A phone that answers to you. Nobody else.
Pixel hardware hardened by DatSov on GrapheneOS, with zero-knowledge encrypted comms and a number-less, data-only identity. Three editions, one standard of hardening, and a platform you can independently verify — supplied to lawful clients after identity verification and screening.
The Sovereign Phone.
Verifiably the hardest target in your price class — not the loudest marketing. We even name our two residual risks (hardware supply chain and physical coercion), because anyone selling you 'unhackable' is lying.
The editions are a price and specification ladder, not a security ladder. The hardening is the same on all three. Every edition ships as a relocked, attestable GrapheneOS install you can independently verify.
CORE
The verifiable secure phone.
$2,200
THEN $60/MONTH AFTER YEAR ONE
- Pixel 10a
- GrapheneOS hardened by DatSov
- Zero-knowledge encrypted comms
- Number-less, data-only identity
- Camera-lens privacy covers
- Setup + 12 months DatSov Secure Service
TOTAL PAYABLE — NOTHING ADDED AT CHECKOUT
REQUEST THIS DEVICESHIELDED
Executive-grade, hardened for daily use.
$4,200
THEN $90/MONTH AFTER YEAR ONE
- Everything in Core, on a Pixel 10
- Rear-camera slide-cover case
- Priority support
- Setup + 12 months DatSov Secure Service
TOTAL PAYABLE — NOTHING ADDED AT CHECKOUT
REQUEST THIS DEVICEBLACKOUT
The full counter-surveillance kit — your phone doesn't just resist surveillance, it watches for it.
$6,600
THEN $150/MONTH AFTER YEAR ONE
- Everything in Shielded, on a Pixel 10 Pro XL
- Faraday 'go-dark' pouch
- IMSI-catcher detection companion (EFF Rayhunter on TP-Link hardware)
- White-glove onboarding
- Premium, self-hostable service
- Setup + 12 months DatSov Secure Service
TOTAL PAYABLE — NOTHING ADDED AT CHECKOUT
REQUEST THIS DEVICEEvery device sale requires identity verification and screening before payment. Devices are supplied to lawful clients only. All deployments include a configuration consultation with your assigned Technical Lead. International orders subject to export screening.
What each edition actually defends against.
The editions are a price and specification ladder, not a security ladder. The hardening is the same on all three. Every edition ships as a relocked, attestable GrapheneOS install you can independently verify.So the honest way to compare them is not “which is more secure” — it is which threats the kit in the box covers, and which nothing covers at any price.
SHIELDED
Executive-grade, hardened for daily use.
BUILT ON PIXEL 10
OVER CORE — A larger Pixel 10, a rear-camera slide case, and priority support. The hardening is unchanged.
WHAT IS IN THE BOX
Everything in Core, on a Pixel 10
Rear-camera slide-cover case
A fitted case with a sliding shutter over the rear lens.
DEFENDS AGAINST — The same vector as the covers, in a form you will actually keep using daily.
Priority support
A shorter response commitment on the same service.
DEFENDS AGAINST — Time. It is a service level, not a security control, and we will not dress it up as one.
Setup + 12 months DatSov Secure Service
Configuration, handover and the first twelve months of patching and support from your assigned Technical Lead.
DEFENDS AGAINST — The slow drift into insecurity that follows every device left unpatched and unmanaged after handover.
Threat coverage across the range.
The first five rows are identical on all three editions. That is not an oversight in the table — it is the point: the hardening does not change with the price.
- Platform — same on every edition
- Kit — differs by edition
- Not included
- Residual — named, not solved
| VECTOR | CORE | SHIELDED | BLACKOUT |
|---|---|---|---|
| OS exploitation and untrusted appsA hardened, de-Googled platform with exploit mitigations the stock OS does not ship. | GrapheneOS, hardened | GrapheneOS, hardened | GrapheneOS, hardened |
| Platform telemetry and account bindingNo Google account is required and no vendor services phone home by default. | De-Googled | De-Googled | De-Googled |
| SIM swap, number porting, carrier recordsIdentity is data-only. There is no carrier-issued number to port away, swap, or request records against. | Number-less identity | Number-less identity | Number-less identity |
| Interception of message content in transitZero-knowledge encrypted comms — DatSov is technically unable to read the content. | Zero-knowledge comms | Zero-knowledge comms | Zero-knowledge comms |
| Tampering with the platform itselfThe install is relocked and attestable, so you can check the OS is the one we say it is instead of trusting us. | Relocked + attestable | Relocked + attestable | Relocked + attestable |
| Opportunistic camera capturePhysical covers, because software permissions are not the only way a lens gets used. | Lens covers | Lens covers + rear slide case | Lens covers + rear slide case |
| Location tracking while the device is stowedA Faraday pouch blocks the radio entirely, so a stowed device cannot transmit or be located by it. | Not included | Not included | Faraday 'go-dark' pouch |
| Active radio surveillance nearbyAn IMSI-catcher companion DETECTS a suspicious cell site and warns you. It does not prevent one operating, and nothing at any price does. | Not included | Not included | IMSI-catcher detection |
| Hardware interference before deliveryA supply chain we do not manufacture end to end. We buy, harden and ship; we cannot prove a device was untouched before it reached us. | Residual — named, not solved | Residual — named, not solved | Residual — named, not solved |
| Coercion of the person holding the deviceIf someone can compel you to unlock it, no phone helps. Anyone claiming otherwise is selling you something that does not exist. | Residual — named, not solved | Residual — named, not solved | Residual — named, not solved |
The last two rows are the two risks we cannot engineer away, at any price, on any edition. We name them because a range that claimed to cover everything would be telling you something we could not stand behind — and because you cannot plan around a risk nobody told you about.
Security you can check, not security you're asked to believe.
Consumer hardware assumes you trust the platform. The Sovereign Phone assumes you should not have to — the install is relocked and attestable, and the residual risks we cannot engineer away are named rather than buried.
Verifiable, not just asserted
Every edition ships as a relocked, attestable GrapheneOS install. You can check the platform is what we say it is rather than take our word for it — which is the whole point.
One hardening, three price points
The editions differ on Pixel model, accessories and service level. They do not differ on how the device is hardened, and we will not pretend otherwise to sell you the expensive one.
Number-less by design
Identity is data-only, with zero-knowledge encrypted comms. Nothing is tied to a carrier-issued number that can be ported away, SIM-swapped, or handed over on request.
Two residual risks, named
Hardware supply chain and physical coercion. We cannot engineer those away, so we tell you about them instead of selling you an 'unhackable' phone that does not exist.
What ships and what we manage.
Each edition is supplied at a one-time figure that includes setup and the first twelve months of DatSov Secure Service; monthly service begins after year one. Every deployment starts with a configuration consultation.
GRAPHENEOS, HARDENED BY DATSOV
A de-Googled mobile OS with our hardening applied, relocked and attestable, so the platform's integrity is something you can verify independently.
ZERO-KNOWLEDGE ENCRYPTED COMMS
Messaging and calls where DatSov is technically unable to read the content, with a number-less, data-only identity rather than a carrier subscription.
COUNTER-SURVEILLANCE KIT
Camera-lens privacy covers across the range; Blackout adds a Faraday 'go-dark' pouch and an IMSI-catcher detection companion so the device watches for surveillance, not just resists it.
DATSOV SECURE SERVICE
Setup plus the first twelve months included with every edition — patching, configuration and support handled by your Technical Lead. Monthly service continues after year one.
Request a Sovereign Phone.
Book an architecture call to scope a single device or a managed fleet. Devices are supplied to lawful clients only, after identity verification and screening.