Evidence your evaluators can verify line by line.

The conformance claim ships in one fixed wording, everywhere it appears:

The hybrid combiner concatenates the ML-KEM and X25519 shared secrets under HKDF-SHA-512, salted by the ciphertexts and bound to the public material — the NIST SP 800-227 §6.2 construction. Reading a recorded session requires breaking both components.

NIAP Common Criteria: READY WITH DEVIATIONS — not a completed EAL 4+ certification. The deviations are enumerated in the artifact bundle; formal evaluation is in progress. FIPS 140-3: Algorithm-conformant; implemented via a library lineage holding FIPS 140-3 cert #4631; QERYX's own module is not yet CMVP-certified.

The evidence package — Security Target, extended-components definitions, side-channel test evidence, SBOM, and audit history — is provided through the procurement channel and summarized in the Trust Center. We publish the caveats with the claims; an evidence package that hides its deviations is not evidence.

The relay can be operated on your hardware, by your staff, inside your enclave — it holds ciphertext and opaque routing identifiers, so operating it grants no one the power to read. Fleet enrollment runs under annual agreements through the procurement lane; there is no public price card for government, by design.

The security floor your personnel get is the same floor every civilian gets. A session is as secure as its weakest end — so the floor is maximal for both ends, in every tier.

Infrastructure-independent transports and field awareness surfaces — mesh radio, acoustic pairing, team coordination — exist as a separate line and stay out of the civilian messenger on purpose. They are briefed and scoped through procurement, not marketed on consumer pages.