The security pages that also list what we can't do.
A trust centre that lists only strengths is marketing. These pages name the adversary next to each claim, say where the protection stops, and state plainly that nobody outside this project has audited any of it.
Five documents, in the order worth reading them.
What you can check yourself
Every claim we make, sorted by whether you can confirm it without trusting us. Most rows currently say no, and the page leads with them.
The threat model, in plain language
Who Avano defends you against and who it does not, what happens if your phone is taken, and where we are behind Signal.
What a relay operator sees
The server in the middle, in detail: what it holds, what it can work out over time, and what a copy of its memory would yield.
What Avano refuses to do
No calls, no notifications, no link previews, no cloud backup, no administrator mode. Each with the argument, so you can disagree with it.
What we hold, line by line
Every category of data that exists anywhere in this system, including the many where the answer is none.
Report a vulnerability
How to reach us, what we commit to, and what we do not offer — including the bug bounty we do not have.
What we hold, and what we deliberately do not.
Avano's security comes less from a clever secret than from a refusal to collect. The less that exists, the less can be seized, subpoenaed or leaked.
No account to point at
No phone number, no email, no name. Your identity is a key on your device, so there is no account record for a court to name and no directory to subpoena.
End-to-end, post-quantum
Messages are sealed with unmodified libsignal, including its post-quantum ratchet. We build around audited cryptography; we do not write our own.
The relay never sees your address
Everything travels over an embedded Tor client, as fixed-size sealed blocks under random codes. The relay has no accounts, no sender field, and nothing on its disk.
Sealed and lockable at rest
Each stored item is encrypted, and the app can be locked behind a passphrase bound to a hardware-held key. It locks itself on leaving the foreground — and while locked it receives nothing.
Four things this page would be dishonest without.
- libsignal — the cryptography we build on — is independently audited. Our own additions are not, and that is where every distinctive claim on this site lives.
- An external audit is on the roadmap. Until it happens we will not imply an assurance we do not have, and “built on audited cryptography” is not the same sentence as “audited”.
- Licensed
AGPL-3.0-or-later; the repository is private today. The app's own trust screen reads Open-source · PLANNED and this site agrees with it. - Until it is public, every architectural claim we make is one you have to take on our word — including the ones we are proudest of.
- The build is hand-made, signed with a development key, delivered by hand, with no published hash and no public log. Every comparable service that was broken was broken here.
- We are not in an app store. There is no update channel and no way to revoke a bad build — including ours.
- The design splits a conversation so no single relay sees both ends. A second relay exists, in another country with another company. The app does not dial it yet.
- Until it does, one legal order reaches one operator and that is sufficient. We would rather write that than describe the split in the present tense.
An overstated security claim is worse than none.
Because somebody acts on it. That is not a figure of speech in this project — it is the rule our own engineering documentation is organised around, after a review found nine claims in our code that were false, each of them with a test that “confirmed” it.
The response was not to write better marketing. It was to adopt three rules that now govern the code and this website equally: name the adversary next to the claim; assert the property, not something that implies it; and watch a test fail before trusting it. When a claim turns out to be wrong we correct it in place and record why it looked right, rather than deleting it quietly.
Several sentences on this site were removed or weakened during its last rewrite for exactly that reason. If you find one we missed, that is a security report and we would like to receive it. How to send one →
The claims, and how to check them.
Every strength above has a matching limit. Read the one page that sorts them.