Physical Tamper Protection

• Strong encryption and Titan M security chip protects your device and data against sophisticated physical attacks.
• Verified boot ensures that your operating system has not been modified.
• Automatic kill switch: Automatically shutdown after inactivity of configured time period.
• PIN layout scrambling, together with privacy screen (not included), allow entering PIN in public without being watched. Alternatively: integrated fingerprint sensor.
• The NitroPhone is delivered in a sealed box.

Protection From Spyware and Zero-Day Exploits

• Substantially hardened Android OS for high security demands (e.g. hardened stock apps, libc, malloc, compiler toolchain, kernel, filesystem access, WebView).
• All apps are sandboxed to protect against exploitable and malicious apps.
• Hardened browser, WebView and PDF viewer.
• Lightning fast distribution of security updates.
• Protection against over-the-air exploits by isolating the baseband radio processor using IOMMU and optional LTE-only mode to significantly reduce cellular radio attack surface.
• Optional: For very high security requirements, both microphones and acceleration and rotation sensors can be removed. Indeed, acceleration and rotation sensors can be misused as microphones. This physically prevents conversations in the environment from being recorded. Phone calls can still be made with an external headset.

Privacy Protection: No Tracking, No Google

• No cloud or Google Play Services integration by default, all under your control. If required, original Google Play Services can be installed as sandboxed apps without special privileges. This novel approach leads to much better compatibility than incomplete reimplementations like microG while providing higher security. Note: This is work-in-progress and some apps may not work as expected.
• Tracking protection: Apps can’t access device IMEI and serial numbers, SIM card serial numbers, subscriber ID, MAC address etc.
• Per-connection MAC randomization prevents tracking by nearby WiFi scanners.
• Firewall: Granular network and sensors permissions (e.g. GPS) toggle for each app.
• Default Indicators for active camera, microphone, and location.

Easy Usability for Everybody

• No bloatware. Minimal secure system with few apps by default. Additional apps can be installed manually; updates have to be confirmed.
• End-to-end encrypted automatic backups to USB drive or to any cloud storage (e.g. Nextcloud).

Open Source and Attestation

• Open source allows verifying absence of backdoors.
• Remote attestation: hardware-based verification of the authenticity and integrity of phone’s software.

Who Needs NitroPhone?

• Professionals who need a secure smartphone for sensitive data and communication.
• People who want to use a privacy-friendly smartphone (without Google, without Apple).
• Companies who want to provide their employees a secure smartphone.
• Journalists, activists and NGOs who need to protect themselves and their contacts.

Hardware

• Google Pixel 4a, black, 128 GB storage
• RAM: 6 GB
• 147.6 mm (5.81″), 1080 x 2340 pixel, full-screen display with punch-hole front camera
• Rear camera: dual pixel technology with 12.2 MP
• Processor (CPU): Qualcomm Snapdragon 730G, Octa-core
• Titan M security chip
• Ports: USB-C, 3.5 mm audio jack
• Wi-Fi 802.11 a/b/g/n/ac, Bluetooth, NFC
• Fingerprint sensor
• 1x SIM card slot, 1x ESIM
• Dimensions: 144 x 69.4 x 8.2 mm
• Weight: 143 g

Scope of Delivery

• Google Pixel 4a, black, 128 GB storage
• Power plug, Europe
• USB-C to USB-C cable
• USB-A (female) to USB-C (male) adapter
• SIM card needle
• Sealed box

Why Google Pixel Smartphone?

• Unlike most other devices, Pixel smartphones include a Titan M secure element that enables Verified Boot.
• Pixel smartphones are supported by Android by default, so security updates can be distributed quickly.
• Pixel smartphones allow installation of custom software such as GrapheneOS. Ironically, this makes them some of the best hardware for Google-free smartphones.

Comparison With e.g. LineageOS, CalyxOS, /e/

LineageOS, CalyxOS, /e/ and other Android distributions essentially rely on the standard Android which only comes with its own selection of apps. GrapheneOS, on the other hand, is an elaborately hardened Android and should therefore be seen as its own operating system. In addition, security updates are often provided late by the distributions mentioned at the beginning.

Comparison With Linux Phones

Establishing Linux for smartphones as a third ecosystem alongside iOS and Android is a promising goal. In addition to thousands of existing applications, user freedom, transparency and security, the usability on both smartphones and large screens is compelling. Unfortunately, “Linux for Smartphones” is not yet mature enough for most users. In order to offer our customers a professionally usable, stable and secure smartphone, we have chosen GrapheneOS.