What is true today
- Avano is founder-led and self-funded. There are no outside investors, no venture capital, and no board. It is small by intention rather than by stage — being small and independent is part of the threat model: less to subpoena, less to acquire, less to lean on.
- Contact: [email protected]. This address is real, monitored, and the same one published for security reports, press, legal requests and everything else. We use one address rather than a wall of them because a wall of addresses is a wall of things to get wrong, and we can only vouch for the ones we have tested.
- Website: avano.app. Machine-readable security contact:
/.well-known/security.txt.
- Source licence:
AGPL-3.0-or-later. The repository is not yet published. A build that includes libsignal, which is AGPL-3.0-only, is distributed under AGPL-3.0-only until counsel says otherwise.
What is not settled, and therefore not stated
Registered company name and legal formPendingAn Estonian private limited company (osaühing) is being registered to operate Avano; its name will be printed here when the registration is complete. The name “Aere Network” that appears across this site is a project name, not the registered entity.
Country of establishmentEstonia, registration pendingDecided on 2026-08-22: Estonia, an EU establishment. This determines the governing law of the terms (Estonian, from the day of registration), which data-protection authority supervises us (the Estonian Data Protection Inspectorate), which legal orders bind us directly, and that no EU representative is needed. Nothing here is in force until the registry entry exists.
Registered addressPendingFollows from the above. An imprint without a postal address is incomplete in several jurisdictions that may apply to us.
Company registration number and VAT identifierPendingFollows from the above.
Managing director / responsible personPendingSeveral regimes require a named natural person responsible for published content. Whether we are in scope is unconfirmed.
Data protection officer, or EU representativePendingAn EU representative (GDPR Article 27) is owed only by a controller established outside the Union. An Estonian company is established inside it, so none is needed once the company is registered. A data protection officer (Article 37) is owed for large-scale monitoring of people or large-scale processing of special categories of data; our reading is that we do neither. Counsel is to confirm both.
Regulatory point of contactPendingOwed under the Digital Services Act at any size (Article 11): one point of contact for authorities, reachable in Estonian and in English (Article 11(3)), published here when the company is registered. For users (Article 12) there are two ways to reach us: the email address above, and the postal address that follows registration. Notice-and-action (Articles 16 to 18) attaches to hosting services; our reading is that the relay is a mere conduit, a kind Recital 29 says includes interpersonal communication services, and a notice could not locate an opaque block in any case.
Contact for European evidence ordersPendingA provider established in Estonia that serves users in another member state designates a contact for European production and preservation orders in criminal matters, and notifies the Consumer Protection and Technical Regulatory Authority of it in writing, with the languages it can be addressed in, Estonian among them (Electronic Communications Act § 4¹, Directive (EU) 2023/1544). It will be named here. Such an order must be answered within ten days, or eight hours in an emergency; what we can produce is on the law-enforcement page.
Why we are publishing the blanks
An imprint is one of the few pages where an incorrect entry is actively harmful: it tells a regulator, a court, or a person with a legitimate complaint where to go, and sending them somewhere wrong wastes their time and looks like evasion. It is also the page most often filled in with something approximately true.
The same rule governs this site as governs the code: do not claim what you have not checked. We have not checked, so this page says so. The table above turns into an imprint the day the entity exists, and not before.
Infrastructure, for the record
The website is served by a commercial hosting provider. The relays run on rented virtual machines from one commercial provider. One message relay runs today; a second is planned for the two-relay split but not currently deployed, and a separate call relay carries call media: voice, and on Android video. We publish the country each relay runs in, and deliberately not its provider or address: a relay's precise location is targeting information, and publishing the pairing of a provider and an address would hand an adversary, for free, exactly what such work otherwise costs them. What a relay host can and cannot do is described in full on our law-enforcement policy, which is the part that actually affects you.
