The second relay should not be ours.
A network run by one company divides nothing. Avano is built to be a network that others run: a relay from the source we publish, on machines only the operator can reach, in a jurisdiction of the operator's choosing, holding what every Avano relay holds, which is numbered slots of sealed bytes in memory and nothing else. The kit to do it is written. This page is for the organisation considering it.
What an operator sees is one sentence long.
A relay sees that a Tor connection opened or polled a numbered slot, when, and how many bytes; in the Simple posture it sees the phone's address for the life of that connection. It sees sealed blocks of one size and cannot tell a message from cover. It holds no account, no name, no number, no contact list and no history, and it writes nothing to a disk. What it cannot be made to produce is everything that is not in that sentence, because it was never there.
This is the same sentence for our own relay and for yours. It is the property the whole product rests on, and it is the reason the agreement with an operator is short.
A deploy recipe, a posture, and the undertakings, in one directory.
The operator kit is in the published source: the deploy recipe for one machine (a Tor onion service, the relay binary built from the source, memory-only storage, the health line), the posture the relay must keep (what it must never log, what it must shed first under load), the undertakings each side makes, an outline of the agreement for counsel, and, since October 2026, the same recipe for a company's own relay with seats.
From the source to a serving onion in one documented sequence, with every trap the first machines taught written beside the step that meets it.
Memory only; the written order of what goes first when the machine is full; one health line.
What the operator promises, what we promise, who holds which key. An outline for counsel, not a contract.
We ask for little, because the relay holds little.
We ask an operator to run the published source without modification, to keep the memory-only posture, to log nothing the posture forbids, to hold its own keys where we cannot reach them, and to tell its users the same sentence about visibility that we tell ours. We undertake to publish the source and every change to it, to keep the protocol stable across operators, to carry the operator's relay in the signed directory, and never to ask the operator for anything a relay does not hold.
The one thing neither side can promise is that a relay cannot be compelled by its own state. What a compelled relay can hand over is the sentence above, and the two-leg design means that one relay's answer is half of nothing.
A relay joins by a record in the signed directory, and nothing else changes.
The network's list of relays is a signed document. A new operator's relay joins it as one record: its identity, its onion address, its operator, network and jurisdiction. The record is signed by the directory's roster of keys, two of three, and every phone that verifies the next directory can place its next conversation leg on the new relay. No app update, no account, no registration: the record is the whole of joining.
Today the directory is not yet published, because the keys that sign it are kept off every machine until their ceremony, and no second operator has signed. The kit exists so that when one does, the only new thing is their record.
None yet. The longest lead time in the company, which is why the kit was written first.
One directory is one network. Several operators inside it is federation.
Federation, in Avano's terms, is several operators' relays under one signed directory, with every conversation's two legs placed on two of them. That is built, and waits on the keys and on the second operator. What is not federation, and is refused on purpose, is a phone on one network reaching a relay its own directory never vouched for: a link from another network names a relay the phone does not list, and the phone refuses it with a sentence. A sovereign deployment is an island by design, and its users want it so; bridging two islands is a directory decision between their keyholders, not a code path.
An organisation that wants its own leg of the split, without running a machine.
The same kit can be run by us, in the organisation's own hosting account or jurisdiction, as a managed relay: the organisation owns the leg, we operate it, and the relay still holds nothing that could be read. This is a service we have designed and priced on paper and have not sold; nothing on this page is an offer until it is. Write to [email protected] if your organisation wants to be the first.