Executive and board communications
Leadership teams need a channel for sensitive strategy discussions that doesn't sit on the same platform as everyday team chatter.
Live
GhostWire
A hardened private phone, configured before it reaches you.
Overview
What GhostWire is.
GhostWire is a hardened Google Pixel, chosen as a Pixel 7a, 8a or 9a and relocked on GrapheneOS with verified boot. It arrives as a ready-to-use private phone with GhostWire messaging and calls, safety tools and no Google account built into the setup.
GhostWire is fully post-quantum across communications. ML-KEM-768 protects message and call-media keys, ML-DSA-65 protects identity signatures, and hybrid post-quantum envelopes protect delayed messages. Voice and video calls use DTLS-SRTP with ML-KEM-rooted frame keys protecting the media itself.
There is no key escrow. GhostWire runs no Key Management Server or equivalent server-side communication-key store: encryption keys stay on the GhostWire handsets, while delivery infrastructure routes communications without a path to decrypt them.
GhostWire is available now at ghostwire.store. Each phone is configured before handover, including a tested duress PIN and the safety suite. Optional prepaid eSIM or physical-SIM data is available separately. Orders dispatch worldwide after confirmed payment.
Capabilities
What it does.
Delivery & Relay
Store-and-forward relay
Messages traverse an anonymous relay layer designed so no single node holds the full picture of sender, recipient and content at once.
HMAC-signed delivery
Every message is signed on send and verified on receipt, so tampering or replay in transit is detectable, not assumed away.
Delivery confirmation
Senders get a verifiable record that a message reached its recipient, with delivery managed inside the GhostWire service architecture.
Anonymous routing
The relay is built to minimise metadata leakage between parties, keeping who-talked-to-whom out of a central log.
Keys & Identity
No-key-escrow architecture
GhostWire has no Key Management Server or equivalent server-side communication-key store. Encryption keys stay on the handsets; delivery infrastructure cannot decrypt communications.
Full post-quantum communications
ML-KEM-768 protects messages and call-media keys, ML-DSA-65 protects identity signatures, and hybrid post-quantum envelopes protect delayed messages.
Retention controls
GhostWire's service architecture includes retention and access controls designed for a private communications system rather than a consumer social platform.
Forward secrecy, every message
Keys rotate every message under the double ratchet, so compromising one message's key doesn't expose the ones before or after it.
Hardware & Handset
Titan M2 secure element
A tamper-resistant hardware security chip on every model, the same class of element used to anchor GrapheneOS's verified boot.
Relocked, verified boot
GrapheneOS installed and the bootloader relocked, so the device refuses to boot anything that isn't what we signed.
Duress-PIN wipe
A second PIN wipes GhostWire irreversibly and returns a clean first-run install — armed and tested before the handset ever leaves us.
Signed updates, our own channel
Every app is release-signed by us and updates over our own self-hosted, hash-pinned channel — no Google Play, no app store, no third-party distributor.
Architecture
How it's built.
GhostWire's architecture is deliberately linear: a message enters as plaintext on the client, and every layer after that exists to reduce what any single party — including Pharoah — can see, tamper with, or lose.
The client encrypts on-device before anything leaves the handset. That encrypted envelope is what actually crosses the wire; the anonymous relay stores and forwards it without the ability to decrypt it. Delivery is HMAC-verified at the recipient end, and undelivered messages simply auto-purge — there is no log to keep.
It's a small number of layers on purpose. Fewer moving parts means fewer places for a mistake, a compromised relay, or a misconfigured integration to turn a private channel into a leaky one.
GhostWire architecture, in order
- Client apps: Messages are composed on hardened handsets and protected by GhostWire's controlled communications architecture.
- Protected delivery envelope: Communications use GhostWire's full post-quantum protection across messages, identity, calls and video.
- Managed relay (store-and-forward): GhostWire's delivery layer routes encrypted communications without requiring a public phone number or consumer-platform account. It holds no communication keys and cannot decrypt them.
- HMAC-verified delivery: Each delivery is cryptographically signed and verified, so tampering in transit is detectable.
- Retention controls: Retention and access controls are designed into the managed GhostWire service rather than delegated to a consumer social platform.
Use Cases
Who it's built for.
Privileged legal correspondence
Conversations that may be privileged need a channel that keeps no record for anyone to compel — GhostWire's relay purges undelivered messages rather than retaining them.
Cross-border deal teams
M&A and investment teams working across jurisdictions need a private channel they own outright, independent of any single counterparty's tooling.
Journalists and incident responders
Anyone whose sources, contacts or movements can't sit on a platform that profiles them needs a device built for that from the ground up, not bolted on.
Privacy-conscious individuals
No business case required — GhostWire ships direct to individual buyers who want a handset that isn't watching them, no consultation or onboarding process needed.
FAQ
Straight answers.
Is GhostWire available today?
Yes. GhostWire ships today as a complete hardened handset, ordered directly at ghostwire.store — no consultation or sign-up process required. Devices are dispatched worldwide within 24 hours of payment.
Is GhostWire a consumer messaging app?
No — it isn't an app you install on a phone you already own. GhostWire is a hardened Google Pixel, relocked on GrapheneOS, with our zero-identity encrypted messenger, VPN and anonymous data service pre-installed and release-signed by us.
What does "store-and-forward relay" mean?
GhostWire runs a delivery service that forwards encrypted communications without requiring a public phone number, consumer account or social graph. The relay holds no communication keys and cannot decrypt messages or calls.
How are messages authenticated?
Every message uses an audited Olm double ratchet plus an ML-KEM-768 post-quantum hybrid handshake, and every relay delivery is HMAC-signed on send and verified on receipt, so tampering or replay in transit is detectable rather than assumed away.
Does GhostWire use key escrow?
No. GhostWire has no Key Management Server, no key escrow and no equivalent server-side communication-key store. Encryption keys remain on the GhostWire handsets; the delivery layer cannot decrypt communications.
How is data handling controlled?
GhostWire's managed service architecture includes retention and access controls as part of the system. The applicable data-handling terms are set out in the GhostWire privacy policy.
What makes GhostWire private?
Zero public identity, hardened GrapheneOS handsets, handset-held communication keys with no escrow, and full post-quantum protection across calls, video, messages and identity.
How much does GhostWire cost?
Pixel 7a kits start at £2,300, Pixel 8a at £2,400 and Pixel 9a at £2,500. Full pricing is published at ghostwire.store.
How do I order one?
Order directly at ghostwire.store. Card and cryptocurrency payment are both accepted, and devices dispatch worldwide within 24 hours of payment.
What kind of buyer is GhostWire built for?
Anyone whose conversations, contacts and location genuinely can't sit on a consumer platform — executives, deal teams, journalists, incident responders and privacy-conscious individuals.
How do updates work?
Signed builds from our own update channel — there is no Google Play or app store involved.
Does GhostWire replace my everyday phone?
It can, or it can run alongside one. GhostWire ships as a complete handset — GrapheneOS, our messenger, a hardened browser, Mullvad VPN and anonymous eSIM data all pre-installed — not a single app bolted onto a platform that's already watching you.
Engagement
How to work with us.
GhostWire is a self-serve, direct purchase. Choose a Pixel 7a, 8a or 9a at ghostwire.store, then pay securely online or arrange payment after confirmation. The handset is configured before it reaches you, with its duress PIN and safety suite checked before handover.
Published handset pricing starts at GBP 2,300, with the Pixel 9a build at GBP 2,500. Fleet or organisation-scale orders can reach us directly at info@pharoahtechnology.co.uk.
Ready to talk about GhostWire?
A hardened private phone, configured before it reaches you.
More From Pharoah
Explore the rest of the catalogue.
Pharoah Secure OS
Pharoah Labs
A hardened operating environment for regulated and government contexts — an active research and engineering programme, deployed by engagement.
Explore →
Fusion
By engagement
An advanced software engineering platform built around ownership, production discipline, deployment and long-term maintainability.
Explore →
Anaïs AI
Live
The practical AI platform that routes every prompt across 200+ models for the lowest cost and the highest quality.
Explore →