Hardware that slows an attacker down.
The Pixel security chip helps protect encrypted storage by enforcing delays between incorrect unlock attempts. You choose the private PIN or passphrase.
A private phone, ready before it reaches you.
A hardened GrapheneOS Pixel, private communications and 14 approved apps. Prepared before dispatch; you create your private vault and PINs.
Your complete kit includes the configured handset, security apps, a managed mailbox during onboarding and personal support.
USB auto-wipe proven where enabledOn a deployment with locked USB-C data enabled, the release bytes triggered the configured factory reset in bench testing.
Duress PIN factory resetGrapheneOS’s own duress PIN, created by you during setup: entered at the lock screen, it wipes the whole device including eSIMs. GhostWire’s separate duress PIN destroys only the GhostWire vault.
Payment readyCards, wallets, PayPal, Klarna, bank methods, crypto and invoice routes are live.
Handover checkedInstalled apps, calls, update access and fitted protection are checked before boxing. You create private PINs during setup.
Serious, functional security and safety technology. At its best.
The foundation of a GhostWire handset
Security starts below the screen.
Pixel hardware. GrapheneOS protection. GhostWire communications. Three layers, each with a clear job.
A stronger Android foundation.
GrapheneOS adds exploit defences and tighter isolation between apps, alongside controls over network, sensor, file and contact access. No Google account is required.
Trust checked at startup.
We verify the official OS signing key and relock the bootloader. Verified boot checks the signed operating system as it starts.
Protection when the phone is put away.
Encrypted user profiles and automatic reboot help protect stored data. Our stock setup uses an eight-hour locked-device reboot interval; you set your own screen lock.
Security that keeps moving.
Official GrapheneOS security updates remain available. GhostWire and its companion apps use signed update channels. OS support duration depends on your Pixel model.
The private communications layer.
No phone-number account. Hybrid post-quantum messaging and current-pair ML-KEM-rooted frame protection for voice and video. The private vault and included security apps complete the kit.
Titan M2 protects the hardware foundation; it is not the messaging protocol. GhostWire communication keys remain on the handsets. Pixel and GrapheneOS are independent products, with no endorsement implied.
Read the underlying specifications
Owner-controlled protection
More control when the situation changes.
GhostWire now combines separate encrypted workspaces, an owner-enabled remote reset path and dedicated relay deployments. Each control is bounded so you can judge when it helps.
Independent additional vault
Create a second working vault with separate keys, encrypted data, attachments and communication state. Opening it does not expose the primary vault through GhostWire’s interface.
Authenticated remote factory reset
If you enable it locally first, a fresh, signed and device-bound command can request a full Android factory reset through the owner control path. It is off by default.
Dedicated relay option
Organisations can use a separately configured GhostWire relay and self-hosted TURN service instead of the standard call-relay provider.
Limits: the additional vault is not a separate Android user profile and cannot defeat a compromised operating system. An offline phone remains pending; a reset request handed to Android is not proof that storage was erased. A dedicated relay still observes connection metadata and must be securely operated.
The Pharoah Technology approach
Security starts with awareness.
No technology can detect every threat. GhostWire brings together stronger defences, security tools and practical awareness to help you protect yourself when it matters. We look beyond the obvious risks to your conversations, data and everyday privacy.
Know what you share.
Understand which apps can access your location, microphone, camera, contacts and files. Allow only what you need.
Think beyond the conversation.
Encryption matters. So do the handset, the apps you install, the networks you join and what happens if the device is lost.
Stay aware. Stay in control.
Use the included security tools and available permissions to make informed choices. No phone can identify every tracker or prevent every attack.
A mobile network can still infer a connected handset’s location. App permissions, a VPN and encrypted messaging do not make you invisible to your carrier.
Privacy, in plain English
What GhostWire changes in your everyday life.
You use it like a phone. We remove the usual ways your device, account and conversations can be tied back to you. Built for founders, lawyers, journalists, crypto holders, travellers and anyone who needs a phone separated from their normal identity.
Your communication keys stay on your GhostWire handsets.
There is no key escrow and no equivalent server-side key store. GhostWire routes your messages, voice and video without holding the keys needed to decrypt them.
Post-quantum protection has a precise boundary.
Hybrid X25519 + ML-KEM-768 pairing protects messages, and v2 sessions refresh ML-KEM protection on each ratchet turn. Each dead drop uses a fresh ML-KEM-768 encapsulation mixed into its hybrid handshake. Current GhostWire pairings add ML-KEM-rooted application-frame encryption above DTLS-SRTP for voice and video, derived from the pairing rather than renegotiated per call — that is the difference, and it is what allows a locked handset to answer. Sessions migrated from earlier builds remain DTLS-SRTP.
Your phone is not built around a Google identity.
There is no GhostWire phone number or account to hand over. You pair by invitation and verify the other person directly.
Pressure has an exit — two ways.
Where the deployment enables USB auto-wipe, a locked USB data plug-in triggers the configured handset reset. GrapheneOS’s own duress PIN at the lock screen wipes the whole device including eSIMs, while GhostWire’s separate duress PIN removes only the private vault. You choose your private PINs during setup. USB auto-wipe is optional: manually enable USB-C data in GrapheneOS, then arm it in GhostWire. Enabling the app option alone does not change the USB-C setting.
Dead drops are one-shot, post-quantum, and honest about it.
A dead drop is a message the receiving handset consumes once. Every drop makes a fresh ML-KEM-768 encapsulation to the recipient's published mailbox and mixes it into the hybrid handshake, sent from a throwaway account so the drop does not name its sender. It expires after 1 hour, 24 hours or 3 days, or sooner under their conversation setting, and your side keeps only a delivery marker. It cannot stop someone copying what they can read, and the app says so before you send.
Calls, honestly explained.
Current hybrid-authenticated GhostWire pairings derive ML-KEM-rooted application-frame keys and use them above DTLS-SRTP for voice and video. Any session negotiated without that frame layer remains DTLS-SRTP rather than being mislabelled post-quantum.
Every app in the box, named
14-app customer flash set: ten first-party GhostWire apps plus four selected third-party apps.
The current customer flash set contains 14 pinned apps: ten first-party GhostWire product apps plus Molly, Telegram, Cake Wallet and Mullvad VPN. Every APK is version-, hash- and signer-pinned; the handset build refuses to complete if a required app is missing, undeclared or signed by anything else. LinkBond and Vehicle Scanner are included in the handset flash bundle; the GhostWire Router companion is separate and sent by download link to router buyers. Beyond the flash set, the GhostWire approved-app store on the handset offers six reviewed third-party apps for on-demand install — SimpleX Chat, Session, Threema Libre, Briar, Cake Wallet and Mullvad VPN — served from our own repository at apps.ghostwire.co.uk/t1. The catalogue is signature-verified on the handset before anything installs, each release is pinned to its publisher’s signing key, and nothing outside the catalogue can be installed through it.
Official GrapheneOS security updates remain available through its system updater. GhostWire and companion apps use our signed update channels. The approved-app catalogue verifies its own downloads; it does not block every other Android installation route.
GhostWire
The zero-identity messenger. Invite-paired, no accounts, no phone number. Hybrid post-quantum pairing on every session.
Estate certGhostMail PGP Mail
OpenPGP mail on the handset. One managed mailbox is included, set up by our operators during onboarding; or connect your own IMAP/SMTP account.
Estate certGhostBrowser
Our own browser build. No Google services, no telemetry, no sync account, nothing phoning home.
Estate certGhostMaps
Offline-first maps. Routes and searches resolve on the handset; your location is never reported to us or anyone else.
Estate certGhostWire LinkBond
Wi-Fi intelligence for the handset: current-network checks, router handoff and dual-network research. Pinned into the handset flash bundle.
Flash bundle · includedGhostWire Shield
Always-on mobile-network watch. It checks baseband anomaly signals and warns about suspicious cell-tower behaviour, including downgrade, unknown-serving-cell and identity-inconsistency patterns. It cannot confirm an IMSI catcher.
Mobile network watch · includedGhostWire SCARAB
On-device installed-app and permission-risk scanner. It reports declared permission capabilities and a sourced historical package-name reference locally. These are review prompts, not proof of spyware or malware. It is not a network firewall.
App-risk scanner · includedGhostWire Privacy Audit
Your Room Scanner and Wi-Fi Scanner. It probes devices on the current local network for camera/NVR risks and unusual network devices. Analysis and results stay on the handset and are not uploaded.
Room + Wi-Fi scanner · includedGhostWire Safe Room
Software radio-density and Bluetooth proximity indicators for a controlled space before a sensitive meeting. It is not a complete RF/TSCM detector; dedicated RF hardware is required for a full sweep. Powered-off, wired and passive devices are outside the scan.
Radio/Bluetooth indicators · includedGhostWire Vehicle Scanner
Compares salted anonymous Wi-Fi and Bluetooth references outside and inside a vehicle. It does not claim to detect powered-off, wired, cellular-only, passive or non-radio devices.
Vehicle comparison · includedCurrent app improvements: GhostMail supports individual and selected-message deletion, editable drafts and attachment-loss safeguards. Shield includes regional GNSS advisories; SCARAB uses a limited sourced historical reference; Safe Room adds public Bluetooth company references and marks stale or incomplete observations. These OSINT references provide context, not proof of an attack or a clean device. Molly and Telegram retain their own update routes. One Updates screen handles GhostWire, its companion apps and approved releases. GhostMail for Apple-silicon Mac (developer-signed; not notarized). GhostMail desktop 0.4.0 for Windows (installer), Windows (MSI), Linux (.deb), Linux (AppImage) and Linux (.rpm): not code-signed, so Windows shows a SmartScreen warning; compare your download with the SHA-256 checksums first.
And a platform of 37 components behind them.
The handset is the part you hold. It sits on a much larger engineering programme — a specified, numbered suite covering identity, transport, storage, device management and assurance. Not every component is a consumer app, and most of them you will never see. That is the point: they are the reason the ten apps above can make the claims they do.
Live security backbone: GhostPolicy gates policy decisions; GhostLedger keeps tamper-evident evidence; GhostAdmin controls privileged actions; GhostUpdate verifies signed releases and rollout decisions; GhostMesh provides the peer transport; and GhostWire runs its own relay, wake-push service and fleet cockpit. These are platform services behind the handset, not third-party downloads.
Release and provisioning controls: GhostOS verifies image provenance and signed GrapheneOS configuration profiles locally; SCARAB and Privacy Audit supply the app-risk, network and camera/NVR checks. Their release artefacts are kept separate from the handset flash set and are promoted only after the signing and device gates pass.
Radio claim boundary: Shield warns on nine observable Android cellular-anomaly signals. Android public APIs cannot confirm an IMSI catcher, null-cipher attack, silent SMS or paging attack; those require privileged baseband or hardware access.
Foundation
- GhostCore — shared crypto + contracts
- GhostKey — key custody
- GhostIdentity — identity binding
- GhostTrust — device trust
- GhostDNS — resolution privacy
Communication
- GhostWire Messenger
- GhostMesh — off-grid transport
- GhostBeacon
- GhostWatch — monitoring
Storage
- GhostDrive
- Ghostwire Vault
- GhostCloud
- GhostBackup
- GhostArchive
Control & assurance
- GhostOS — image provenance and configuration
- GhostPolicy — policy decisions
- GhostCommand — fleet control
- GhostUpdate — signed OTA
- GhostScan · GhostSecure · GhostPulse
- GhostCompliance — audit trail
Current manufacturing truth: Newly provisioned Pixel 7a, 8a, 9a and 10a handsets use the live signed mandatory OTA release and current app set; the accepted USB auto-wipe behavior is retained. Factory bundles for these four models are retained in GhostWire-owned private R2 and passed downloaded-byte verification; Google Drive is not used for factory-bundle publication. Five included security apps: GhostWire Shield, SCARAB, Privacy Audit, Safe Room and Vehicle Scanner ship on every handset alongside GhostWire, GhostMail, GhostBrowser, GhostMaps and LinkBond. The first-party local USB auto-wipe control is inside GhostWire; the retired Wasted APK and link-distributed Costa Alert are not preloaded. The wider suite contains shared libraries, hosted services and operator tools; these are separate from the handset apps. GhostMail ships on the handset with one managed OpenPGP mailbox included for onboarding. Its Mac client is also available for personal, team and company use; extra managed accounts are £39/year, five for £149/year, or ten for £249/year. Your included six-month GhostWire service starts at actual handover, not while unsold stock is boxed.
Your apps. Your choice.
Selected apps. Clear boundaries.
GhostWire is built for private communication. Other apps on your handset have their own security and privacy practices.
Selected by Pharoah Technology
We select the third-party apps we consider suitable for inclusion or download on GhostWire handsets. Our catalogue checks publisher signing keys and approved releases to reduce the risk of installing a tampered or unexpected app.
Use with an informed choice
Selection is not a guarantee that an app is free of vulnerabilities, malware or tracking. You use third-party apps at your own risk; their permissions, privacy policies, services and future updates remain separate from GhostWire.
For sensitive conversations, use GhostWire’s own messaging, voice and video with your GhostWire contacts. Installing another app does not give that app GhostWire’s encryption or privacy protections.
This guidance does not limit your statutory consumer rights or our responsibility for the product and services we supply.
Prepared to order
Your Pixel. Your GhostWire kit.
Choose from the Pixel 10 range as well as our existing handset range. We confirm the model, availability and complete kit price before accepting your order.
Pixel 10aPixel 10Pixel 10 ProPixel 10 Pro XLPixel 10 Pro Fold
Choose your model
Tell us your preferred Pixel, storage and delivery destination.
Configured and checked
We prepare GrapheneOS and the GhostWire kit, then complete the handset checks. Your private PINs remain yours to create.
Dispatched within 48 hours
All device orders dispatch within 48 hours of a confirmed order and payment, subject to agreed availability. Courier delivery time is separate.
Tracked courier delivery to your chosen home or business address. Express service is available on request; any express charge and the delivery estimate are confirmed before booking. PO boxes are accepted only where the chosen delivery service supports them.
Ask about your Pixel →Pixel 10 models are prepared to order. Model, storage, condition and final price are confirmed individually.
One kit. Two ways to keep it alive.
The kit is the complete device, GhostWire service and suite. After your first six months, a recharge continues the relay, updates and suite. Hybrid post-quantum messaging and current-pair ML-KEM-rooted voice/video frame protection are included; calls are unmetered while service is active. Optional roaming-data SIM plans are renewed separately.
The GhostWire Kit
£1,700 Pixel 9a build
from £1,500 across the range
6-month contract · all-in · Pixel 7a, 8a, 9 or 9a
- Pixel 7a £1,500 · Pixel 8a £1,600 · Pixel 9 / 9a £1,700
- Pixel 10a £1,850 · prepared to order
- Priced by device: Pixel 7a £1,500 · Pixel 8a £1,600 · Pixel 9 or 9a £1,700
- Case + screen protector, fitted
- GhostWire secure messaging pre-installed
- GhostWire LinkBond Wi-Fi diagnostics ships in the handset flash bundle
- GhostWire Vehicle Scanner anonymous outside/cabin comparison ships in the handset flash bundle
- GhostWire approved-app store on the handset: SimpleX Chat, Session, Threema Libre, Briar, Cake Wallet and Mullvad VPN install on demand from our own repository, catalogue signature-verified
- SIM clarity: the phone works without SIM. Optional roaming data starts from £250; physical SIM supply is confirmed before payment and never treated as part of the core phone price.
- Five included security apps: GhostWire Shield, SCARAB, Privacy Audit, Safe Room and Vehicle Scanner
- GhostMail — private email, two ways: a managed mailbox on our own mail service (one included, set up for you by our operators after handover — never created automatically), or connect a mailbox you already have over standard IMAP/SMTP at no charge. Full OpenPGP either way. Extra managed mailboxes £39/year each (5 for £149, 10 for £249)
- Private vault and duress-PIN setup with buyer-controlled credentials
- Worldwide, dispatched within 48h of confirmed order and payment, subject to agreed availability · secure checkout, crypto or bank transfer
- Ways to pay: cards, wallets, PayPal, Klarna and local bank methods, as shown by Stripe. Companies: Billie Pay in 30 for eligible business buyers
- Fleet discount: 10% off orders of 5 units or more
- Router bundle: Pixel 9a kit + GhostWire Router for £2,500
Recharge
£499
per unit · 6 months
- Full service renewal for your unit
- Roaming-data SIM renewal quoted separately when required
- Relay service + security updates
- Shield suite kept current
GhostMail OpenPGP
Included on the handset
Mac + extra accounts from £39/year
OpenPGP mail · managed service or your own IMAP/SMTP
- GhostMail ships on every handset with one managed OpenPGP account included
- 1 extra account £39/year · 5 accounts £149/year · 10 accounts £249/year
- GhostMail for Mac is available for personal, team and company use with the same managed-account plans
- Set up for you by our operators once payment is verified — never created automatically
- Prefer your own provider? GhostMail also connects to any existing IMAP/SMTP mailbox at no charge
Secure calls
Included
encrypted voice + video
- Current-pair ML-KEM-rooted application-frame call protection
- No per-minute billing while service is active
- Sessions without the current frame layer remain DTLS-SRTP and are labelled accurately
GhostWire Router
£800
secure mobile Wi-Fi · six months of Mullvad VPN
- Secure Stripe checkout ready as a standalone router order
- Ways to pay: cards, wallets, PayPal, Klarna and local bank methods, shown by Stripe where the buyer and order are eligible. Companies: Billie Pay in 30 for eligible business buyers
- Pixel 9a bundle: kit + router for £2,500
- GhostWire Shield, SCARAB, Privacy Audit and Safe Room ship on the handset, not the router
- GhostWire Router companion app is delivered by buyer download link for read-only gateway checks and router-panel handoff
- Router owners get six months of Mullvad VPN and secure mobile Wi-Fi
Every handset is boxed only after these checks pass.
- Current release installed from signed OTA bytes
- GrapheneOS relocked and verified boot checked
- GhostWire message and call path checked
- Private setup the vault and PINs are left for you to create; optional USB auto-wipe requires manual USB-C data configuration and on-device arming
- GhostMail installed, with one managed mailbox included for operator-assisted onboarding, or connect your own IMAP/SMTP account
- Hardware case, screen protector and dispatch condition checked
Support included: setup and handover support are included with the kit. Statutory rights are unchanged; hardware warranty and replacement handling follow the device source and condition confirmed on the order.
GhostWire Secure Mobile Wi-Fi
A protected LTE connection for every device you carry.
A GhostWire-configured GL.iNet Mudi-family portable router. Phones, laptops and tablets join its secured Wi-Fi and use its Mullvad WireGuard tunnel without installing a VPN app on each client.
£800router + six months of Mullvad VPN included
- Tested pilotGL.iNet GL-E750 Mudi V1
- FirmwareGL.iNet 4.3.28 / OpenWrt 22.03.4
- VPNPreconfigured Mullvad WireGuard profile
- AppGhostWire Router companion for read-only gateway checks
- Kill switchBlock-non-VPN configured and acceptance-tested
- DNS policyDNS override and rebinding protection
- Remote accessGoodCloud and DDNS disabled
- Radio WatchLocal monitoring pilot →
Optional data: add a six-month prepaid physical SIM for this router, or an eSIM or physical SIM for a GhostWire handset, covering 160+ countries. Each option starts at £250 for the basic data plan; higher-data plans cost more and the final price is confirmed before payment. Router eSIM is not advertised until the physical-eSIM-card route passes acceptance on the exact hardware. Every router is configured and connectivity acceptance-tested before dispatch. The Android router companion is sent as a private buyer download link with router orders and currently performs read-only reachability checks until the write contract is fully measured.
GhostWire Router · Radio Watch
More visibility into your connection.
Radio Watch adds local observation of the router’s own cellular and Wi-Fi connections alongside its existing VPN protection.
Connection activity
Tracks mobile-link state, upload and download counters, connected Wi-Fi client totals and connection-event counts.
Patterns worth checking
Flags repeated cellular drops and bursts of Wi-Fi disconnections when the required readings are available. Ordinary coverage changes, sleeping devices and interference can cause these patterns too.
Local, read-only monitoring
Keeps a limited history in the router’s memory. The observer does not change the VPN, routing or DNS, and requires no change to GhostWire handset software.
Radio Watch cannot confirm an IMSI catcher or see attacks aimed directly at nearby phones. A pattern is a reason to investigate, not proof of an attack. Missing or outdated readings are shown as gaps, never as an all-clear.
Pilot status · 18 September 2026. Installed and collecting on our GL-E750 Mudi V1 pilot. Mobile-data, browser, handset and extended reliability checks are still in progress before wider rollout. Radio Watch is not yet a standard feature of every shipped router.
GhostWire
Mail
Browser
Maps
LinkBond
VehicleZero-identity router mode
The handset stays off the mobile network. The router carries the connection.
With no physical SIM, no active eSIM and cellular disabled, the GhostWire handset does not register to mobile towers. It joins the GhostWire router over secured Wi-Fi, while the router carries the data connection and wraps connected-device traffic in its fail-closed Mullvad WireGuard tunnel.
01
No handset cellular identity.The mobile session uses the router SIM/IMSI and router modem IMEI. The SIM-free handset does not supply an IMSI, and its IMEI is not transmitted through its Wi-Fi connection to the router.
02
No personal VPN login.Each router receives its own Mullvad numbered account and WireGuard profile. Mullvad requires no customer name, email address or phone number for that account.
03
The SIM and public Internet identity are separated.The carrier sees an encrypted WireGuard connection from the router, while websites and services see the Mullvad exit IP rather than the SIM connection. If the VPN stops, the router kill switch blocks Internet traffic instead of exposing it.
04
Calls and messages remain data services.GhostWire messaging, voice and video work over the router Wi-Fi. Native carrier calls and SMS are not used; emergency calling requires another available route while handset cellular is disabled.
Security boundary: zero identity here means no GhostWire account identity, no handset SIM identity, no handset tower registration and no personal Mullvad login. The carrier still operates the router SIM session, but that transport identity is isolated on the router rather than attached to the GhostWire handset or messenger. Keep handset cellular disabled in this mode.
Full specification
Every layer, specified.
No mystery hardware, no "military-grade" hand-waving. This is exactly what ships, layer by layer, as verified on our own field fleet. Together they are a combination we have not seen assembled on one handset before: an on-device post-quantum hybrid handshake, cellular anomaly warnings, camera/network-risk indicators, a controlled-room RF/Bluetooth sweep and relocked verified boot and an instant duress vault-wipe, on Pixel 7a, Pixel 8a, Pixel 9 or Pixel 9a.
ML-KEM-768
Post-quantum hybrid handshake
resists harvest-now, decrypt-later
0
Accounts, numbers, backdoors
zero identity by architecture
1 PIN
Duress wipe
forced to unlock? the vault is already gone
160+
Countries, optional roaming data
handset eSIM or physical SIM · each from £250
01 Hardware
- DeviceGoogle Pixel 7a, Pixel 8a, Pixel 9 or Pixel 9a, hardened and relocked; Pixel 10a prepared to order
- Security chipTitan M2 tamper-resistant element, every model
- PricingPixel 7a £1,500 · Pixel 8a £1,600 · Pixel 9a £1,700 · Pixel 10a £1,850 prepared to order
- Reference buildPixel 9a: Tensor G4, 6.3-inch 120 Hz pOLED
- Memory8 GB RAM, 128 GB storage (9a build)
- Battery5,100 mAh, all-day (9a build)
- BuildIP68 water and dust rated (9a build)
02 Operating system
- OSGrapheneOS, hardened Android, no Google services
- Verified bootGrapheneOS verified boot with a locked bootloader · OS integrity enforced at boot
- Key storageStrongBox hardware-backed keys
- Memory safetyHardware memory tagging (Pixel 8a and newer GhostWire models)
- Duress PINInstant GhostWire vault + key wipe on entry — app data, not the whole handset
- App isolationPer-app sandbox, permission scopes
- USBLocked down while the screen is locked
03 GhostWire messenger
- IdentityNone. No number, no email, no account
- EncryptionOlm double ratchet with hybrid post-quantum message epochs
- Key exchangePost-quantum hybrid: ML-KEM-768, signature-bound
- Local vaultAES-256 database, Argon2id PIN key
- PairingSingle-use QR or link invites, burned at the relay
- VerificationSafety numbers bind both identities
- Messaging1:1 and groups, voice notes, photos
- Media viewerIn-memory zero-disk viewer with interactive pinch-zoom
- Screen privacyScreenshot-proof, blanked in app switcher
- DuressSecond PIN wipes the GhostWire vault and keys instantly
04 Calls + wake
- CallsEncrypted voice and video, peer-to-peer
- Cross-networkWiFi to cellular, secure TURN relay
- RingingRings locked; ring survives reboot
- Hang-upPropagates in 1 to 2 seconds
- WakeContent-free push from our own server; no Google, no Apple
- Push channelOur own wake channel, held by the app itself · no Firebase, no Apple, no companion app, no public relay. Delivery is managed within GhostWire's own service layer.
- Closed-appMessages and calls arrive with the app closed
05 Network + service
- DataOptional prepaid handset eSIM, or physical SIM for handset/router · six months · 160+ countries · each from £250 for the basic plan; more data costs more
- RelayManaged GhostWire store-and-forward service with decoupled message, call-signalling, and control queues
- Key custodyCommunication keys stay on the GhostWire handsets · no escrow service
- VPNMullvad pre-installed
- UpdatesSigned builds from our own channel · no Google Play; approved third-party apps come from GhostWire’s own store on the handset
06 In the box
- HandsetProvisioned Pixel 9a, case + protector fitted
- CommsGhostWire with one-shot dead drops; Molly and Telegram, hardened configs
- Browser & mapsGhostBrowser and GhostMaps — our own builds, release-signed by us
- Safety suiteCellular anomaly alerts, WiFi reader, camera/network-risk checks and software mic/camera guard · GhostWire SCARAB · Privacy Audit · Safe Room · Vehicle Scanner
- ShieldGhostWire Shield threat detection, always on
- WalletCake Wallet: XMR, BTC, USDT — plus virtual and physical spending cards, ordered from inside the app
- NetworkMullvad VPN pre-installed · GhostWire vault wipe · USB auto-wipe where enabled
- AppsGhostWire approved-app store — our own on-handset repository: SimpleX Chat, Session, Threema Libre and Briar install on demand · no Google account and no third-party store needed
- HandoverBuyer-controlled vault and duress-PIN setup, onboarding included
Ordering
Order online. Pay now or on confirmation.
Placing the order reserves your allocation and locks your price. Secure Stripe checkout shows the methods available for your order, including cards, wallets, PayPal, Klarna and local bank methods, and Billie for eligible business buyers. If you would rather arrange payment, your order still stands: we reply within one business day and invoice you for crypto or bank transfer.
Order received
GW-000000
Keep this reference. You can pay now — or wait for our reply (within one business day) confirming allocation, shipping or in-person handover first.
Pay now in Bitcoin: scan the code or send the £ total in BTC at today's rate to bc1qc7uvjnes2uc3exhzddthmhvnsdhqc8jdzm356q — then email your reference and transaction id. Dispatch within 48 hours after order, availability and on-chain payment confirmation. Courier delivery time is separate. Monero and Ethereum are also accepted — addresses below.
Monero (XMR) (scan or copy):
44oS88zR9ViXPzRbFP2Xf9AdLVPvq9z9gb9DqiXLptHLM7f7ypz9dEZGqe8XGj8UXQ7UYWdGyJti9FxXk3HAcRK3CPccG49
Ethereum (ETH) (scan or copy):
0x10c39A531c709EEb61E0a002375E721EF6B908bA
Questions in the meantime? info@pharoahtechnology.co.uk, quoting your reference. Or message us on Telegram: @ghostwireuk.
Questions, answered straight.
How do I pay? +
Stripe checkout, crypto or bank transfer. Stripe dynamically shows the methods available for the buyer and order. These can include card, Apple Pay, PayPal, Revolut Pay, Link, Klarna and local bank methods such as Pay by Bank, Bacs Direct Debit, SEPA Direct Debit or iDEAL. Billie can give eligible business buyers 30 days to pay. Availability depends on amount, currency, country, device and provider approval. Or reserve first and pay by crypto (BTC, XMR or ETH) or bank transfer against a proper invoice from Pharoah Technology Ltd once we confirm your allocation.
BTC: bc1qc7uvjnes2uc3exhzddthmhvnsdhqc8jdzm356q
If you are paying in crypto rather than by card, send it once we confirm your allocation and email your order reference with the transaction id so we can match it. Monero and Ethereum addresses are published below — no need to ask.
Monero (XMR) (scan or copy):
44oS88zR9ViXPzRbFP2Xf9AdLVPvq9z9gb9DqiXLptHLM7f7ypz9dEZGqe8XGj8UXQ7UYWdGyJti9FxXk3HAcRK3CPccG49
Ethereum (ETH) (scan or copy):
0x10c39A531c709EEb61E0a002375E721EF6B908bA
Can I pay with Klarna or Billie? +
Pay with Klarna. Choose Klarna at checkout. Klarna decides what it offers for each order and shows it, with its terms, before you confirm. We cannot promise an approval, and we are not told why a request is declined.
Buying for a company? Billie can give eligible business buyers 30 days to pay. Billie makes the decision, not us.
Nothing changes at our end: your kit is built and dispatched exactly the same way. If Klarna or Billie is not shown, or you would rather not use them, Stripe can still show eligible card, wallet and local bank methods; PayPal, crypto and invoiced bank transfer remain available where supported. More detail for personal buyers and for companies.
What details do you actually need? +
The minimum an order needs: a name or alias, an email to reach you on, and a shipping country for kits. The device itself has no account and is never linked to your order details after handover.
Which Pixel should I choose? +
The current range is Pixel 7a, Pixel 8a, Pixel 9 and Pixel 9a. Pixel 10a is £1,850 and prepared to order: we confirm its dispatch date by email before it ships.
Where do you ship, and how fast? +
Worldwide. Kits dispatch within 48 hours of confirmed order and payment, tracked and discreetly packaged. In-person provisioning and handover can also be arranged; tell us in the order notes.
I already have a unit. How does a recharge work? +
Order the recharge and include your unit reference if you have it. GhostWire relay service, security updates and the Shield suite continue for another six months. Encrypted calls stay included and unmetered throughout. Any prepaid handset eSIM or physical SIM is renewed and priced separately.
Is GhostWire independently audited? +
Not yet, and we say so plainly. We do not hide behind vague claims. The architecture is no-backdoor by design, built on audited primitives, and pre-audited internally across our estate using industry-standard open-source auditing toolchains (RustSec, cargo-deny, Project Wycheproof, and concurrency race suites — passing 217 cryptographic tests with 0 unsafe Rust blocks in core). We have applied for formal external audit grant funding, publish our full architecture openly, and actively welcome independent security research and formal third-party audits.
What can the relay see? +
The relay receives delivery envelopes, not communication keys. GhostWire runs no Key Management Server, key escrow or equivalent server-side key store. Encryption keys stay on the GhostWire handsets, so the delivery layer has no path to decrypt communications. See the privacy policy for the data-handling terms that apply to your service.
Contact, payment and product information.
✉ Contact
We answer within one business day.
Email: info@pharoahtechnology.co.uk
Telegram: @ghostwireuk
In-person provisioning and handover by arrangement. Government and fleet enquiries: mark your message "sovereign" and it goes to the top of the pile.
Sales via Telegram
Scan to start an order or delivery conversation with @ghostwireuk.
Open Telegram salesɃ Payment
Stripe can show card, Apple Pay, PayPal, Revolut Pay, Link, Klarna and local bank methods such as Pay by Bank, Bacs Direct Debit, SEPA Direct Debit or iDEAL. Billie Pay in 30 is for eligible business buyers. Or pay by crypto or transfer once we confirm your allocation. Stripe shows only the methods supported for that order.
Pay with Klarna. Choose Klarna at checkout. Klarna shows what is available for your order, and its terms, before you confirm. Paying by card, crypto or transfer is always available instead.
Bitcoin (scan or copy):
bc1qc7uvjnes2uc3exhzddthmhvnsdhqc8jdzm356q
Monero (XMR) (scan or copy):
44oS88zR9ViXPzRbFP2Xf9AdLVPvq9z9gb9DqiXLptHLM7f7ypz9dEZGqe8XGj8UXQ7UYWdGyJti9FxXk3HAcRK3CPccG49
Ethereum (ETH) (scan or copy):
0x10c39A531c709EEb61E0a002375E721EF6B908bA
Bank transfer to Pharoah Technology Ltd — account details are issued on your invoice, never published here.
Card payment at checkout, handled by Stripe. Email your order reference with any crypto payment. Dispatch within 48 hours of confirmed payment, worldwide.■ Product
One kit, on Pixel 7a, Pixel 8a, Pixel 9 or Pixel 9a.
Priced by device: £1,500, £1,600 or £1,700. Pixel 10a is £1,850, prepared to order. Recharge £499 per 6 months. Encrypted calls are included and unmetered while service is active.
Every kit: GrapheneOS relocked with verified boot, zero-identity comms with an on-device post-quantum handshake, the counter-surveillance suite, and duress-PIN protection you configure with your own credentials. An optional six-month prepaid roaming eSIM for a handset, or physical SIM for a handset or router, covers 160+ countries and starts at £250 for either option's basic plan; higher-data plans cost more.
An open invitation
Think you can break GhostWire? Come and try.
We will hand you the keys: a device on the table, the full spec sheet, and our undivided attention. Get in, show us how, and we will fix it and shake your hand. That is how confident we are in what ships.
Take the challenge