Your own relay for your own people. It still cannot read them.
A company that wants its communication on machines it controls runs an Avano relay from the operator kit and reserves it for its people. The reservation is a seat: a credential the company issues blind, so that the relay can tell a seat holder from anyone else without learning which seat holder. The relay holds what every Avano relay holds, numbered slots of sealed bytes in memory, and the company that runs it cannot read a word of what its people say.
A seat is a monthly credential the company signs without seeing.
A seat is a blind signature under the company's key for one month: the phone blinds its serial, the company's mint signs it, the phone unblinds, and what it holds is a credential the relay can verify against the company's public key and cannot connect to the issuing. Two seat holders are two valid signatures; which is which, nothing records. The seat buys the two things a company's relay reserves, opening an inbox there and registering a work handle, and nothing else: messages, calls and files are what they always are.
The same relay as ours, with a gate on inbox creation.
A company's relay is the operator kit's relay with one setting: it reserves inbox creation and work handles for seat holders and leaves everything else untouched. Its record in the signed directory carries the company's class key, so a phone redeeming a seat checks that the relay it talks to is the company's and refuses one that signs under another key. A phone with a seat has its inbox on the company's relay; its contacts outside the company reach it there, through the same two-leg split as everywhere.
Inbox creation and work handles behind a seat; the company's key in the signed record; run end to end on two phones against a relay built from the source, over a plain connection rather than Tor.
A seat arrives as a one-time code, redeemed over the relay's own channel.
The company's console makes the month's key, prints the public half the relay pins, and mints one-time codes for its people. A person types the code on the Shield screen; the phone redeems it over the relay's channel, the blind signing happens there, a used code is refused, and the seat lands on the phone. Nothing in the exchange names the person, and the console keeps a list of codes, not of people.
Blind monthly credentials; a one-time code redeemed over the relay's channel; the console; the contract outline. On two phones: a code redeemed, a used code refused, a pasted seat, both inboxes bought, a message delivered.
The company sees that it has seat holders. Not who, not what, not to whom.
The company's relay sees what every relay sees: numbered slots, sealed blocks of one size, connections from the Tor network or, in the Simple posture, from addresses. It sees that a valid seat opened a slot and never which seat. It cannot read a message, cannot list a person's contacts, cannot tell a message from cover, and cannot be made to produce any of those, because it never held them. That is the product: a company that controls its machines and still cannot surveil its people, and can say so to them and to anyone who asks.
A company without its own relay can still have a Business tier.
Business is the same seat on our relay: a company buys seats for its people, the seat holders get the work handle and the reserved inbox on the public network's relays, and the company runs nothing. It is designed on the same rail and on paper; it is not sold, and no billing exists in the app.
Built and measured on two phones. Not sold yet.
Everything on this page runs on two Android phones against a relay built from the source, over a plain connection, on a rented machine, on 20 October 2026. No company runs a relay yet, no seat has been sold, and no contract has been signed; the outline of one is in the operator kit for counsel. Prices are a decision not yet made and nothing here is an offer. A company that wants to be first writes to [email protected].