Your own network. We hold nothing in it.
A ministry, a newsroom chain, an NGO federation, a hospital group: an organisation whose adversary is a state, or whose law requires that its communication never leave its own control, runs its own deployment of the open code, with its own keys and its own operators, on its own hardware. The company sells the software, the operator kit, support and the certifications the buyer requires. It never holds a key, a conversation or a record for any customer, a ministry included, which is the same property the consumer product rests on.
The buyer runs the code. The company never has a privileged door.
There is no hosted version of a sovereign deployment and there will not be one: a hosted version is a version the host can be compelled over. The buyer builds the apps from the published source with its own network profile, runs its own relays from the operator kit with its own directory keys, and its people pair, message, call and share exactly as on the public network. The company's part is the software, the recipe, the support, and the accreditation work the buyer's procurement requires. Lawful requests from any authority are answered by the company the way they are answered for the consumer product: with what exists, which by design is nothing.
Every address and root of trust a build pins is one file.
A build of the apps reaches for seven things: its home relay's onion and clear addresses, the directory's keys and threshold, the call relays, and the discovery pair. Since October 2026 they live in one profile file, generated into both apps, the engine and the page, with a guard that refuses a value pinned anywhere else. A sovereign deployment is a second profile in the buyer's fork, with its onion, its roster, its call relay and its discovery pair, and the same build. Nothing else in the tree knows the difference, and nothing about the protocol moves: the buyer's build is checked against the same published vectors as ours.
One file, four generated copies, a guard that refuses a second pin. Since 28 October 2026 a template for a buyer's own network sits beside the public profile, the generator writes a second network beside the tree without touching it, and a guard generates from the template on every run and holds the result to the public network's shape; the runbook for a whole deployment, step by step with each step's recipe and whether it has been rehearsed, is deploy/operator-kit/SOVEREIGN-DEPLOYMENT.md in the published source.
A sovereign network is an island. Its users want it so.
A phone on a sovereign network holds that network's directory keys and lists that network's relays. A link from the public network names a relay the phone's directory never vouched for, and the phone refuses it with a sentence; a ministry's phones cannot be pairable from the outside by a pasted link. If a buyer wants its island bridged to the public network, the honest shape is a directory that lists both sets of relays under both parties' keys, a decision between keyholders and a contract, and not a code path. The operators page says the same from the other side.
A buyer does not take our word. It takes the source, the vectors and the record.
The source is published under a licence that keeps it so. The protocol is specified construction by construction, with thirty-one known-answer vectors computed by the shipping code, so a buyer's own build, or a buyer's own implementation, is checked byte for byte. Every push to the source carries a signed record in a chain, so a rewrite of history is visible. The reproducible build of the engine is proven on one machine and the build of the whole app is being measured, with each finding written down as it is found; the proof page is the page that invites you to check. Every security test in the source was first shown to fail against a deliberate break in the code it guards; since 1 November 2026 those breaks are being kept in the source as records (1,322 on 3 November 2026: every check of how the code is wired has one, but the one that judges a git checkout, and every other test either has one or carries the written reason it has none), and each record is planted again regularly to check that its test still catches it, with the failure its record names. The same tool runs a device maker's own deliberate breaks over the maker's own code: an example in C, a check on command frames with three of the mistakes such code makes, is planted regularly with a real compiler. Bringing them in found one that had drifted: after the code around it was rearranged, a break written for one check had come to land on another that no test read; both now have their test and their record. Two more had lost their test the other way: the cover traffic moved onto a clock of its own, and the test that once caught them no longer reached the code they break; a check that reads that code itself now holds them. Planting them again also found eleven checks that held less than their own failure messages said, among them the one that stops a comment in the app's source from silently swallowing the code after it, one that compared a call with reactions to a call without them but stopped reading at the sixtieth datagram, so a reaction sent on its own went unseen, one that checked a call's audio is played a little short to give back delay after a stall, in a test whose stream never stalled, and one that said a member who does not run a group could not share its earlier messages, while the refusal it read was for another reason. Each was strengthened, and the break that got past it is now one of the records.
Defence communications are a separate line. Its first pieces are in the engine and its development kit.
Tactical communication, bearers with no internet (mesh, satellite, radio), hardened handsets and the accreditations a defence procurement asks for are a line of their own. What exists today is in the engine and its development kit, tested on simulated radios and on Android emulators:
- a mesh as a second road beside the relay: devices pair and exchange sealed messages with no server, through devices that carry what they cannot read;
- delivery over lossy, one-way and partly jammed radios, with messages cut to a radio's own size and rebuilt from spare pieces, and two radios used together or one kept silent in reserve;
- radio silence that a commander can order over the air, with transmission only in the windows the commander sets;
- orders ranked by the four military precedences, with an end after which no device obeys them, a net's shared state, and the removal of a captured device;
- signed device records, firmware checked against its maker's signed release, permissions signed at the maker's bench, and a log that shows any entry cut out or changed;
- calls for help and check-ins from a device, raised on a phone;
- a C library for the computer inside a maker's equipment, on Linux for x86_64 and 64-bit ARM;
- a post-quantum inventory tool that lists the classical cryptography in a system and writes its migration plan.
It has not yet run on a maker's board or over a real radio, and the iPhone app does not carry it yet. Satellite and radio bearers, hardened handsets and the accreditations come after the consumer product is launched and audited, because a launched, audited product is what a tender is bought on. Nothing on this page claims more.
The software exists. No deployment does.
The apps, the relay, the operator kit, the network profile and the vectors are published and tested; the Teams relay has run on two phones. No sovereign deployment exists, no accreditation has been sought, and which jurisdictions the company sells into is a decision that carries an invoice and sits with its founder, under EU export and sanctions law. An institution that wants to be the first writes to hello@avano.app.