App sandboxing
Apps remain strongly isolated, limiting access and damage between applications.
GRAPHENEOS
More control over your smartphone
GrapheneOS is a privacy- and security-focused open-source operating system for supported Google Pixel devices. It strengthens Android at the system level without depending on a closed Spy-Supply communications platform.
- Android / AOSP base
- AOSPAndroid / AOSP base
- mandatory Spy-Supply account
- 0mandatory Spy-Supply account
- source and independent installation
- opensource and independent installation
The operating system
What is GrapheneOS?
GrapheneOS is based on Android/AOSP and focuses on system-level privacy and security for supported Google Pixel devices.
Memory safety
Modern Pixels support hardware memory tagging and other exploit mitigations.
Separate permissions
Network and Sensors permissions provide additional per-app control over network and sensor access.
Verified Boot
The system checks whether installed software is authentic and intact.
Sandboxed Google Play
Google Play can optionally run as ordinary sandboxed apps. Google services are not required.
Auto-reboot
An automatic reboot can return sensitive user data to its protected at-rest state.
GrapheneOS publishes its own OS and security updates and integrates relevant platform and firmware updates. Full support also depends on the hardware and firmware support of the Pixel model.
The track record
Why the closed model fails
These five services sold access to closed communications ecosystems. In each case, operators, devices or central infrastructure became part of the investigation. Figures come from public sources including Europol, the FBI and other authorities.
- 2016
Ennetcom
19.000users
Dutch police seized servers in Canada; copied server data subsequently played an important role in the investigation of millions of messages.
- 2018
Phantom Secure
10.000+devices
The CEO pleaded guilty and the service was dismantled. The operator and central service were part of the trust model.
- 2020
EncroChat
115 mlnmessages read
French authorities developed a technical method that enabled access to communications, after which messages could be monitored at scale. The case led to thousands of investigations and arrests.
- 2021
Sky ECC
1 mrdmessages intercepted
Authorities gained access to communications on the proprietary platform and could monitor them at scale. The central infrastructure was part of the investigative target.
- 2021
ANOM
800+arrests
The FBI secretly controlled the platform and distributed devices through criminal networks. Users could not independently verify the operator, software or infrastructure.
These operations show that security does not depend on encryption alone. Operators, servers, devices, software distribution and central infrastructure can all become part of the attack or investigative surface. GrapheneOS reduces some of that dependency because it is not a Spy-Supply-operated communications platform; that does not make a device invulnerable.
These networks were sold almost exclusively to criminal customers, which is precisely why they drew attention. We cite them as a lesson in engineering, not as a comparison: GrapheneOS is ordinary open software for people with a legitimate reason for privacy.
Encryption
From your PIN to unreadable data
Encryption is not a switch that is on or off, it is a chain. Every link below has to hold, and the strongest one is not in software but in a separate chip.
- PIN
Your PIN, stored nowhere
The code itself is not on the device. It is only an ingredient used to derive the key, so there is nothing stored that reveals it.
- CHIP
Titan M2, a separate chip
Combining your code with the key happens inside a dedicated security chip. That chip slows every attempt, which makes endless guessing hopeless.
- FBE
Every file its own key
Storage is not one big encrypted blob but encrypted per file. Separate profiles therefore hold keys that are independent of each other.
- BFU
Before the first unlock: sealed
After a reboot, credential-encrypted user data remains locked until the correct passcode is entered again. A reboot is not a guarantee that every form of malware or compromise is removed.
- AUTO
Automatically back to sealed
If the device sits unused for a while it reboots itself and everything returns to that sealed state. A lost phone therefore protects itself.
Leaked documentation from forensics firm Cellebrite showed their equipment could not extract data from GrapheneOS devices built after 2022, while it could from stock Android. That is down to this chain, not to one clever trick.
Zero-days and spyware
Pegasus and the hole nobody knows yet
Commercial spyware such as Pegasus uses flaws the manufacturer does not know about yet, a so-called zero-day. Against those, "updating on time" by definition does not help. So GrapheneOS takes a different approach.
How an attack like that works
A message or image arrives and you do not even have to tap it. The software that automatically processes that file contains a bug, and through that bug the attacker’s code suddenly runs. From there it tries to escape the app to reach your messages, microphone and camera. GrapheneOS puts a brake on every one of those steps.
Less code to break in through
These attacks arrive through components that process data automatically, such as the handling of an incoming image. GrapheneOS switches off features and drivers you do not use, so a portion of those routes simply is not there anymore.
Memory bugs break off immediately
Many serious exploits rely on memory-safety vulnerabilities. On modern Pixels, GrapheneOS uses additional protections such as hardware memory tagging to make part of this attack class more difficult.
In hardware on the newest Pixels
From the Pixel 8 onwards that memory check sits in the processor itself, which makes it considerably more thorough than a software check. GrapheneOS enables it by default for the system and you can switch it on per app as well.
Inside does not mean everywhere
If an attack does succeed it stays stuck in the app it entered through. Without network permission that app cannot send anything out, and your separate profiles stay unreadable behind their own keys.
A reboot clears it out
Much of this spyware does not embed itself permanently but lives in working memory. The automatic reboot clears that memory, so such an infection is gone afterwards.
Updates with nobody in between
GrapheneOS publishes its own OS and security updates and integrates relevant platform and firmware updates for supported Pixels. Support duration also depends on the Pixel model.
To stay honest: nobody can guarantee an attack with a multi-million budget will never succeed. What you can do is make it so expensive and unreliable that it is not worth it, and that is exactly what these layers do.
The pattern
Three mistakes, every single time
The networks differed in name and price, but kept making the same structural choices.
- 01
A single point to attack
All messages ran through the provider’s servers. Take that one point and you take everyone at once. With Ennetcom, one seizure in Canada was enough.
- 02
Code nobody was allowed to see
Closed software means you cannot verify the claims. With ANOM the provider was the FBI itself, and that stayed invisible for years precisely because nobody could look inside.
- 03
Sold only to the underworld
These devices were so expensive and so aimed at criminal customers that owning one became evidence in itself. A phone that singles you out does not protect you.
Side by side
Why GrapheneOS does not share that fate
Not a longer key or smarter marketing, but a different model: there is simply no party that can betray you.
Closed crypto phoneGrapheneOS
- Source code
- Closed crypto phoneClosed. You had to take the seller at his word.
- GrapheneOSPublic. Anyone can read it and build it themselves.
- Where the server sits
- Closed crypto phoneWith the provider. Every message ran through one point.
- GrapheneOSNo central GrapheneOS/Spy-Supply messaging backend is required.
- One search warrant means
- Closed crypto phoneEveryone is exposed. That is exactly what happened five times.
- GrapheneOSNo central messaging network to seize as a whole; the device itself can still be an investigative target.
- Who else uses it
- Closed crypto phoneAlmost exclusively the underworld. Owning one was suspicious by itself.
- GrapheneOSJournalists, lawyers, doctors and security researchers.
- What it cost
- Closed crypto phoneThousands of euros per six months, locked into a subscription.
- GrapheneOSThe operating system is free. You only pay for the phone.
- If the provider disappears
- Closed crypto phoneYour device is a brick and your contacts are unreachable.
- GrapheneOSNothing changes. Your phone keeps getting updates without us too.
Under the hood
What the device actually does
Six protections you can verify yourself, none of them dependent on us.
Verified boot
At every start the device checks whether the system matches the official build. If anything deviates, you see it on screen before you enter your PIN.
Per-app permissions
GrapheneOS gives users additional control over network and sensor access through separate permissions that can be revoked per app.
Duress PIN
A second PIN that irreversibly wipes the keys when entered. For situations where you are forced to unlock the device.
Hardened memory
GrapheneOS replaces core Android components with stricter versions. That closes off whole categories of attack before anyone tries them on you.
Google in a box
Play Services can run sandboxed as an ordinary app, without system privileges. Your apps work, but Google is not sitting in the core of your device.
Strongest when switched off
The device reboots automatically after a period of disuse, putting everything back behind encryption. The USB port can be disabled entirely while the screen is locked.
Staying honest
What it does not solve for you
Anyone telling you a phone makes you untouchable is selling you something. These are the limits.
- It does not protect you from your own habits. Log in with your own name or reuse passwords and the operating system stops mattering.
- It does not protect the other side of the conversation. What you send also sits on the recipient’s device, with their settings and their risk.
- It does not make you anonymous. Your provider still sees that there is traffic, just not what is inside. For that you need a VPN or Tor.
- It does not make anything legal that was not. We sell privacy to people with ordinary lives and ordinary reasons, not an escape route.
Threat model
What GrapheneOS does and does not solve
GrapheneOS gives you a stronger technical foundation. How you use the device remains just as important.
Helps reduce risk from
- Malicious apps and excessive permissions
- Common Android attack surface
- Certain memory-safety exploit classes
- Unnecessary Google service dependency
- Data exposure between apps
Does not eliminate
- Anonymity, carrier or SIM metadata
- Compromised accounts or social engineering
- Sophisticated zero-days
- Malicious recipients
- All forms of physical or forensic access
Our role
Why buy through Spy-Supply?
You do not pay for GrapheneOS itself. You pay for the device, installation, configuration and our preparation and support.
Sourcing compatible Pixel hardware
Installation and baseline configuration
Optional privacy/security apps where offered
Personal handover and support
FAQ
Frequently asked questions
Is GrapheneOS legal?
Yes. GrapheneOS is open-source software. Spy-Supply sells pre-installed devices but does not operate the GrapheneOS project.
Can I install GrapheneOS myself?
Yes. GrapheneOS can be installed independently on supported Pixel devices. A prepared installation is a service, not a software licence fee.
Is GrapheneOS anonymous?
No. It improves OS-level privacy and security, but does not automatically hide your provider, IP address, SIM identity, location or account metadata.
Can GrapheneOS be hacked?
No complex software should be described as impossible to compromise. GrapheneOS aims to reduce attack surface and impact.
Does Google Play work?
Yes, optionally. Sandboxed Google Play can be installed and runs as ordinary apps with their corresponding permissions.
What if Spy-Supply disappears?
A genuine GrapheneOS installation receives updates from the GrapheneOS project while the Pixel model remains officially supported. We are not a required intermediary.
Technical sources
Ready to look at one?
Our phones arrive ready to use with GrapheneOS and the apps already configured. Come by in Enschede and check the verified boot fingerprint with us before you pay.