What you get
A Pixel with GrapheneOS, installed and configured by us, with your e-mail, your calendar and your own application list tested before we ship it. You do not get a box with a manual; you get a phone that behaves, and one party to call when it stops. We supply new or refurbished models, always with the same configuration.
We do not print a price here. It depends on model, new or refurbished, quantity and how much we are asked to operate — you get that in a quote after the conversation.
Why a different phone
An ordinary Android or iPhone is designed to deliver services, not to protect you. Those services mean: a manufacturer that records your location and usage, a chat app that knows your contact graph, and a carrier that ties your number to you. Three things make that a business problem:
- The SIM card is the weakest link. Taking over a number gives access to one-time codes. After the Odido and Ben leak of 6.2 million records in February 2026, that is no longer theory.
- Device access. A burglar, a seizure, or a colleague with your password: on an ordinary phone they find login data, chats and photographs.
- Metadata. Even when messages are encrypted, a provider knows who you speak to and when. For a lawyer or a negotiator, that is often the sensitive part.
What GrapheneOS is
GrapheneOS is a hardened operating system for specific Pixel handsets. It is Android without Google's services, with strengthened memory protection, stricter sandboxing and a verification system that checks the software really came from the project. Updates arrive directly from GrapheneOS rather than through a carrier, and Google cannot alter the device remotely.
What it is not: an anonymous phone. Your number stays registered to you, your carrier still knows where you are, and whoever carries your traffic can see metadata. GrapheneOS shrinks the attack surface of the handset; the rest of the chain we design separately.
What we do, step by step
- Choose a model based on how long you intend to keep it and which apps you need.
- Flash verified images and re-lock the bootloader, so the phone only accepts software from the project.
- Read out and disable: apps, location services, telemetry, default apps.
- Install sandboxed Google Play only where required — in an isolated context, without letting Google manage the device.
- Add your organisation's mail and calendar, with two-factor configured in a way that fits your risk.
- Test your own application list on the device and record what works and what does not.
- Handover: a short walkthrough, a one-page summary, recovery codes on paper, and a plan for who manages what.
Will my app work? (status September 2026)
This changes with every update, for every vendor. That is why we test your list; below is the current state, not a promise.
| App or service | Status on GrapheneOS | Solution |
|---|---|---|
| DigiD (including the app and the NFC identity check) | Works; since September 2025 Logius no longer requires a certified device | install as usual |
| ING, ABN AMRO, bunq, SNS, ASN, Knab | Work in practice through sandboxed Google Play; ABN AMRO can briefly fail Play Integrity after an app update | sandboxed Google Play |
| Rabobank | Works, usually installed via the Aurora Store | Aurora Store |
| iDEAL | Works; the browser route always does | bank app or browser |
| Works but needs Play services, and keeps metadata with Meta | sandboxed Google Play — better replaced by your own chat | |
| Revolut | Refuses devices without Google certification (since late 2024) | another bank, or browser features |
| Other apps using Play Integrity (insurers, travel, some streaming) | Mixed; some refuse | we test beforehand |
| Android Auto | Works since 2024 | sandboxed Google Play |
| Tap to pay | No contactless payment from the phone | physical card or watch |
| Google Wallet and card provisioning | Does not work as you are used to | physical card |
Limitations, without spin
- No contactless payment from the phone. This is the most cited reason people give up; a card or a watch is the workaround.
- Some apps from large vendors refuse an uncertified device. We test your list and tell you beforehand, not after delivery.
- iMessage and Apple-only services do not exist here. If you live inside an Apple ecosystem, you need to know that.
- Google's factory warranty does not lapse because of GrapheneOS, but an unlocked bootloader can complicate a repair. We deliver with the bootloader locked.
- Bank and carrier terms change. A specification from 2024 is not a warranty today.
Which model
We work with Pixels because they are the only handsets GrapheneOS maintains and supports for years. Newer models receive security updates for a long horizon; with refurbished units we check battery condition and remaining value. Which model fits depends on your budget and on the apps that demand certification. The quote states the model, its update horizon, and whether it is new or refurbished.
Management after delivery
A phone that still looks like today's in a year is not an accident. Management covers: checking and applying updates, verifying profile and backups, remote locking and wiping after theft, and preparing a replacement device so an employee does not lose a working day. If you would rather manage it yourself, we hand over a checklist instead of an agreement.
Who this is for
Lawyers and notaries, accountants and tax advisers, HR advisers and occupational health physicians, boards and commissioners, journalists, and self-employed professionals in care or financial services. A single device makes sense: often it is the phone of the person carrying the most sensitive conversations.
Comparison
| Privacy phone via GSAP | Installing GrapheneOS yourself | CarbonPhone / Droid | iPhone | |
|---|---|---|---|---|
| Google services | absent, sandboxed only where needed | same | absent | Apple services, always on |
| Update horizon | GrapheneOS support per Pixel model | same | vendor dependent, shorter | long, but Apple decides |
| Banks and DigiD | tested against your list, by us | you research and test it | mixed, little Dutch experience | all work |
| When something breaks | GSAP is the contact | you are the contact | importer or vendor | Apple Store or web shop |
| Extra | configuration, walkthrough, recovery plan, management | none | limited | no privacy management |
Questions
Do I have to keep my current number?
You can; a privacy phone is not an anonymous phone. If you do want that, a minimal-registration eSIM is an option we raise in the conversation.
Can I use the phone I already have?
Sometimes. GrapheneOS supports specific Pixels only. If your device qualifies, we flash it; otherwise we advise on a model.
Can my employer read it?
Whoever manages the device can see more than you think. That is why management at us runs on terms you sign, not on a silent profile.
What if the device breaks?
We configure a replacement from the backup — which is why backup and management sit inside the package.
Does this work for a tablet or laptop?
Tablets: same principle, larger screen. Laptops need a different approach, which we advise on separately.
Back to the overview · Request a quote based on your app list