The convoy enters the valley
Cellular is saturated, the tactical band is interfered with, and the satellite terminal is in a terrain shadow. Command traffic must not care which of them survives.
Defence & security
The link is the first thing contested. Keep the connection anyway.
For procurement officers, programme managers and integrators: one encrypted connection over the dissimilar bearers the platform already carries — with no controller, no cloud and nothing new to procure for a pilot.
The stakes
The stakes
Communications fail exactly when the mission needs them most — that is what “contested” means.
The feed and the commands share one dying link
A drone team’s video and control channel compete on a degrading path — and without delivery contracts, the wrong one wins.
The report can’t wait for an operator to notice
A forward position’s satellite path drops during handover to headquarters. The queue must hold, and drain the moment anything returns.
One connection over everything
The bearers you have, as one encrypted system.
Nexus Atlas bonds the links the platform already carries — SATCOM, tactical radio, cellular, Wi-Fi, mesh, wired, others and even your custom waveform — into one encrypted connection that survives any single failure. Pure software on the compute already installed.
SATCOMtactical / MANET radiomulti-carrier cellular802.11s meshmicrowavewiredyour custom waveform
Three pillars
What the configuration is built to protect.
Every pillar maps to a demonstrable behavior, not a brochure adjective.
Redundancy that scales with the threat
Under worsening interference the scheduler escalates from one to two to three simultaneous transmission paths — on a direct link set, and on every hop of a relayed route — and scales back when the spectrum clears. Diversity across links and bands does the work.
Command traffic always first
Six delivery contracts. A video stream can never crowd out the command channel, and duplicated command classes ride through a link loss without interruption.
No infrastructure to trust
Every node autonomous; the data plane works fully offline; configuration spreads over the encrypted tunnels themselves. A partitioned force keeps operating on both sides of the split.
0.1–0.75 sTypically configured reweighting cadence — deployment-specific, not a universal recovery guarantee.
0.0008%Effective loss from three independent links each losing 2% (broadcast mode).
2 minKey rotation, measured at zero packet loss during the swap.
6+ typesDissimilar link types bonded on one node — six shown in the field demonstration, with no fixed upper limit.
One operator, one aircraft, bonded cellular and radio.
Control is duplicated across links, so a base-station handoff or a fading band passes without interruption; video aggregates across whatever capacity remains.
Command and voice straight on the radio.
Where both ends run Atlas, the SiK-family or RFD900-class telemetry radio carries Atlas directly — no PPP, no IP plan per radio pair — and about 29 bytes come off every voice packet. Writes are paced on the radio’s own buffer, so a voice frame overtakes video in Atlas’s queue instead of waiting behind it in the radio’s: command and voice stay usable beside video on a 64 kbit/s radio. Atlas directly on serial radios
The formation is the network.
Multi-hop mesh across the aircraft: when one is lost, the topology recomputes the moment the loss is detected — ≈1.5–1.75 s at default settings — and traffic threads through the survivors: spatial and spectral redundancy in one fabric. The swarm-fabric deep-dive
The operator never loses the asset.
Teleoperated ground robots on bonded radio links, with redundant control paths held warm — an obstacle that blocks one radio doesn’t block the mission.
Autonomous robots across a forward base.
Bonded Wi-Fi and mesh radio keep logistics robots moving across large structures where any single radio has shadows.
Trunks that survive partial destruction.
Encrypted multi-path trunks bonding satellite, microwave and tactical radio between positions — the trunk degrades gracefully instead of failing with its weakest member. When video fills one trunk, command traffic takes a route with room through another position, while the video stays on the shortest.
Sensor video to every station that needs it.
Airborne sensor feeds cross the mesh to ground stations, aggregated across links for throughput and deadline-managed so stale frames never choke fresh ones.
The live picture drops late frames so the link stays usable for the operator; the aircraft keeps every packet of the stream, the ground station asks for exactly what it missed, and the gaps cross on the lowest lane, behind commands and live video, during the sortie or after it. The ISR capture is packet-complete after the blackout. How the gaps are filled
Diversity does the work.
No frequency-hopping claims: when one band degrades, continuous quality scoring shifts traffic classes to links on other bands — and communications continue while any usable path remains.
A new unit joins by signature, not by editing hubs.
A new aircraft or vehicle joins by a signed pairing code the ground station shows — one code, one unit, once — or by a certificate from your own fleet authority, signed once at the factory, so the unit is admitted wherever that authority is trusted with no entry on any hub. A forward hub that cannot sign the fleet’s list still admits the unit and hands the record to one that can; the rest of the force knows it from the signed list about a second later, and every admission is recorded with who made it. Join by code Join by certificate A hub that cannot sign
A lost node is out everywhere at once.
A vehicle is lost with its radio aboard. The operator removes it in one action: every node ends its connections with it and refuses it from then on, the hosted relays refuse it too, and the fleet’s shared secret is replaced. Routes it announces afterwards count for nothing, because every node accepts only routes signed by a current member. A drone lost over hostile ground wipes its own keys once it has been outside its operating area for longer than its grace time, and one signed command wipes a lost unit the moment it is back on the network and removes it from the fleet in the same step. How removal works The area and the wipe
A push never strands a vehicle.
A vehicle out of contact for a week comes back on its old key, receives the new one over its first connection and switches by itself: keys and the fleet’s shared secret rotate on a signed schedule every node acts on when it holds it, and the old material is kept until every node that matters has moved. A configuration release never completes while a required node is unconfirmed — one silent or failed at the deadline withdraws the change on its own, the previous settings go back out signed, and the operator is told which node held it. Keys without a flag day The release gate
Join an allied network without touching it.
An allied unit runs its own network under its own keys. Your ground station joins it as an ordinary member under the ally’s rules and bridges it to yours: their observer reaches your video feed at an address of their own network, and nothing is installed or renumbered on any of their devices. Neither side sees the other’s topology; each decides which hosts take part, and the ally can revoke your node like any member. Opt-in. How the seam works
A coalition partner who must fly the aircraft is a member of the fleet; one who must only watch gets a link, not a device on your network. The feed gateway — a separate package beside Nexus Atlas — sends one feed outward from a read-only member to a feed server; the partner’s officer opens it in a browser with a token for that feed, until it expires or is cut with one click, and the player draws the viewer’s name across the picture. The fleet opens no port, and nothing travels inward. How the gateway works
Inside your own fleet, a partner’s node holds exactly the permissions its record gives it: it may send voice and position, read only its own node, never carry anyone else’s traffic and never change the fleet’s settings. Every node in the fleet enforces the record, so the limits hold wherever the partner’s node goes. What a member may do
Pure software. Pilot on hardware you already own — no procurement. Built and controlled in the EU; ITAR-free; runs air-gapped. For the security review: memory-safe core, named cryptography, signed releases with SBOM and provenance — the trust page carries the detail.