Twenty-five ideas explain most of Nexus Atlas.
Each idea is a plain-language explanation — most with a single picture — written for the decision-maker, not the network engineer. Every one links to the engineering site, where your advisors can go deeper — most of them into an interactive demonstration of the same idea. And every one is labelled: what is demonstrated, what ships, what is opt-in.
One connection from many links.
The foundation. Dissimilar links — satellite, cellular, radio, Wi-Fi, mesh, wired — become one encrypted connection, and applications see one ordinary network. They never learn which link carried the bytes, so nothing has to be integrated, modified or made "Atlas-aware". Six dissimilar link types have been bonded on one field node — a demonstrated point, not a ceiling: there is no fixed link limit, and a node bonds as many links as the deployment and its resources require.
The interactive bonding demo — nexusatlas.ioFour links keep the picture simple — any IP-capable transport joins the same bond: 802.11s mesh, Wi-Fi HaLow, Bluetooth and serial telemetry radios via small adapters, from a few kbps to multi-gigabit.
Failover you never notice.
There is no moment where a link "fails over". Every path is measured continuously — delay, jitter, loss — and traffic shifts away from trouble in proportion to measured quality, on a cadence typically configured between 0.1 and 0.75 seconds. By the time a link actually dies, the traffic has usually already left. A response cadence, not a universal recovery guarantee — and never a binary up/down switch.
The gradual-degradation demo — nexusatlas.ioShares are illustrative; the real split follows the measured delay, jitter and loss of each link, re-weighted on the configured cadence.
Redundancy that escalates.
Eight scheduling strategies ship; three are adaptive. As loss or latency worsens, the traffic that matters is duplicated across one, then two, then three simultaneous paths — and scaled back the moment conditions clear. The arithmetic is why it works: three independent links each losing 2% of packets yield 0.0008% effective loss with copies on all three. In the scripted demonstration, three links forced to 30% loss delivered roughly 2.7% effective loss end-to-end.
The strategies in detail — nexusatlas.ioThe interference-adaptive mode is the live demonstration mode — the escalation shown here is the behaviour exhibited under controlled link degradation.
The fleet routes around loss.
When two nodes cannot reach each other directly, traffic crosses the other members of your own fleet — re-encrypted at every hop, up to 8 hops. Every node holds the same picture of the topology; lose a relay and every survivor recomputes independently, with no controller anywhere. Relay nodes are trusted, authenticated members of your fleet — stated plainly, because your security review will ask.
The distributed control-plane demo — nexusatlas.ioThe route re-forms the moment the loss is detected — ≈ 1.5–1.75 s at default probe settings. Re-encrypted per hop; every relay is an authenticated member of your own fleet.
One stream, many watchers.
When several stations watch the same live feed across the mesh, the scarce hops carry it once — not once per viewer. The network computes where the watchers' paths diverge from the topology it already floods, and duplicates the stream only there; the cost of the trunk does not grow with the audience. Measured on an eight-node rig: five minutes of Full-HD-rate video to three stations, with the scarce first hop carrying exactly one copy per packet.
How the tree is computed — nexusatlas.ioThree stations watching one feed: the scarce hops carry it once — copies are made only where the stations’ paths part. Delivery stays video-shaped: losses repaired by forward error correction, never by retransmission storms.
Join networks you do not run.
A partner flies its own drones and an agency runs its own sensors, each network under its own administrator — and the job is to join them, not to take them over. Your node joins each network as an ordinary member, under that owner’s rules, and the two meet at a seam on your host. Each side keeps its own keys, its own admission and its own address plan. Traffic crosses only between the hosts each owner has chosen to export, and arrives at addresses inside the receiving network, so nothing is installed, configured or renumbered on any member of either. Routes, topology and membership never cross the seam: a partner’s network never learns yours, and either owner can revoke you like any other member, which stops the traffic at once.
The seam, step by step — nexusatlas.ioWhere every node is yours, the answer is simpler still: one network. A packet that crossed one seam is never sent across another, so loops cannot form, and a second host bridging the same pair takes over when the first goes down.
Video can never starve the command link.
Reliability and priority are a property of the message, not the connection. Six service classes — Control, Voice, Position, Telemetry, Video, Bulk — each get their own delivery contract, and strict priority comes with reserved floors: with classes enabled, a 4 Mbps video stream cannot crowd out a 2 kbps command channel — measured, with the drop counters to show it. Classification uses standard packet marks and flow heuristics: zero application changes.
Priority under pressure, measured — nexusatlas.ioOff by default; with classes off the data path is byte-identical. Deadline delivery and erasure recovery are contracts of the same system — too-late video frames are dropped, never retransmitted.
Every byte of the bearer.
A serial radio at 64 kbit/s, a metered satellite terminal, a congested cell: a narrow bearer has no airtime to spare, and a packet that arrives too late costs the same airtime as one that arrives in time. So that airtime is never spent on something the far end cannot use. A packet no link can deliver inside its budget is refused at planning instead of being sent to die. A packet that loses one piece on a link is withdrawn from that link whole, pieces already queued included. Video, telemetry and bulk are handed to the link only as fast as it drains, so a voice frame never waits behind them. A packet that outlives its budget is dropped where it waits, before it is sent. And every drop is counted where it was taken — by class, by link and by reason — so an operator sees which traffic to move off which bearer.
Every byte of the bearer — nexusatlas.ioPlanning against deadlines, pacing and late drops come with the traffic classes and switch on with them; whole-packet withdrawal and the drop counters run on every link. Beside video on a 64 kbit/s link, voice crosses in about 30 ms one way, measured.
Nothing is lost in the blackout.
Bulk data addressed to an unreachable peer is held — on disk when the node is configured for it, so it survives a restart — and drained automatically the instant a path returns: the home network, or a passing relay vehicle, vessel or aerial node. Sender and receiver never need to be connected at the same moment. Delivery that waits, instead of failing — demonstrated as the "data mule" scenario.
Survive the blackout — nexusatlas.ioThe queue is a delivery contract of the Bulk traffic class — real-time classes are never held back behind it.
Unreachable, then upgraded.
A node behind carrier-grade NAT — no inbound ports, no fixed address — becomes reachable outbound-only in under a second through a relay, and the relay path is an ordinary link in the bond with its own measurements. Path candidates are then exchanged over that already-working relay, and crossing probes open a direct path through both NATs. The upgrade is a scheduler decision: the relay stays in the bond as a warm standby, so a failed attempt costs nothing. Hosted relays run in North America, Europe and Asia; private, on-premises relay estates serve closed networks.
The traversal deep-dive — nexusatlas.ioRelay and gateway lists are signed with an offline key and verified by every client — a directory outage never becomes a tunnel outage.
Addresses change. Sessions don’t.
A link whose public address changes mid-mission — a cellular modem crossing carriers, a moving vehicle — keeps its tunnel without a reconnect. Sessions are bound to cryptographic identity, not to addresses, and only cryptographically verified traffic can move an endpoint. The same indifference to link identity is what lets SIM and eSIM profiles cycle underneath a mission without dropping it.
How sessions bind to identity — nexusatlas.ioAddresses illustrative. Roaming is a property of every link in the bond — each link roams independently while the others keep carrying.
Your own exit, with no leak.
Whatever network a laptop is plugged into, its internet traffic should leave through an exit you run — never through the network it happens to be on. Atlas sends a desktop’s entire traffic over the bond to an exit node of your own, and the leak guard fails closed: when the path to the exit is gone, or the tunnel is not running at all, nothing leaves by any other route, IPv6 included, and name lookups stay pinned to the tunnel. The state is on screen: a switch in the desktop’s top-bar indicator shows whether the guard is armed and lets the person at the keyboard choose, and the icon turns red the moment traffic is unguarded. At the far end, the exit forwards for the named devices only, keeps the card that carries its relay link apart from the card that carries the traffic out, and starts closed until that card has an address.
Gateways and exits — nexusatlas.ioOne bundle sets up the whole desktop side on a Debian live system with a single command. A phone sends its whole traffic through a bonded exit from the app’s full-tunnel mode, and the app points to Android’s own switch that blocks traffic outside the tunnel.
Predict, don’t react.
For platforms that move, the killer is geometry. Nodes share position and velocity inside the routing flood; the scheduler projects each node along its track and hands traffic to the longer-reaching link before the short one stretches past its declared range — while both still work. Signal-trend, range and terrain prediction ship today, opt-in. Prediction is advisory: it biases decisions, never kills a link, and never falsifies a measurement.
The position & velocity demo — nexusatlas.ioEach radio is scored against its own declared reach — a 300 m Wi-Fi leg and a multi-kilometre radio leg get different risk from the same distance.
Encrypted everywhere, with the boundaries stated.
Always on — there is no unencrypted production mode. Noise IK handshake; X25519, ChaCha20-Poly1305, BLAKE2s: the cryptographic family of WireGuard and Signal. And the word “encrypted” is not allowed to hide who can read what: direct peer traffic is end-to-end; mesh relays re-encrypt per hop and are trusted, authenticated members of your own fleet; hosted Traversal relays forward envelopes they cannot open. Three different boundaries, stated as three different facts — because your security review will ask.
Hop honesty — the three boundaries — nexusatlas.ioThe suite is the default, not a lock-in — the primitives can be exchanged without changing the protocol, the engineering basis of the FIPS and post-quantum tracks.
Names, with no name server to lose.
Your people should type isr02.narva, not read an address off a laminated card. Every node already announces who it is and where it can be reached, so every node answers name lookups itself, out of its own copy of the fleet — there is no name server anywhere in the mesh to stand up, defend or lose. Names keep resolving with the uplink dead, and when a network splits in two, each half keeps resolving its own half. Existing corporate names can be pointed down the tunnel without touching your DNS estate, and a mesh-only mode fits an EMCON posture: no query ever leaves on an uplink.
How names resolve without a server — nexusatlas.ioAnswers come out of the routing database itself, so they track the topology — 30-second lifetimes, never stale by design. Names resolve only inside the tunnel, and the tunnel itself never waits on a lookup.
No controller. No cloud. Fully offline.
Every node is autonomous and carries everything it needs: its full configuration, its own view of the topology, its own decisions. There is no orchestrator to stand up, no cloud that must be reachable, nothing that phones home. The data plane needs no internet at any point in its life, air-gapped networks are a first-class operating condition, and a partitioned network keeps operating on both sides of the split.
Operations without a controller — nexusatlas.ioThe only hosted pieces are optional — Traversal relays and the fleet console — and losing them costs visibility, never connectivity.
Nobody joins without a signature.
Adding a node in the field used to mean editing a key file on every hub. Now a fleet chooses its way in: a single-use pairing code shown as a QR, a certificate from your own fleet authority, a key with a second secret — a wrong one gets no answer — or an operator approving each request from a queue. Every admission lands in the journal with who made it, and every record is minted with the least it needs. A hub that cannot sign the fleet list forwards what it admits to one that can, near or several hops away, and no hub hands out more than it holds.
Four ways in, each one logged — nexusatlas.ioA key that passes none of the chosen modes gets nothing. The modes are chosen per fleet — one of them or several — and a code already spent, expired or withdrawn admits nobody.
Removed everywhere in a second.
A lost or sold device keeps its keys. Removal is one command, or one action in the dashboard, and the signed fleet list carries it: every node that adopts the list ends the removed node’s sessions, refuses its handshakes and switches to a new mesh secret, and the hosted relays drop it — every node holds the new list within a second of the push, measured. What the device already received it keeps; it reads nothing after. And because every route is signed by the node that announced it, a device outside the fleet — or one just removed — cannot inject a route or fake a link’s liveness: a forged advert is dropped at the first receiver and moves nothing.
Removal that holds — nexusatlas.ioThe removed id and every key it held stay on the list’s revocations for good; a device that comes back comes back as a new identity, through admission. The signed routing plane is described on the same page, under signed routing.
A device that leaves the area wipes itself.
A captured node is the case removal by name is too slow for. Draw an area on the map instead: the nodes last seen inside come back as a list with the age of each fix, the operator confirms, and exactly those are removed everywhere at once. Each node can carry a signed operating area of its own — outside it beyond a grace time, it cuts itself off or wipes its own keys, and never without a position fix. And one signed command wipes a single node remotely and removes it from the fleet in the same step, leaving a single audit line.
Remove by area, wipe on command — nexusatlas.ioPositions are what each node reported, which is why every fix carries its age and a person confirms the list before anything is removed. A lost aircraft over hostile ground wipes itself once it has been outside its area long enough.
A push never strands an aircraft.
A fleet update that half the fleet took is the one you find out about in the air. Every node record carries an update class. Required nodes gate a release: it is complete only when each of them has confirmed, and a required node that fails, or stays silent past the deadline, aborts it — the previous settings signed back out — and the abort names the node. Best-effort nodes take the change when next seen and never block. Left-behind nodes stay on their known build and are shown as such. Keys and the shared mesh secret rotate on the same kind of signed schedule — accepted, then used, then the old retired — in windows a node out of contact can still catch: a vehicle back after a week takes the new key by itself over its first connection.
Update classes — the release gate — nexusatlas.ioRotation runs on one schedule for a node’s keys and the fleet’s secret — publish, activate, retire — and the old material is refused only once every required node has moved. A node back after retire re-enrols through admission.
Share one feed, not your network.
A partner who needs the live picture should not need a seat inside your network. The feed gateway is a separate package that stands beside Nexus Atlas: a read-only member of the fleet pushes one stream outward to a feed server — ours, or one inside your own network with your own certificates. Each viewer gets a link with a token of their own, until it expires or is cut, and a link opens exactly the feeds it names, and nothing else. A link can also require a code — a six-digit PIN or a password — that you send over a different channel; the server keeps only its hash, and repeated wrong codes lock the link. With your say-so on both the gateway and the link, the viewer also sees a map of the mesh nodes beside the picture. The player draws the viewer’s name across the picture; one click revokes a viewer, one stop cuts everyone. The fleet opens no port and nothing travels inward — a partner who must fly the aircraft is a member of the fleet, not a viewer of a feed. Live video plays in any browser, glass to glass in about 0.3 seconds, measured.
The feed gateway — nexusatlas.ioTokens come from the issuer that ships in the package, with its own sign-in, wherever the server runs. “Open this link” is the whole onboarding — nothing to install on the viewer’s side.
Control takes the path with room.
The shortest path is often the fullest. Priority at one hop cannot reorder what already sits in a radio’s buffer or a modem’s queue further along the path — but path choice can. Every node advertises how loaded each of its links is, and command traffic routes on a second map that counts that load, so a command steers around a relay busy carrying video before latency ever shows the queue, while the video keeps its cheapest path.
Paths with room — nexusatlas.ioTwo shortest-path maps, one per class: the loaded hop stays the right answer for telemetry and the wrong one for a command.
Straight onto the radio.
A serial telemetry radio used to need a PPP layer underneath — framing and headers that cost bytes on every packet, and a daemon that hid the radio’s buffer. Where both ends run Nexus Atlas, the radio carries Atlas directly — SiK-family, RFD900-class, any byte pipe — with no adapter, no PPP and no IP plan per radio pair. About 29 bytes come off a 104-byte voice packet, a fifth of it. Writes are paced on the radio’s own buffer, so the queue that decides the order is Atlas’s own, where a voice frame overtakes video: voice stays usable beside video on a 64 kbit/s radio, and traffic is back in milliseconds after a radio reset or a replug.
Atlas directly on serial radios — nexusatlas.ioSeveral radios on one channel reach each other, and the radio’s own signal and noise readings steer routing. Devices that only offer PPP keep it.
Complete footage after the blackout.
Live video drops what arrives too late — right for the pilot, wrong for the archive a search or an incident review needs. Mark a class for retention and the sender keeps every packet of it; the receiver tracks the holes and asks for exactly what it missed, and only those packets cross, on the lowest lane, during the flight or after it. The capture ends packet-complete, in order, every packet once. Concept 09 holds messages until a path returns; this one recovers the footage the live view had to let go.
Complete footage — nexusatlas.ioRetention is per class and bounded by size and age; with the node’s disk encryption on, each retained record is sealed at rest.
The map knows the hills.
A link fades behind a ridge before any signal reading says so: the formation flies together, every distance unchanged, and the ground slides into the path. Each node holds the elevation data and checks every path it knows against it — line of sight and the first Fresnel zone, worked out at each link’s own frequency, so a 915 MHz radio and a 5 GHz radio to the same aircraft get different answers from the same ground. Terrain sets the link’s score while it still carries, the route leaves the fading link before the fade, and when the direct link then fails the traffic loses nothing, because it has already left. Concept 13 watches motion and signal trend; this watches the one thing in the scene that never moves. The ground is drawn in 3D on the node’s own dashboard.
How the node sees the ridge — nexusatlas.ioA dependent route moves in about half a second instead of half a minute, measured, because a moving node shares a new position after 25 m and at least every 10 s.
Twenty-five ideas. One hundred and four capabilities.
These pages showed the shape of the platform. The full catalogue goes through everything it does, in the same plain language — one hundred and four capabilities across ten groups, each with an engineering deep link where your advisors can go deeper.
Browse the full catalogue — /product/capabilities