01
Identity in a commercial database
Numbers, devices and staff profiles are held in the operator's commercial database, outside the ministry's perimeter.
Secure MVNO for government: rent the network, not the identity
A ministry pays for mobile service as a customer and controls none of it as an owner. A government MVNO changes that.
- Inside the perimeter
- identity, records, policies, the BSS
- From the host
- coverage only
- Delivered
- a closed loop for a private LTE network
Reviewed by Alexander Donskoy, Sales Director, Avante · Last reviewed 2026-09
Starting point: your staff are customers of commercial operators
02
Internal calls are visible outside
Who calls whom inside the ministry appears in the operator's records like any ordinary subscriber.
03
No policy control
The ministry cannot decide which devices, destinations or hours official communication is allowed on.
04
In a crisis you queue with everyone else
Official traffic shares capacity with civilian subscribers, so there is no priority at the moment it is needed most.
Only signalling and traffic cross the boundary
The MVNO core is deployed in an approved government data centre. Interfaces to the host network (online charging, provisioning, mediation, SIM and eSIM, settlement) are detailed in the technical annex.
Inside the government perimeter
- subscriber database and staff profiles
- call-record archive
- access policies and keys
- BSS and charging system
- signalling
- user traffic
everything the host operator needs, and nothing else
On the host operator's network
- radio access and core
- SMSC
- eSIM platform
- roaming and interconnect
Your perimeter, their coverage
The platform behind it: 15 live MVNOs · 12M+ subscribers served · 3 MVNE installations · 150M+ load proven in testing.
01
Identity inside the perimeter
Numbers, devices and staff profiles sit in a dedicated instance inside the government perimeter, not in the operator's database.
02
Priority written into the contract
Priority for official subscribers during congestion is a requirement on the host, fixed in the SLA when the operator is chosen. Avante drafts the requirement and checks performance against it; the host delivers.
03
A second network as insurance
One BSS runs in multi-host mode, so the failure of one network does not stop the ministry.
04
One tariff, departmental budgets
Rates are agreed once. Each department gets its own budget and limits, and premium services or roaming can be blocked in real time.
05
Audit and sovereign control
Every access to the data is logged under a role model. Administration stays with the ministry.
06
Standard interfaces, no changes at the host
Only signalling and user traffic cross the boundary, over standard telecom interfaces. Nothing has to change on the operator's side.
The host carries the traffic, not your identity data
| Ministry | Avante | Host operator |
|---|---|---|
| Security policy and access rules | Identity, access and charging core | Spectrum, radio network, coverage, capacity |
| Rules for personnel and devices | Traffic control and audit events | Transport to the agreed point of interconnection |
| Monitoring and incident response | Integration, support and staff training | Interconnect, roaming, SLA |
| Lawful interception under national law |
Identity and rules belong to the ministry. Traffic and coverage belong to the operator. The boundary is the contract itself, fixed in the wholesale agreement and the MVNO service description.
The host gains a tenant it does not lose; the regulator gains a template
Market reference: dedicated priority mobile services for public safety already exist. FirstNet in the United States has 8.4 million connections with 24/7 priority and pre-emption on AT&T; ASTRID Blue Light Mobile in Belgium is a priority service for emergency and government agencies on Proximus. Sources: FirstNet, July 2026; ASTRID. Both are independent programmes, not Avante deployments.
For the operator
- long revenue, low churn: a government tenant does not migrate for a discount
- base consolidation: staff spread across every operator today move onto one network
- volume without investment: wholesale traffic on the existing network, with no secure BSS to fund
- someone else's risk removed: the ministry's identity data and policies are not its concern.
For the regulator
- the market opens without spectrum: a new service layer on existing networks
- new revenue: licence fees, numbering charges, annual regulatory payments
- data in national jurisdiction: civil servants' data stored and processed in-country with logged access
- every control preserved: interception, numbering, emergency calls and reporting, as today.
Choose the model first. The build follows.
01
Target model: Full (8 to 10 months)
Own core, network data and full autonomy. It gives the ministry the most control and asks the most of the operator. The closed domain is complete: identity, policies, records and audit inside the perimeter.
02
Medium
Own BSS, identity and charging inside the perimeter, with the host's core. This is the alternative where time or scope argue for it. The choice between Medium and Full is made at the assessment stage, and the clock starts once the host agreement is signed and the regulator has approved.
How we get there
01
Joint assessment with the operator
Feasibility on the host side, and the target model.
02
Architecture and accountability matrix
Who does what, and what is fixed in the contract.
03
Secure pilot
A limited group of subscribers, and a security review.
04
Commercial launch
Rollout to the ministry's full headcount.
The decision today: approve a joint assessment with the host operator and select the target model.
Frequently asked questions
What is a government MVNO?
A mobile service for public-sector staff run by the state or its agency as a virtual operator: the host operator provides coverage and carries traffic; the government owns the subscriber database, the usage rules, the records and the audit trail, on a BSS deployed inside its own perimeter.
Where is the platform deployed?
In an approved government data centre or the ministry's own infrastructure. Only signalling and user traffic leave the perimeter; subscriber data, call records, policies, keys and the charging system stay inside.
How is priority during congestion delivered?
By the host operator, under its SLA. Priority for official subscribers is written into the wholesale agreement when the operator is selected; Avante drafts the requirement and verifies performance against it.
What happens if the host network fails?
The BSS runs in multi-host mode, so a second network can be contracted as insurance; the failure of one network does not stop the ministry.
Does the host operator need to change its network?
No. The MVNO connects through standard telecom interfaces (online charging, provisioning, mediation, SIM and eSIM, settlement), all detailed in the technical annex.
How is lawful interception handled?
Under national law, by the host operator on the traffic it carries, with hand-off points agreed in the accountability matrix. Interception, numbering, emergency calls and reporting remain with the regulator as today.
How long does it take?
Full model: eight to ten months once the host agreement is signed and the regulator has approved; a Medium model is faster. The path is interconnection and IMSI → integration and testing → secure pilot → commercial launch.
The next step is a joint assessment
A working session with your host operator and your security team. It ends with a target model (Medium or Full), an accountability matrix and the scope of a secure pilot: which group, which services, which security checks.