Executive and board communications
Leadership teams need a secure channel for sensitive strategy, governance, and M&A discussions that remains completely decoupled from corporate IT networks.
Live
GhostWire
A hardened private phone and secure router system, configured before it reaches you.
Overview
What GhostWire is.
GhostWire is a hardened Google Pixel, available on the Pixel 7a, 8a, 9 and 9a, with the Pixel 10a prepared to order, relocked on GrapheneOS with verified boot. It arrives as a ready-to-use private communications system with zero-identity messaging, encrypted calls, native GhostMail PGP email, counter-surveillance tools, and an optional portable secure router pilot.
Between current GhostWire pairings, post-quantum protection is hybrid and stated with its limits. Messages use a hybrid X25519 + ML-KEM-768 handshake and a fresh ML-KEM-768 encapsulation every turn on current sessions, identity signatures combine Ed25519 with ML-DSA-65, and dead drops carry their own ML-KEM-768 encapsulation. Voice and video run over DTLS-SRTP with ML-KEM-rooted frame keys; older migrated sessions stay DTLS-SRTP and are labelled that way. Bundled third-party apps keep their own encryption.
There is zero key escrow. GhostWire runs no Key Management Server or server-side communication-key store: encryption keys stay strictly on the GhostWire handsets, while anonymous store-and-forward relay infrastructure routes communications with separate decoupled queues for real-time signaling, messaging, and control packets.
GhostWire is available now at ghostwire.store. Each phone is configured before handover, including a tested duress PIN, an independent additional vault, an owner-enabled remote reset path (off by default), and the full counter-surveillance suite (Shield, Safe Room, SCARAB, and Vehicle Scanner). Orders dispatch worldwide within 48 hours of confirmed payment.
Capabilities
What it does.
Post-Quantum Cryptography & Identity
Hybrid post-quantum ratchet
On current sessions a fresh ML-KEM-768 encapsulation every turn protects message content; identity signatures combine Ed25519 with ML-DSA-65, and dead drops carry their own ML-KEM-768 encapsulation.
No-key-escrow architecture
GhostWire has no Key Management Server or server-side communication-key store. Encryption keys stay on the handsets; delivery infrastructure cannot decrypt communications.
Forward secrecy & frame encryption
Keys rotate every message under the double ratchet, and real-time voice and video frames are encrypted with current-pair ML-KEM-rooted keys.
GhostMail PGP email integration
Native on-device OpenPGP email: end-to-end encrypted to anyone who has a key, ordinary mail to everyone else, and it always tells you which. Mail headers and routing stay visible to mail servers.
Delivery & Anonymous Relay
Decoupled relay queues
Relay infrastructure uses independent queues for messaging, real-time call signaling, and control packets to ensure high message volume never blocks urgent call setup.
HMAC-signed delivery
Every message is signed on send and verified on receipt, so tampering or replay in transit is cryptographically detectable.
Anonymous routing
The relay routes encrypted payloads by ephemeral queue tokens rather than phone numbers or accounts. Like any network service it still sees connection metadata such as IP addresses and timing.
Dedicated relay option
Organisations can use a separately configured GhostWire relay and self-hosted TURN service instead of the standard call-relay provider. A dedicated relay still observes connection metadata and must be securely operated.
Hardware Root of Trust & OS Hardening
Titan M2 hardware security chip
A tamper-resistant hardware element on every Pixel enforcing brute-force unlock delays and anchoring GrapheneOS verified boot.
Relocked verified boot
GrapheneOS installed with the bootloader relocked to official signing keys, ensuring the handset executes only verified, untampered firmware.
Duress PIN & remote reset
A duress PIN irreversibly destroys the GhostWire vault: messages, contacts and keys. An owner-enabled remote reset path is off by default; an offline phone stays pending, and a reset request is not proof that storage was erased.
Independent secondary vault
Create a separate encrypted working vault with distinct keys, communication states, and attachments without exposing the primary vault.
Secure Router & Counter-Surveillance Suite
Portable secure router pilot
A GhostWire-configured GL.iNet GL-E750 Mudi (tested on firmware 4.3.28) with an IPv4 cellular profile and a fail-closed Mullvad WireGuard tunnel: a configured, acceptance-tested block-non-VPN rule stops traffic if the VPN drops.
Radio Watch connection observer
Local, read-only memory monitoring on the router tracking cellular connection events, drops, and Wi-Fi disconnect bursts without modifying DNS or VPN routing.
Shield & Safe Room sensors
On-device radio and acoustic observation tools to inspect local cellular signals, RF anomalies, and environmental acoustic baselines.
SCARAB & Vehicle Scanner
Offline permission analysis and vulnerability auditing across installed applications, plus wireless tracker detection around vehicles.
Architecture
How it's built.
GhostWire's architecture is built on the principle of defense-in-depth across three distinct layers: hardware root of trust, hardened operating system, and post-quantum communications.
Plaintext never leaves the handset. Messages and media streams are encrypted on-device with ML-KEM-768 hybrid keys before traversing anonymous store-and-forward relays with decoupled signaling queues. Communication keys remain exclusively on client handsets.
For network separation, the GhostWire portable router pilot is a separate device that carries the data connection through its fail-closed WireGuard tunnel, with Radio Watch observing connection events; the SIM-free handset does not present its own cellular identity.
GhostWire architecture, in order
- Hardened Hardware & OS: Titan M2 security chip, relocked GrapheneOS verified boot, duress wipe, and independent secondary encrypted vaults.
- Post-Quantum Cryptographic Layer: ML-KEM-768 key encapsulation, ML-DSA-65 digital signatures, double ratchet forward secrecy, and DTLS-SRTP frame protection.
- Decoupled Anonymous Relay: Store-and-forward delivery with isolated queues for real-time call signaling, messages, and control packets; no key escrow, and only ciphertext is held for delivery.
- Secure Network Uplink & Radio Watch: Portable router pilot with an IPv4 cellular profile, a fail-closed WireGuard tunnel and local radio event observation.
- Counter-Surveillance & GhostMail Suite: Integrated client tools including Shield, Safe Room, SCARAB offline audit, Vehicle Scanner, and GhostMail OpenPGP email.
Use Cases
Who it's built for.
Privileged legal and financial counsel
Conversations and case files subject to strict legal privilege need handset-held keys, no server-side key store and an irreversible duress wipe of the GhostWire vault.
Field operations and hostile environment travel
Operational teams working in contested or high-surveillance regions use the portable router with Radio Watch and counter-surveillance tools to monitor cellular environments.
Investigative journalism and source protection
Reporters and whistleblowers communicating sensitive material require zero-identity onboarding, post-quantum cryptography, and GhostMail PGP correspondence.
Privacy-conscious individuals
Individuals who want stronger personal privacy receive a turnkey, hardened handset ready for immediate use without Google accounts or invasive tracking.
FAQ
Straight answers.
Is GhostWire available today?
Yes. GhostWire ships as a complete hardened handset kit ordered directly at ghostwire.store. Pixel 7a, 8a, 9 and 9a kits dispatch worldwide within 48 hours of confirmed payment. The Pixel 10a is prepared to order, and we confirm its dispatch date by email before it ships.
What makes GhostWire post-quantum?
GhostWire uses NIST-standardised post-quantum algorithms alongside classical ones: ML-KEM-768 with X25519 for pairing, message ratchets and call-frame keys, and ML-DSA-65 with Ed25519 for identity signatures. This covers communication between current GhostWire pairings; older migrated sessions and bundled third-party apps are outside it. It has not been independently audited.
What is the GhostWire portable router pilot?
The router pilot is a GhostWire-configured GL.iNet GL-E750 Mudi (tested on firmware 4.3.28) with a cellular profile, a fail-closed Mullvad WireGuard tunnel whose block-non-VPN rule stops traffic if the VPN drops, and the Radio Watch connection observer to inspect cellular and Wi-Fi link health.
What is GhostMail PGP?
GhostMail is our native on-device OpenPGP email client. Mail is end-to-end encrypted to anyone who has a key and ordinary mail to everyone else, and it always tells you which. As with all email, headers and routing remain visible to mail servers.
Does GhostWire use key escrow?
No. GhostWire operates zero key escrow and maintains no server-side key management system. Encryption keys reside solely on your handset; our delivery infrastructure cannot decrypt your communications.
What is the duress PIN and secondary vault?
An additional vault provides a separate encrypted workspace with its own keys and messages. Entering the GhostWire duress PIN irreversibly destroys the GhostWire vault: messages, contacts and keys. GrapheneOS also offers its own duress PIN, which wipes the phone’s data.
How much does GhostWire cost?
Pixel 7a £1,500, Pixel 8a £1,600, Pixel 9 or 9a £1,700, and Pixel 10a £1,850, prepared to order. The GhostWire Router is £800 with six months of Mullvad VPN included: £2,300 with a Pixel 7a, or £2,500 as the Pixel 9a bundle. Every kit includes six months of GhostWire service from handover; a recharge is £499 per six months. Orders are placed at ghostwire.store, and fleets of five or more can request a quote.
Engagement
How to work with us.
GhostWire is a self-serve, direct purchase available at ghostwire.store. Each handset is individually provisioned, verified on GrapheneOS, and shipped securely worldwide within 48 hours.
Handsets start from £1,500 at ghostwire.store, or £2,300 with the GhostWire Router. Enterprise fleet deployments and dedicated relay infrastructure can be scoped via info@pharoahtechnology.co.uk.
Ready to talk about GhostWire?
A hardened private phone and secure router system, configured before it reaches you.
More From Pharoah
Explore the rest of the catalogue.
Pharoah Secure OS
Pharoah Labs
A hardened operating environment for regulated and government contexts — an active research and engineering programme, deployed by engagement.
Explore →
Fusion
By engagement
An advanced software engineering platform built around ownership, production discipline, deployment and long-term maintainability.
Explore →
Anaïs AI
Live
The practical AI platform that routes every prompt across 200+ models for the lowest cost and the highest quality.
Explore →