot read messages. We engineer the instrument to its maximum, hand it to you, and walk away — the math forbids us from reaching over your shoulder, and we built the math on purpose.
Why an operator would choose to hold less
Whatever an operator holds, an operator can be compelled to produce. A subpoena, a hostile acquisition, a pressure campaign — each one resolves against what is actually on disk. Our design goal is that the answer is ciphertext and opaque routing identifiers, with undelivered messages queuing under a published retention ladder.
The zero-knowledge page walks the whole model, including what the relay does hold and for how long.
Read every layer with its state on it
Every dependency is a door someone else holds. This ledger names each layer we are taking ownership of — in the present tense where it is live, as roadmap where it is not. No row ships on faith.
-
Relay
LiveSealed ciphertext moves; the relay cannot read it.
-
Stack
LiveMixcoatlDB, GlyconCache, QSFS, crypto-core — our own database, cache, file store, and crypto library.
-
Jurisdiction
LiveOur own hardware in an EU data center, Nuremberg.
-
Builds
PartialBuild-attestation manifest published (ML-DSA-87, ctx QERYX-attest-v1); update-authenticity trust-root registry not yet claimed.
-
Names
RoadmapOur own DNS and DoH resolution, so no registrar decides whether we resolve.
-
Certificates
RoadmapA post-quantum root CA path with DANE/TLSA pinning.
-
Time
RoadmapMultiple independent time sources — Roughtime, an NTP quorum, our own clock.
-
Distribution
RoadmapMore than one road to the binary; each channel is listed here only once it is live.
How to read LIVE, PARTIAL, ROADMAP
LIVE means running in production today. PARTIAL means shipped in part, with the gap named in the row. ROADMAP means a commitment we have made and not yet met. When a row changes state, the ledger changes — never the other way around.
Take the floor at maximum, in every tier
The security of a session is the minimum of the security of both ends. A higher tier cannot buy its way out of a lower-tier counterparty — so the floor is maximal for everyone, in every tier. Higher tiers unlock new instruments; they never upgrade the crypto you already have.
Why every tier will be paid
A free tier funds itself with the people on it. We refuse that economics entirely: you pay, so you are the one we answer to. Nothing is purchasable in this build; when the tiers open, the entry tier carries the full messenger at maximum capability — the tier ladder states the rest plainly.
What retiring a tier means
A downgrade is a billing-state change, not a data event. Identity keys, conversation history, contacts, and memberships are preserved; only the higher-tier instruments lock, visibly, with the reason on the tile.
Read Armed as a state, never as a uniform
Armed is a state of protection, not a uniform. Families, founders, journalists, and the people who defend them get the same floor, the same primitives, the same maximum parameters — protection is not a demographic.
And the launch stance matches: QERYX ships worldwide or not at all. One launch, every region — no country ladder, no waitlist by passport.
05 / THE HARD QUESTIONS
Ask the three that test a mission.
Is this a military product?
It is a civilian messenger with an engineering bar high enough that governments can evaluate it — the procurement surface exists for exactly that review. The face of the product is peace-forward and for everyone; the discipline underneath is what makes that face honest.
Why build your own database, cache, and file store?
Because a dependency is a decision someone else makes about your threat model. The Sovereign Stack pages — MixcoatlDB, GlyconCache, QSFS, crypto-core — document each component and what it replaces.
What happens when a claim stops being true?
The page changes the same day the truth does. Status here is stated true-or-absent — a stale badge is treated as a defect of the same class as a failing test.