Hardware that slows an attacker down.
The Pixel security chip helps protect encrypted storage by enforcing delays between incorrect unlock attempts. You choose the private PIN or passphrase.
Encrypted · Zero identity · Post-quantum
GHOSTWIRE
Private. Secure. Zero identity.
A secure handset built as a complete privacy system: zero-identity communications, post-quantum protection, hardened hardware, counter-surveillance tools and an integrated secure application suite. Hybrid post-quantum messaging and current-pair ML-KEM-rooted frame protection for voice and video.
Pixel 9a £1,700 Pixel 7a from £1,500
Ways to pay Cards, wallets, bank methods, Klarna, Billie for companies
Dispatch within 48h After confirmed payment
Zero identity
PQ messages, voice + video
Duress-PIN vault wipe
Optional handset eSIM or physical SIM · 160+ countries
GhostWire
Mail
Browser
Maps
LinkBond
Vehicle
The GhostWire unit · Hardened Pixel · approved lock screen
The foundation of a GhostWire handset
Security starts below the screen.
Pixel hardware. GrapheneOS protection. GhostWire communications. Three layers, each with a clear job.
A stronger Android foundation.
GrapheneOS adds exploit defences and tighter isolation between apps, alongside controls over network, sensor, file and contact access. No Google account is required.
Trust checked at startup.
We verify the official OS signing key and relock the bootloader. Verified boot checks the signed operating system as it starts.
Protection when the phone is put away.
Encrypted user profiles and automatic reboot help protect stored data. Our stock setup uses an eight-hour locked-device reboot interval; you set your own screen lock.
Security that keeps moving.
Official GrapheneOS security updates remain available. GhostWire and its companion apps use signed update channels. OS support duration depends on your Pixel model.
The private communications layer.
No phone-number account. Hybrid post-quantum messaging and current-pair ML-KEM-rooted frame protection for voice and video. The private vault and included security apps complete the kit.
Titan M2 protects the hardware foundation; it is not the messaging protocol. GhostWire communication keys remain on the handsets. Pixel and GrapheneOS are independent products, with no endorsement implied.
Read the underlying specifications
Owner-controlled protection
More control when the situation changes.
GhostWire now combines separate encrypted workspaces, an owner-enabled remote reset path and dedicated relay deployments. Each control is bounded so you can judge when it helps.
Independent additional vault
Create a second working vault with separate keys, encrypted data, attachments and communication state. Opening it does not expose the primary vault through GhostWire’s interface.
Authenticated remote factory reset
If you enable it locally first, a fresh, signed and device-bound command can request a full Android factory reset through the owner control path. It is off by default.
Dedicated relay option
Organisations can use a separately configured GhostWire relay and self-hosted TURN service instead of the standard call-relay provider.
Limits: the additional vault is not a separate Android user profile and cannot defeat a compromised operating system. An offline phone remains pending; a reset request handed to Android is not proof that storage was erased. A dedicated relay still observes connection metadata and must be securely operated.
The Pharoah Technology approach
Security starts with awareness.
No technology can detect every threat. GhostWire brings together stronger defences, security tools and practical awareness to help you protect yourself when it matters. We look beyond the obvious risks to your conversations, data and everyday privacy.
Know what you share.
Understand which apps can access your location, microphone, camera, contacts and files. Allow only what you need.
Think beyond the conversation.
Encryption matters. So do the handset, the apps you install, the networks you join and what happens if the device is lost.
Stay aware. Stay in control.
Use the included security tools and available permissions to make informed choices. No phone can identify every tracker or prevent every attack.
A mobile network can still infer a connected handset’s location. App permissions, a VPN and encrypted messaging do not make you invisible to your carrier.
Everything that ships, named
14-app customer flash set: ten first-party GhostWire apps plus four selected third-party apps.
The current customer flash set contains 14 pinned apps: ten first-party GhostWire product apps plus Molly, Telegram, Cake Wallet and Mullvad VPN. Every APK is version-, hash- and signer-pinned; the handset build refuses to complete if a required app is missing, undeclared or signed by anything else. LinkBond and Vehicle Scanner are included in the handset flash bundle; the GhostWire Router companion is separate and sent by download link to router buyers. Beyond the flash set, the GhostWire approved-app store on the handset offers six reviewed third-party apps for on-demand install — SimpleX Chat, Session, Threema Libre, Briar, Cake Wallet and Mullvad VPN — served from our own repository at apps.ghostwire.co.uk/t1. The catalogue is signature-verified on the handset before anything installs, each release is pinned to its publisher’s signing key, and nothing outside the catalogue can be installed through it.
Official GrapheneOS security updates remain available through its system updater. GhostWire and companion apps use our signed update channels. The approved-app catalogue verifies its own downloads; it does not block every other Android installation route.
GhostWire
The zero-identity messenger. Invite-paired, no accounts, no phone number. Hybrid post-quantum pairing on every session.
Estate certGhostMail PGP Mail
OpenPGP mail on the handset. One managed mailbox is included, set up by our operators during onboarding; or connect your own IMAP/SMTP account.
Estate certGhostBrowser
Our own browser build. No Google services, no telemetry, no sync account, nothing phoning home.
Estate certGhostMaps
Offline-first maps. Routes and searches resolve on the handset; your location is never reported to us or anyone else.
Estate certGhostWire LinkBond
Wi-Fi intelligence for the handset: current-network checks, router handoff and dual-network research. Pinned into the handset flash bundle.
Flash bundle · includedGhostWire Shield
Always-on mobile-network watch. It checks baseband anomaly signals and warns about suspicious cell-tower behaviour, including downgrade, unknown-serving-cell and identity-inconsistency patterns. It cannot confirm an IMSI catcher.
Mobile network watch · includedGhostWire SCARAB
On-device installed-app and permission-risk scanner. It reports declared permission capabilities and a sourced historical package-name reference locally. These are review prompts, not proof of spyware or malware. It is not a network firewall.
App-risk scanner · includedGhostWire Privacy Audit
Your Room Scanner and Wi-Fi Scanner. It probes devices on the current local network for camera/NVR risks and unusual network devices. Analysis and results stay on the handset and are not uploaded.
Room + Wi-Fi scanner · includedGhostWire Safe Room
Software radio-density and Bluetooth proximity indicators for a controlled space before a sensitive meeting. It is not a complete RF/TSCM detector; dedicated RF hardware is required for a full sweep. Powered-off, wired and passive devices are outside the scan.
Radio/Bluetooth indicators · includedGhostWire Vehicle Scanner
Compares salted anonymous Wi-Fi and Bluetooth references outside and inside a vehicle. It does not claim to detect powered-off, wired, cellular-only, passive or non-radio devices.
Vehicle comparison · includedCurrent app improvements: GhostMail supports individual and selected-message deletion, editable drafts and attachment-loss safeguards. Shield includes regional GNSS advisories; SCARAB uses a limited sourced historical reference; Safe Room adds public Bluetooth company references and marks stale or incomplete observations. These OSINT references provide context, not proof of an attack or a clean device. Molly and Telegram retain their own update routes. One Updates screen handles GhostWire, its companion apps and approved releases. GhostMail for Apple-silicon Mac (developer-signed; not notarized). GhostMail desktop 0.4.0 for Windows (installer), Windows (MSI), Linux (.deb), Linux (AppImage) and Linux (.rpm): not code-signed, so Windows shows a SmartScreen warning; compare your download with the SHA-256 checksums first.
And a platform of 37 components behind them.
The handset is the part you hold. It sits on a much larger engineering programme — a specified, numbered suite covering identity, transport, storage, device management and assurance. Not every component is a consumer app, and most of them you will never see. That is the point: they are the reason the ten apps above can make the claims they do.
Live security backbone: GhostPolicy gates policy decisions; GhostLedger keeps tamper-evident evidence; GhostAdmin controls privileged actions; GhostUpdate verifies signed releases and rollout decisions; GhostMesh provides the peer transport; and GhostWire runs its own relay, wake-push service and fleet cockpit. These are platform services behind the handset, not third-party downloads.
Release and provisioning controls: GhostOS verifies image provenance and signed GrapheneOS configuration profiles locally; SCARAB and Privacy Audit supply the app-risk, network and camera/NVR checks. Their release artefacts are kept separate from the handset flash set and are promoted only after the signing and device gates pass.
Radio claim boundary: Shield warns on nine observable Android cellular-anomaly signals. Android public APIs cannot confirm an IMSI catcher, null-cipher attack, silent SMS or paging attack; those require privileged baseband or hardware access.
Foundation
- GhostCore — shared crypto + contracts
- GhostKey — key custody
- GhostIdentity — identity binding
- GhostTrust — device trust
- GhostDNS — resolution privacy
Communication
- GhostWire Messenger
- GhostMesh — off-grid transport
- GhostBeacon
- GhostWatch — monitoring
Storage
- GhostDrive
- Ghostwire Vault
- GhostCloud
- GhostBackup
- GhostArchive
Control & assurance
- GhostOS — image provenance and configuration
- GhostPolicy — policy decisions
- GhostCommand — fleet control
- GhostUpdate — signed OTA
- GhostScan · GhostSecure · GhostPulse
- GhostCompliance — audit trail
Current manufacturing truth: Newly provisioned Pixel 7a, 8a, 9a and 10a handsets use the live signed mandatory OTA release and current app set; the accepted USB auto-wipe behavior is retained. Factory bundles for these four models are retained in GhostWire-owned private R2 and passed downloaded-byte verification; Google Drive is not used for factory-bundle publication. Five included security apps: GhostWire Shield, SCARAB, Privacy Audit, Safe Room and Vehicle Scanner ship on every handset alongside GhostWire, GhostMail, GhostBrowser, GhostMaps and LinkBond. The first-party local USB auto-wipe control is inside GhostWire; the retired Wasted APK and link-distributed Costa Alert are not preloaded. The wider suite contains shared libraries, hosted services and operator tools; these are separate from the handset apps. GhostMail ships on the handset with one managed OpenPGP mailbox included for onboarding. Its Mac client is also available for personal, team and company use; extra managed accounts are £39/year, five for £149/year, or ten for £249/year. Your included six-month GhostWire service starts at actual handover, not while unsold stock is boxed.
Communication without compromise
Privacy isn't a setting. It's the architecture.
Most "secure" apps still know your number, your contacts, and when you're online. GhostWire is built so that even we can't. No third party can read GhostWire messages or hear GhostWire calls — there are no accounts, no address book, and no readable content anywhere but the handsets.
Zero identity
No phone number. No email. No real name. You pair devices with a one-time invite, so there is no account database to breach — because there are no accounts. You are unknown by design.
Post-quantum protection, with the boundary stated
Messages use the vodozemac Olm double ratchet, built on audited primitives with a fresh ML-KEM-768 encapsulation every turn on current sessions, so recording today's traffic does not decrypt it later. Dead drops carry their own fresh hybrid X25519 + ML-KEM-768 encapsulation per drop, mixed into the same Olm handshake. Voice and video add ML-KEM-rooted application-frame keys above DTLS-SRTP on current hybrid pairings — derived from the pairing, not renegotiated per call, which is what lets a locked handset still answer. Older sessions migrated from earlier builds remain DTLS-SRTP and are not mislabelled post-quantum.
Panic-PIN wipe
A second PIN instantly destroys the GhostWire vault — messages, contacts and keys are unrecoverable. Irreversible. Forced to unlock under duress, the app you hand over comes back as a clean first-run install and holds nothing. It clears GhostWire, not the rest of the handset. The handset itself factory-resets two ways: where the deployment enables USB auto-wipe, a locked USB data plug-in triggers the configured handset reset; GrapheneOS’s own duress PIN at the lock screen wipes the whole device including eSIMs. You create your private PINs during setup. USB auto-wipe is optional: manually enable USB-C data in GrapheneOS, then arm it in GhostWire. Enabling the app option alone does not change the USB-C setting.
No key escrow.
GhostWire combines zero public identity, hybrid post-quantum cryptography and hardened handsets. Delivery infrastructure is part of the product, but it holds no communication keys: no key-management server, no equivalent server-side key store, and no decryption path outside the handsets.
Built for the real world
No push services tied to Google or Apple. An optional six-month prepaid roaming eSIM for a handset, or physical SIM for a handset or router, is available with coverage in 160+ countries. No Google account. No Apple ID. No account database anywhere.
Dead drop: one-shot messages
Send a message the receiving handset consumes once. It expires after 1 hour, 24 hours or 3 days — or sooner under the recipient’s conversation setting — and your side keeps only a delivery marker, never the body. It cannot stop someone copying what they can read, and the app says so before you send.
Our own approved-app store, on the handset
Six reviewed third-party apps — SimpleX Chat, Session, Threema Libre, Briar, Cake Wallet and Mullvad VPN — install on demand from GhostWire’s own repository. No Google account, no Play Store: the catalogue is signature-verified on the handset and every release is pinned to its publisher’s signing key. Nothing outside the catalogue can be installed through it.
Decoupled relay architecture
High-volume messaging cannot starve urgent call signalling or vital session control envelopes. Independent queues isolate chat payloads from real-time WebRTC media and device control streams, backed by automatic FIFO queue eviction and 24-hour envelope expiration to eliminate starvation.
Zero-disk encrypted media viewer
Sensitive photo and document attachments are decrypted directly in ephemeral memory inside the secure sandbox. Full-resolution interactive zoom and pan navigation without writing decrypted files to shared storage or leaking thumbnails to external gallery apps.
The GhostWire Appliance
A complete secure communications ecosystem.
Not an app you download onto a phone that's already watching you — a hardened device where every layer is chosen for one thing: that your conversations, plans, and movements can't be read, tracked, or sold.
Pixel 9a
Hardened & relocked
GrapheneOS
Locked down
Optional data SIM
handset eSIM or physical · six months · 160+ countries
GhostWire LinkBond
Wi-Fi diagnostics · in handset flash
GhostWire Shield
Threat detection
Cake Wallet
XMR · BTC · USDT · spending cards
GhostBrowser
Our browser · no Google, no telemetry
GhostMaps
Offline maps · no location reporting
Duress PIN
Instant vault wipe
GhostWire Push
Our own wake channel — no Google, no Apple
Room reader
Camera and network-risk checks
WiFi reader
Every device on a network, seen
Cellular anomaly alert
Suspicious tower behaviour, explained
Audio-visual guard
Mic & camera lockdown
WiFi protection
Hostile network defence
And more
Threat detection, always on
Who it's for
When the conversation actually matters.
Built for people whose communications are a target — and who can't afford a "trust us" answer on where their words end up.
The Coast
Privacy, elevated.
High-net-worth · Family & staff
Private comms for people worth targeting — effortless, and actually secure.
Executive-grade security for the life you've built, so you can live it without being watched. Premium hardware, family and staff ready, concierge onboarding.
The Ministry
Sovereign comms.
Governments · State agencies
Sovereign communications without key escrow.
Hardened Pixel + GrapheneOS + GhostWire delivery infrastructure. Zero public identity, handset-held keys, hybrid post-quantum messaging and current-pair ML-KEM-rooted frame protection give organisations a serious private-comms system they can account for and govern.
The Hunted
If they can't find you.
Journalists · Activists · Threatened principals
If they cannot find you, they cannot map your public identity.
No public account and no phone number. An optional prepaid roaming eSIM for a handset, or physical SIM for a handset or router, provides coverage in 160+ countries, and a duress PIN destroys the GhostWire vault — messages, contacts and keys — if you're forced to unlock. Personal safety, by design.
Under the hood
Serious cryptography. Not marketing.
GhostWire is built on audited, battle-tested primitives — the same class of ratchet that protects the world's most scrutinised messengers — and hardened for people who are genuinely targeted.
- PairingHybrid post-quantum key exchange — X25519 + ML-KEM-768, on every pairing, with no classical fallback
- Message encryptionOlm double ratchet · vodozemac 0.10 · v2 message content wrapped by the ML-KEM epoch ratchet
- Post-quantum ratchetOn v2 sessions, a fresh ML-KEM-768 encapsulation every turn — post-quantum forward secrecy for message content. Retired keys are zeroized.
- Security propertiesForward secrecy + post-compromise
- Current-pair identityHybrid Ed25519 + ML-DSA-65 signatures bind identities established on the current protocol. Both signatures are required: stripping either one fails closed.
- No key escrowNo Key Management Server and no equivalent server-side key store. Encryption keys never leave the GhostWire handsets.
- UpdatesSigned live mandatory OTA · USB auto-wipe bench-proven on the release bytes
- Service layerGhostWire delivery, call and update infrastructure · routes communications but cannot decrypt them · auto-purge controls
- Message retentionThree-day default and hard maximum · unanswered messages, attachments, local rows and relay deposits expire under the same policy
- Relay storageCiphertext only · auto-purge
- Key vaultSealed under a 32-byte Argon2id key
- HandsetPixel + GrapheneOS · verified boot, locked bootloader
- App integritySigned builds · owner-controlled update channel
- IdentityNone — invite pairing · fingerprint verify
- Screen captureBlocked · FLAG_SECURE on every screen
- Voice + videoProtected media sessions over DTLS-SRTP · current GhostWire pairings add ML-KEM-rooted FrameCryptor protection · sessions without that frame layer remain DTLS-SRTP · unmetered while service is active
- Push notificationsOur own wake channel, held by the app itself — no Google, no Apple, no third-party distributor
- VPNMullvad, installed as standard
- BrowserGhostBrowser — our own build, no Google services, no telemetry
- MapsGhostMaps — offline-first, no location reporting
- Wi-Fi intelligenceGhostWire LinkBond — dual-network research app for Wi-Fi diagnostics, router handoff and security posture checks; pinned into the handset flash bundle
- PaymentsCake Wallet — XMR · BTC · USDT, plus virtual and physical spending cards
- Approved appsGhostWire’s own app store on the handset — SimpleX Chat, Session, Threema Libre, Briar, Cake Wallet, Mullvad VPN · served from apps.ghostwire.co.uk/t1 · catalogue signature-verified · publisher signing keys pinned
- Dead dropOne-shot message consumed once by the receiving handset · a fresh ML-KEM-768 encapsulation per drop, mixed into the hybrid handshake, sent from a throwaway account so the sender is anonymous · expires after 1 hour, 24 hours or 3 days · sender keeps a delivery marker, never the body
- DuressSecond PIN wipes the GhostWire vault + keys
- ConnectivityOptional six-month prepaid roaming eSIM for handset, or physical SIM for handset/router · 160+ countries · selected separately
- Shield suiteCellular anomaly alerts · WiFi reader · camera/network-risk checks · software mic/camera guard
- Key custodyHandset-held communication keys. No escrow service.
# GhostWire service controls
service> identity model
→ no public phone-number account
service> communications protection
→ messages · voice · video
service> key custody
→ handset-held · no escrow
service> delivery only · cannot decrypt
The blueprint
How GhostWire moves a message.
One engineering drawing, no marketing: a message is encrypted on the sender handset, routed by GhostWire and decrypted only on the recipient handset. If a box isn't on this sheet, it doesn't exist in the system.
CURVE25519ED25519HKDF-SHA-256AES-256OLM DOUBLE RATCHETARGON2ID VAULT
ProjectGHOSTWIRE · SECURE COMMS
Engineered byPHAROAH TECHNOLOGY LTD
Sheet01 · CLIENT-HELD KEY PATH
Real encryption. Real privacy.
- ▸End-to-end protected communications — vodozemac Olm double ratchet, built on audited primitives, hybrid post-quantum messaging, current-protocol ML-DSA-65 identity binding and current-pair ML-KEM-rooted call frames.
- ▸Sender authentication — signed messages. "From X" is provably from X.
- ▸No key escrow — GhostWire delivery infrastructure has no Key Management Server, no equivalent key store and no path to decrypt communications.
- ▸Proof-of-possession registration — identity hijacking is stopped at the door.
- ▸Sealed key vault — hardened local protection using a 32-byte Argon2id key; communication keys stay on the handsets.
- ▸Verified conversations — fingerprint verification and delivery receipts, without identity.
All communications. All secure.
Protected text
PQ protected
Voice calls
Clear · secure
Video calls
Protected · HD
Files & media
Any type · up to 25 MiB
No screenshots
FLAG_SECURE
Private push
GhostWire-owned
Built-in VPN
Mullvad standard
No numbers
Zero identity
Fingerprint verify
Contacts · proven
Dead drop
One-shot · self-expiring
Approved apps
Our own store · six reviewed
Signed updates
Owner-controlled · mandatory
GhostWire Secure Mobile Wi-Fi
Your private network, in your pocket.
A GhostWire-configured GL.iNet Mudi-family mobile router for phones, laptops and tablets. Connected devices use its Mullvad WireGuard tunnel without needing a VPN app on every client.
- Tested pilotGL.iNet GL-E750 Mudi V1
- FirmwareGL.iNet 4.3.28 / OpenWrt 22.03.4
- VPNMullvad WireGuard, six months included
- AppGhostWire Router companion for read-only gateway checks
- Kill switchBlock-non-VPN configured and acceptance-tested
- DNS policyDNS override and rebinding protection
- Remote accessGoodCloud and DDNS disabled
- Radio WatchLocal monitoring pilot →
An optional six-month prepaid physical SIM with coverage in 160+ countries can be supplied for the router; handset orders can use eSIM or physical SIM. Router eSIM is not advertised until the physical-eSIM-card route passes acceptance on the exact hardware. Every router is configured and connectivity acceptance-tested before dispatch. The Android router companion is sent as a private buyer download link with router orders and currently performs read-only reachability checks until the write contract is fully measured.
GhostWire Router · Radio Watch
More visibility into your connection.
Radio Watch adds local observation of the router’s own cellular and Wi-Fi connections alongside its existing VPN protection.
Connection activity
Tracks mobile-link state, upload and download counters, connected Wi-Fi client totals and connection-event counts.
Patterns worth checking
Flags repeated cellular drops and bursts of Wi-Fi disconnections when the required readings are available. Ordinary coverage changes, sleeping devices and interference can cause these patterns too.
Local, read-only monitoring
Keeps a limited history in the router’s memory. The observer does not change the VPN, routing or DNS, and requires no change to GhostWire handset software.
Radio Watch cannot confirm an IMSI catcher or see attacks aimed directly at nearby phones. A pattern is a reason to investigate, not proof of an attack. Missing or outdated readings are shown as gaps, never as an all-clear.
Pilot status · 18 September 2026. Installed and collecting on our GL-E750 Mudi V1 pilot. Mobile-data, browser, handset and extended reliability checks are still in progress before wider rollout. Radio Watch is not yet a standard feature of every shipped router.
GhostWireMailBrowserMapsLinkBondVehicleZero-identity router mode
The handset stays off the mobile network. The router carries the connection.
With no physical SIM, no active eSIM and cellular disabled, the GhostWire handset does not register to mobile towers. It joins the GhostWire router over secured Wi-Fi, while the router carries the data connection and wraps connected-device traffic in its fail-closed Mullvad WireGuard tunnel.
01
No handset cellular identity.The mobile session uses the router SIM/IMSI and router modem IMEI. The SIM-free handset does not supply an IMSI, and its IMEI is not transmitted through its Wi-Fi connection to the router.
02
No personal VPN login.Each router receives its own Mullvad numbered account and WireGuard profile. Mullvad requires no customer name, email address or phone number for that account.
03
The SIM and public Internet identity are separated.The carrier sees an encrypted WireGuard connection from the router, while websites and services see the Mullvad exit IP rather than the SIM connection. If the VPN stops, the router kill switch blocks Internet traffic instead of exposing it.
04
Calls and messages remain data services.GhostWire messaging, voice and video work over the router Wi-Fi. Native carrier calls and SMS are not used; emergency calling requires another available route while handset cellular is disabled.
Security boundary: zero identity here means no GhostWire account identity, no handset SIM identity, no handset tower registration and no personal Mullvad login. The carrier still operates the router SIM session, but that transport identity is isolated on the router rather than attached to the GhostWire handset or messenger. Keep handset cellular disabled in this mode.
Your apps. Your choice.
Selected apps. Clear boundaries.
GhostWire is built for private communication. Other apps on your handset have their own security and privacy practices.
Selected by Pharoah Technology
We select the third-party apps we consider suitable for inclusion or download on GhostWire handsets. Our catalogue checks publisher signing keys and approved releases to reduce the risk of installing a tampered or unexpected app.
Use with an informed choice
Selection is not a guarantee that an app is free of vulnerabilities, malware or tracking. You use third-party apps at your own risk; their permissions, privacy policies, services and future updates remain separate from GhostWire.
For sensitive conversations, use GhostWire’s own messaging, voice and video with your GhostWire contacts. Installing another app does not give that app GhostWire’s encryption or privacy protections.
This guidance does not limit your statutory consumer rights or our responsibility for the product and services we supply.
Prepared to order
Your Pixel. Your GhostWire kit.
Choose from the Pixel 10 range as well as our existing handset range. We confirm the model, availability and complete kit price before accepting your order.
Pixel 10aPixel 10Pixel 10 ProPixel 10 Pro XLPixel 10 Pro Fold
Choose your model
Tell us your preferred Pixel, storage and delivery destination.
Configured and checked
We prepare GrapheneOS and the GhostWire kit, then complete the handset checks. Your private PINs remain yours to create.
Dispatched within 48 hours
All device orders dispatch within 48 hours of a confirmed order and payment, subject to agreed availability. Courier delivery time is separate.
Tracked courier delivery to your chosen home or business address. Express service is available on request; any express charge and the delivery estimate are confirmed before booking. PO boxes are accepted only where the chosen delivery service supports them.
Ask about your Pixel →Pixel 10 models are prepared to order. Model, storage, condition and final price are confirmed individually.
Pricing
Choose your Pixel. Built and ready.
The same complete hardened kit on Pixel 7a, Pixel 8a, Pixel 9 and Pixel 9a. Pixel 10a is prepared to order.
The GhostWire Kit
from £1,500
£1,700 Pixel 9a build
6-month contract · all-in · Pixel 7a, 8a, 9 or 9a
- Pixel 7a £1,500
- Pixel 8a £1,600
- Pixel 9a £1,700 · in stock
- Pixel 9 £1,700 · in stock
- Pixel 10a £1,850 · prepared to order
- GrapheneOS hardened and relocked on every model
- Case + screen protector, fitted
- GhostWire secure messaging pre-installed
- GhostWire LinkBond Wi-Fi diagnostics ships in the handset flash bundle
- GhostWire Vehicle Scanner anonymous outside/cabin comparison ships in the handset flash bundle
- GhostWire approved-app store on the handset: SimpleX Chat, Session, Threema Libre, Briar, Cake Wallet and Mullvad VPN install on demand from our own repository, catalogue signature-verified
- Optional six-month prepaid handset eSIM, or physical SIM for handset/router, available separately · 160+ countries
- Five included security apps: GhostWire Shield, SCARAB, Privacy Audit, Safe Room and Vehicle Scanner
- GhostMail — private email, two ways: a managed mailbox on our own mail service (one included, set up for you by our operators after handover — never created automatically), or connect a mailbox you already have over standard IMAP/SMTP at no charge. Full OpenPGP either way: end-to-end encrypted to anyone who has a key, ordinary mail to everyone else, and it always tells you which
- Private vault and duress-PIN setup with buyer-controlled credentials
- Ways to pay: cards, wallets, PayPal, Klarna and local bank methods, as shown by Stripe. Companies: Billie Pay in 30 for eligible business buyers
- Fleet discount: 10% off orders of 5 units or more
GhostWire Router
£800
secure mobile Wi-Fi · six months of Mullvad VPN
- Ways to pay: cards, wallets, PayPal, Klarna and local bank methods, shown by Stripe where the buyer and order are eligible. Companies: Billie Pay in 30 for eligible business buyers
- Pixel 9a bundle: kit + router £2,500
- Fleet discount: 10% off orders of 5 units or more
Recharge
£499
per 6 months
- GhostWire units — full service renewal
- Roaming-data SIM renewal quoted separately when required
- Relay service + security updates
- Shield suite kept current
Secure calls
Included
encrypted voice & video
- Current-pair ML-KEM-rooted application-frame call protection
- Sessions without the current frame layer remain DTLS-SRTP and are labelled accurately
- No per-minute billing while service is active
Five security apps
Included
pre-installed · release-signed · kept current
- GhostWire Shield — mobile-network watch for suspicious downgrade, serving-cell and identity-change patterns; it cannot confirm an IMSI catcher
- GhostWire SCARAB — on-device installed-app risk scanner for spyware and malware indicators
- GhostWire Privacy Audit — Room Scanner + Wi-Fi Scanner for camera/NVR and nearby-network risks; results stay on the handset
- GhostWire Safe Room — software radio-density and Bluetooth proximity indicators for a controlled room; it is not a complete RF/TSCM detector, and powered-off, wired and passive devices are outside the scan
- GhostWire Vehicle Scanner — anonymous outside/cabin Wi-Fi and Bluetooth comparison
Available now. Order online at ghostwire.store, or arrange your kit directly with us. Pixel 10a is prepared to order.
Pay in Bitcoin
Buy, recharge or top up — anonymously.
One Bitcoin address for everything: your device, the 6-month recharge and paid add-ons. No card, no bank, self-custodial. Scan or copy, and pay the £ value in BTC at today's rate.
bc1qc7uvjnes2uc3exhzddthmhvnsdhqc8jdzm356q
- Scan the QR or copy the address, and send your Bitcoin.
- Message us on Telegram (or email) with what it's for and your delivery details — we'll confirm the exact BTC amount with you first if you like.
- We verify the payment on-chain and arrange your device or top-up.
An open invitation
Think you can break GhostWire? Come and try.
We will hand you the keys: a device on the table, the full spec sheet, and our undivided attention. Get in, show us how, and we will fix it and shake your hand. That is how confident we are in what ships.
Take the challenge