Your own relay for your own people. It still cannot read them.
A company that wants its communication on machines it controls runs an Avano relay from the operator kit and reserves it for its people. The reservation is a seat: a credential the company issues blind, so that the relay can tell a seat holder from anyone else without learning which seat holder. The relay holds what every Avano relay holds, numbered slots of sealed bytes in memory, and the company that runs it cannot read a word of what its people say.
A seat is a monthly credential the company signs without seeing.
A seat is a blind signature under the company's key for one month: the phone blinds its serial, the company's mint signs it, the phone unblinds, and what it holds is a credential the relay can verify against the company's public key and cannot connect to the issuing. Two seat holders are two valid signatures; which is which, nothing records. The seat buys the two things a company's relay reserves, opening an inbox there and registering a work handle, and nothing else: messages, calls and files are what they always are.
The same relay as ours, with a gate on inbox creation.
A company's relay is the operator kit's relay with one setting: it reserves inbox creation and work handles for seat holders and leaves everything else untouched. Its record in the signed directory carries the company's class key, so a phone redeeming a seat checks that the relay it talks to is the company's and refuses one that signs under another key. A phone with a seat has its inbox on the company's relay; its contacts outside the company reach it there, through the same two-leg split as everywhere.
Inbox creation and work handles behind a seat; the company's key in the signed record; run end to end on two phones against a relay built from the source, over a plain connection rather than Tor.
A seat arrives as a one-time code, redeemed over the relay's own channel.
The company's console makes the month's key, prints the public half the relay pins, and mints one-time codes for its people. A person types the code on the Shield screen; the phone redeems it over the relay's channel, the blind signing happens there, a used code is refused, and the seat lands on the phone. Nothing in the exchange names the person, and the console keeps a list of codes, not of people.
Blind monthly credentials; a one-time code redeemed over the relay's channel; the console; the contract outline. On two phones: a code redeemed, a used code refused, a pasted seat, both inboxes bought, a message delivered.
The company sees that it has seat holders. Not who, not what, not to whom.
The company's relay sees what every relay sees: numbered slots, sealed blocks of one size, connections from the Tor network or, in the Simple posture, from addresses. It sees that a valid seat opened a slot and never which seat. It cannot read a message, cannot list a person's contacts, cannot tell a message from cover, and cannot be made to produce any of those, because it never held them. That is the product: a company that controls its machines and still cannot surveil its people, and can say so to them and to anyone who asks.
A company without its own relay can still have a Business tier.
Business is the same seat on our relay: a company buys seats for its people, the seat holders get the work handle and the reserved inbox on the public network's relays, and the company runs nothing. It is designed on the same rail and on paper; it is not sold, and no billing exists in the app.
A call for help, and a check-in the team keeps when she cannot press anything.
A reporter in the field, an aid worker, a travelling employee: one press sends a call for help to the people she chose, and a check-in ("raise the alarm if I have not said I am fine by six") is kept on their phones, each keeping it independently, so taking her phone or switching it off cannot cancel the alarm. On the wire both are ordinary messages of the one fixed size, sent on the cover traffic's slots like any other, so a link does not show that a call for help was made or to whom; nothing is kept on a server, and nothing fires on a passphrase typed under duress. Since 30 October 2026 this is in the engine and its tests: three people each receive one call and each copy is tracked until that person's phone reports it; at the deadline each responder's phone raises the alarm once, not when "I am fine" arrived first, and one that was off through her answer raises it on return saying when her last word arrived; a person removed from the team raises nothing. The responders can be the people she chose or a group the organisation names, every member of which keeps the deadline for as long as she is in it. The app's "If you are in danger" screen offers both. On Android a responder's phone raises the alarm when Avano is open, and rings and names her over the lock screen when it is in a pocket, if alerts and the pocket ring are turned on; when "I am fine" reaches a responder after the alarm went off, the phone says she answered, in the alarm's place. Since 30 October 2026 all of this has run on two emulated Android phones over Tor, where one message took between twenty seconds and five minutes to arrive, which is why a check-in is set for half an hour or more. Both are also in each group's own menu, with that group already chosen, and a call for help can carry where she is, to about a kilometre, only when she ticks it, that time. Not yet: the alarm on an iPhone from the background, which needs a permission Apple grants, and any run on real phones. Until those, do not rely on it.
A team's own positions, with how sure and how old always on screen.
A member shares her own position with her team, by her own tap, for one hour, four or twelve, as her phone gives it or rounded to about a kilometre before it leaves. Every other member's phone shows each sharing member's last position with its radius and its age, greyed after two minutes and gone after fifteen, and "stopped sharing" when she stops; nobody's position is read without their own tap. A position is a group message of the one fixed size, sent on the cover traffic's slots and sealed to the members; no server holds one, and each phone keeps only the latest per member, in memory and never on disk. There is no map, because a map would tell its tile server where the team is. Since 30 October 2026 this is in the engine, its tests, and the app's group menu under "Team positions". When she starts sharing, the app asks for her precise position for this alone; she can answer approximate, and then her position is drawn with the few kilometres the phone gives. A location sent as a message in a chat stays rounded to about a kilometre. Since 30 October 2026 this has run on two emulated Android phones over Tor: one shared a precise position from the team sheet, the other drew it within 5 metres and 23 seconds old, then drew "stopped sharing". What a phone lets go of is wiped from its memory, not merely freed. Since 2 November 2026, on Android, she chooses before she starts how her share goes on: only while Avano is open; from her pocket where Avano already stays unlocked for calls (the default, which unlocks nothing more); or from her pocket with Avano kept unlocked until the share ends, which the sheet says plainly leaves the phone open to whoever takes it then. A share from a pocket shows a notification with the app's name and a Stop button and nothing else, needs Avano's notifications on, and asks for no background location permission. This ran on two emulated Android phones over Tor: positions fixed with her screen off reached the other phone under both pocket choices, and the key to her messages was dropped once the share ended. Not yet: the iPhone (there a share runs while Avano is open) and any run on real phones. Until those, do not rely on it.
Built and measured on two phones. Not sold yet.
Everything on this page runs on two Android phones against a relay built from the source, over a plain connection, on a rented machine, on 20 October 2026. No company runs a relay yet, no seat has been sold, and no contract has been signed; the outline of one is in the operator kit for counsel. Prices are a decision not yet made and nothing here is an offer. A company that wants to be first writes to hello@avano.app.