Hardware that slows an attacker down.
The Pixel security chip helps protect encrypted storage by enforcing delays between incorrect unlock attempts. You choose the private PIN or passphrase.
Pedido en euros — el importe mostrado es el del pago seguro. Formulario en inglés.
A hardened GrapheneOS Pixel, private communications and 15 approved apps. Prepared before dispatch; you create your private vault and PINs.
Your complete kit includes the configured handset, security apps, a managed mailbox during onboarding and personal support.
The foundation of a GhostWire handset
Pixel hardware. GrapheneOS protection. GhostWire communications. Three layers, each with a clear job.
The Pixel security chip helps protect encrypted storage by enforcing delays between incorrect unlock attempts. You choose the private PIN or passphrase.
GrapheneOS adds exploit defences and tighter isolation between apps, alongside controls over network, sensor, file and contact access. No Google account is required.
We verify the official OS signing key and relock the bootloader. Verified boot checks the signed operating system as it starts.
Encrypted user profiles and automatic reboot help protect stored data. Our stock setup uses an eight-hour locked-device reboot interval; you set your own screen lock.
Official GrapheneOS security updates remain available. GhostWire and its companion apps use signed update channels. OS support duration depends on your Pixel model.
No phone-number account. Hybrid post-quantum messaging and current-pair ML-KEM-rooted frame protection for voice and video. The private vault and included security apps complete the kit.
Titan M2 protects the hardware foundation; it is not the messaging protocol. GhostWire communication keys remain on the handsets. Pixel and GrapheneOS are independent products, with no endorsement implied.
The Pharoah Technology approach
No technology can detect every threat. GhostWire brings together stronger defences, security tools and practical awareness to help you protect yourself when it matters. We look beyond the obvious risks to your conversations, data and everyday privacy.
Understand which apps can access your location, microphone, camera, contacts and files. Allow only what you need.
Encryption matters. So do the handset, the apps you install, the networks you join and what happens if the device is lost.
Use the included security tools and available permissions to make informed choices. No phone can identify every tracker or prevent every attack.
A mobile network can still infer a connected handset’s location. App permissions, a VPN and encrypted messaging do not make you invisible to your carrier.
You use it like a phone. We remove the usual ways your device, account and conversations can be tied back to you. Built for founders, lawyers, journalists, crypto holders, travellers and anyone who needs a phone separated from their normal identity.
There is no key escrow and no equivalent server-side key store. GhostWire routes your messages, voice and video without holding the keys needed to decrypt them.
Hybrid X25519 + ML-KEM-768 pairing protects messages, and v2 sessions refresh ML-KEM protection on each ratchet turn. Each dead drop uses a fresh ML-KEM-768 encapsulation mixed into its hybrid handshake. Current GhostWire pairings add ML-KEM-rooted application-frame encryption above DTLS-SRTP for voice and video, derived from the pairing rather than renegotiated per call — that is the difference, and it is what allows a locked handset to answer. Sessions migrated from earlier builds remain DTLS-SRTP.
There is no GhostWire phone number or account to hand over. You pair by invitation and verify the other person directly.
Where the deployment enables USB auto-wipe, a locked USB data plug-in triggers the configured handset reset. GrapheneOS’s own duress PIN at the lock screen wipes the whole device including eSIMs, while GhostWire’s separate duress PIN removes only the private vault. You choose your private PINs during setup. USB auto-wipe is optional: manually enable USB-C data in GrapheneOS, then arm it in GhostWire. Enabling the app option alone does not change the USB-C setting.
A dead drop is a message the receiving handset consumes once. Every drop makes a fresh ML-KEM-768 encapsulation to the recipient's published mailbox and mixes it into the hybrid handshake, sent from a throwaway account so the drop does not name its sender. It expires after 1 hour, 24 hours or 3 days, or sooner under their conversation setting, and your side keeps only a delivery marker. It cannot stop someone copying what they can read, and the app says so before you send.
Current hybrid-authenticated GhostWire pairings derive ML-KEM-rooted application-frame keys and use them above DTLS-SRTP for voice and video. Any session negotiated without that frame layer remains DTLS-SRTP rather than being mislabelled post-quantum.
The current customer flash set contains 15 pinned apps: ten first-party GhostWire product apps plus Signal, Molly, Telegram, Cake Wallet and Mullvad VPN. Every APK is version-, hash- and signer-pinned; the handset build refuses to complete if a required app is missing, undeclared or signed by anything else. LinkBond and Vehicle Scanner are included in the handset flash bundle; the GhostWire Router companion is separate and sent by download link to router buyers. Beyond the flash set, the GhostWire approved-app store on the handset offers six reviewed third-party apps for on-demand install — SimpleX Chat, Session, Threema Libre, Briar, Cake Wallet and Mullvad VPN — served from our own repository at apps.ghostwire.co.uk/t1. The catalogue is signature-verified on the handset before anything installs, each release is pinned to its publisher’s signing key, and nothing outside the catalogue can be installed through it.
Official GrapheneOS security updates remain available through its system updater. GhostWire and companion apps use our signed update channels. The approved-app catalogue verifies its own downloads; it does not block every other Android installation route.
The zero-identity messenger. Invite-paired, no accounts, no phone number. Hybrid post-quantum pairing on every session.
Estate certOpenPGP mail on the handset. One managed mailbox is included, set up by our operators during onboarding; or connect your own IMAP/SMTP account.
Estate certOur own browser build. No Google services, no telemetry, no sync account, nothing phoning home.
Estate certOffline-first maps. Routes and searches resolve on the handset; your location is never reported to us or anyone else.
Estate certWi-Fi intelligence for the handset: current-network checks, router handoff and dual-network research. Pinned into the handset flash bundle.
Flash bundle · vc15 / 0.3.0Always-on mobile-network watch. It checks baseband anomaly signals and warns about suspicious cell-tower behaviour, including downgrade, unknown-serving-cell and identity-inconsistency patterns. It cannot confirm an IMSI catcher.
Mobile network watch · includedOn-device installed-app and permission-risk scanner. It scores apps already on the handset for spyware and malware indicators and shows those findings locally. It is not a network firewall.
App-risk scanner · includedYour Room Scanner and Wi-Fi Scanner. It probes devices on the current local network for camera/NVR risks and unusual network devices. Analysis and results stay on the handset and are not uploaded.
Room + Wi-Fi scanner · includedSoftware radio-density and Bluetooth proximity indicators for a controlled space before a sensitive meeting. It is not a complete RF/TSCM detector; dedicated RF hardware is required for a full sweep. Powered-off, wired and passive devices are outside the scan.
Radio/Bluetooth indicators · includedCompares salted anonymous Wi-Fi and Bluetooth references outside and inside a vehicle. It does not claim to detect powered-off, wired, cellular-only, passive or non-radio devices.
Vehicle comparison · vc1 / 0.1.0The handset is the part you hold. It sits on a much larger engineering programme — a specified, numbered suite covering identity, transport, storage, device management and assurance. Not every component is a consumer app, and most of them you will never see. That is the point: they are the reason the ten apps above can make the claims they do.
Live security backbone: GhostPolicy gates policy decisions; GhostLedger keeps tamper-evident evidence; GhostAdmin controls privileged actions; GhostUpdate verifies signed releases and rollout decisions; GhostMesh provides the peer transport; and GhostWire runs its own relay, wake-push service and fleet cockpit. These are platform services behind the handset, not third-party downloads.
Release and provisioning controls: GhostOS verifies image provenance and signed GrapheneOS configuration profiles locally; SCARAB and Privacy Audit supply the app-risk, network and camera/NVR checks. Their release artefacts are kept separate from the handset flash set and are promoted only after the signing and device gates pass.
Radio claim boundary: Shield warns on nine observable Android cellular-anomaly signals. Android public APIs cannot confirm an IMSI catcher, null-cipher attack, silent SMS or paging attack; those require privileged baseband or hardware access.
Current manufacturing truth: every handset ships on the live signed mandatory OTA release; its USB auto-wipe path was physically bench-proven on the release bytes. Pixel 9a and Pixel 10a factory bundles are retained in GhostWire-owned private R2 and passed downloaded-byte verification; Google Drive is not used for factory-bundle publication. Five included security apps: GhostWire Shield, SCARAB, Privacy Audit, Safe Room and Vehicle Scanner ship on every handset alongside GhostWire, GhostMail, GhostBrowser, GhostMaps and LinkBond. The first-party local USB auto-wipe control is inside GhostWire; the retired Wasted APK and link-distributed Costa Alert are not preloaded. The wider suite contains shared libraries, hosted services and operator tools; these are separate from the handset apps. GhostMail ships on the handset with one managed OpenPGP mailbox included for onboarding. Its Mac client is also available for personal, team and company use; extra managed accounts are 45,45 €/year, five for 173,63 €/year, or ten for 290,16 €/year. Your included six-month GhostWire service starts at actual handover, not while unsold stock is boxed.
Your apps. Your choice.
GhostWire is built for private communication. Other apps on your handset have their own security and privacy practices.
We select the third-party apps we consider suitable for inclusion or download on GhostWire handsets. Our catalogue checks publisher signing keys and approved releases to reduce the risk of installing a tampered or unexpected app.
Selection is not a guarantee that an app is free of vulnerabilities, malware or tracking. You use third-party apps at your own risk; their permissions, privacy policies, services and future updates remain separate from GhostWire.
For sensitive conversations, use GhostWire’s own messaging, voice and video with your GhostWire contacts. Installing another app does not give that app GhostWire’s encryption or privacy protections.
This guidance does not limit your statutory consumer rights or our responsibility for the product and services we supply.
Prepared to order
Choose from the Pixel 10 range as well as our existing handset range. We confirm the model, availability and complete kit price before accepting your order.
Tell us your preferred Pixel, storage and delivery destination.
We prepare GrapheneOS and the GhostWire kit, then complete the handset checks. Your private PINs remain yours to create.
All device orders dispatch within 48 hours of a confirmed order and payment, subject to agreed availability. Courier delivery time is separate.
Tracked courier delivery to your chosen home or business address. Express service is available on request; any express charge and the delivery estimate are confirmed before booking. PO boxes are accepted only where the chosen delivery service supports them.
Ask about your Pixel →Pixel 10 models are prepared to order. Model, storage, condition and final price are confirmed individually.
The kit is the complete device, GhostWire service and suite. After your first six months, a recharge continues the relay, updates and suite. Hybrid post-quantum messaging and current-pair ML-KEM-rooted voice/video frame protection are included; calls are unmetered while service is active. Optional roaming-data SIM plans are renewed separately.
Support included: setup and handover support are included with the kit. Statutory rights are unchanged; hardware warranty and replacement handling follow the device source and condition confirmed on the order.
A GhostWire-configured GL.iNet Mudi-family portable router. Phones, laptops and tablets join its secured Wi-Fi and use its Mullvad WireGuard tunnel without installing a VPN app on each client.
Optional data: add a six-month prepaid physical SIM for this router, or an eSIM or physical SIM for a GhostWire handset, covering 160+ countries. Each option starts at 291,32 € for the basic data plan; higher-data plans cost more and the final price is confirmed before payment. Router eSIM is not advertised until the physical-eSIM-card route passes acceptance on the exact hardware. Every router is configured and connectivity acceptance-tested before dispatch. The Android router companion is sent as a private buyer download link with router orders and currently performs read-only reachability checks until the write contract is fully measured.

GhostWire
Mail
Browser
MapsWith no physical SIM, no active eSIM and cellular disabled, the GhostWire handset does not register to mobile towers. It joins the GhostWire router over secured Wi-Fi, while the router carries the data connection and wraps connected-device traffic in its fail-closed Mullvad WireGuard tunnel.
No handset cellular identity.The mobile session uses the router SIM/IMSI and router modem IMEI. The SIM-free handset does not supply an IMSI, and its IMEI is not transmitted through its Wi-Fi connection to the router.
No personal VPN login.Each router receives its own Mullvad numbered account and WireGuard profile. Mullvad requires no customer name, email address or phone number for that account.
The SIM and public Internet identity are separated.The carrier sees an encrypted WireGuard connection from the router, while websites and services see the Mullvad exit IP rather than the SIM connection. If the VPN stops, the router kill switch blocks Internet traffic instead of exposing it.
Calls and messages remain data services.GhostWire messaging, voice and video work over the router Wi-Fi. Native carrier calls and SMS are not used; emergency calling requires another available route while handset cellular is disabled.
Security boundary: zero identity here means no GhostWire account identity, no handset SIM identity, no handset tower registration and no personal Mullvad login. The carrier still operates the router SIM session, but that transport identity is isolated on the router rather than attached to the GhostWire handset or messenger. Keep handset cellular disabled in this mode.
No mystery hardware, no "military-grade" hand-waving. This is exactly what ships, layer by layer, as verified on our own field fleet. Together they are a combination we have not seen assembled on one handset before: an on-device post-quantum hybrid handshake, cellular anomaly warnings, camera/network-risk indicators, a controlled-room RF/Bluetooth sweep and relocked verified boot and an instant duress vault-wipe, on Pixel 7a, Pixel 8a, Pixel 9 or Pixel 9a.
resists harvest-now, decrypt-later
zero identity by architecture
forced to unlock? the vault is already gone
handset eSIM or physical SIM · each from 291,32 €
Placing the order reserves your allocation and locks your price. Secure Stripe checkout offers card, PayPal, Klarna and Clearpay where eligible. If you would rather arrange payment, your order still stands: we reply within one business day and invoice you for crypto or bank transfer.
Keep this reference. You can pay now — or wait for our reply (within one business day) confirming allocation, shipping or in-person handover first.
Pay now in Bitcoin: scan the code or send the £ total in BTC at today's rate to bc1qc7uvjnes2uc3exhzddthmhvnsdhqc8jdzm356q — then email your reference and transaction id. Dispatch within 48 hours after order, availability and on-chain payment confirmation. Courier delivery time is separate. Monero and Ethereum are also accepted — addresses below.
Monero (XMR) (scan or copy):
44oS88zR9ViXPzRbFP2Xf9AdLVPvq9z9gb9DqiXLptHLM7f7ypz9dEZGqe8XGj8UXQ7UYWdGyJti9FxXk3HAcRK3CPccG49
Ethereum (ETH) (scan or copy):
0x10c39A531c709EEb61E0a002375E721EF6B908bA
Questions in the meantime? info@pharoahtechnology.co.uk, quoting your reference. Or message us on Telegram: @ghostwireuk.
Stripe checkout, finance, crypto or bank transfer. Card, PayPal, Klarna and Clearpay are enabled on the live checkout, handled by Stripe, and shown where the buyer and order are eligible. Apple Pay, Revolut Pay, Amazon Pay and Bizum can also appear where supported by the buyer's device and country. Finance is subject to provider approval and the methods Stripe displays. Or reserve first and pay by crypto (BTC, XMR or ETH) or bank transfer against a proper invoice from Pharoah Technology Ltd once we confirm your allocation.
BTC: bc1qc7uvjnes2uc3exhzddthmhvnsdhqc8jdzm356q
If you are paying in crypto rather than by card, send it once we confirm your allocation and email your order reference with the transaction id so we can match it. Monero and Ethereum addresses are published below — no need to ask.
Monero (XMR) (scan or copy):
44oS88zR9ViXPzRbFP2Xf9AdLVPvq9z9gb9DqiXLptHLM7f7ypz9dEZGqe8XGj8UXQ7UYWdGyJti9FxXk3HAcRK3CPccG49
Ethereum (ETH) (scan or copy):
0x10c39A531c709EEb61E0a002375E721EF6B908bA
Yes — Klarna and Clearpay are enabled on the live Stripe checkout for both handset kits and the router. Stripe shows either option only where the buyer and order are eligible.
The finance provider is the lender, not us. They decide whether to approve you, they set the instalment plan and any interest, and we are not told why an application is declined. Nothing changes at our end: your kit is built and dispatched exactly the same way.
If finance is declined, is not displayed, or you would rather not use it, card, PayPal, crypto and bank transfer are still available.
The minimum an order needs: a name or alias, an email to reach you on, and a shipping country for kits. The device itself has no account and is never linked to your order details after handover.
The current range is Pixel 7a, Pixel 8a, Pixel 9 and Pixel 9a. Pixel 10a is priced at 3088,04 € and prepared to order; ask us to confirm availability.
Worldwide. Kits dispatch within 24 hours of confirmed payment, tracked and discreetly packaged. In-person provisioning and handover can also be arranged; tell us in the order notes.
Order the recharge and include your unit reference if you have it. GhostWire relay service, security updates and the Shield suite continue for another six months. Encrypted calls stay included and unmetered throughout. Any prepaid handset eSIM or physical SIM is renewed and priced separately.
Not yet, and we say so plainly. The architecture is no-backdoor by design, built on audited primitives, and we are migrating to fully audited cryptography. Design-partner pilots run today; we scale with formal assurance. We sell privacy and sovereignty; we do not sell "police-proof".
The relay receives delivery envelopes, not communication keys. GhostWire runs no Key Management Server, key escrow or equivalent server-side key store. Encryption keys stay on the GhostWire handsets, so the delivery layer has no path to decrypt communications. See the privacy policy for the data-handling terms that apply to your service.
We answer within one business day.
Email: info@pharoahtechnology.co.uk
Telegram: @ghostwireuk
In-person provisioning and handover by arrangement. Government and fleet enquiries: mark your message "sovereign" and it goes to the top of the pile.
Sales via Telegram
Scan to start an order or delivery conversation with @ghostwireuk.
Open Telegram salesCard, PayPal, Klarna or Clearpay at checkout — plus Apple Pay, Revolut Pay, Amazon Pay, and Bizum in Spain, each shown where your device, order or country supports it. Or pay by crypto or transfer once we confirm your allocation.
Pay in instalments. Klarna is offered at checkout on every kit in the range, 2680,18 € to 2913,24 €. Approval, the instalment plan and any interest are entirely Klarna's — they are the lender, not us, and we are not told why an application is declined. Paying by card, crypto or transfer is always available instead.
Bitcoin (scan or copy):
bc1qc7uvjnes2uc3exhzddthmhvnsdhqc8jdzm356q
Monero (XMR) (scan or copy):
44oS88zR9ViXPzRbFP2Xf9AdLVPvq9z9gb9DqiXLptHLM7f7ypz9dEZGqe8XGj8UXQ7UYWdGyJti9FxXk3HAcRK3CPccG49
Ethereum (ETH) (scan or copy):
0x10c39A531c709EEb61E0a002375E721EF6B908bA
Bank transfer to Pharoah Technology Ltd — account details are issued on your invoice, never published here.
Card payment at checkout, handled by Stripe. Email your order reference with any crypto payment. Dispatch within 48 hours of confirmed payment, worldwide.One kit, on Pixel 7a, Pixel 8a, Pixel 9 or Pixel 9a.
Priced by device: 2680,18 €, 2796,71 € or 2913,24 €. Pixel 10a will be 3088,04 € by confirmed order. Recharge 873,97 € per 6 months. Encrypted calls are included and unmetered while service is active.
Every kit: GrapheneOS relocked with verified boot, zero-identity comms with an on-device post-quantum handshake, the counter-surveillance suite, and duress-PIN protection you configure with your own credentials. An optional six-month prepaid roaming eSIM for a handset, or physical SIM for a handset or router, covers 160+ countries and starts at 291,32 € for either option's basic plan; higher-data plans cost more.
An open invitation
We will hand you the keys: a device on the table, the full spec sheet, and our undivided attention. Get in, show us how, and we will fix it and shake your hand. That is how confident we are in what ships.
Take the challenge