Why GrapheneOS on a Pixel: a guide for UK businesses

GrapheneOS is a non-profit, open source mobile operating system built on the Android Open Source Project; it was founded as an open source project in 2014 (Source: GrapheneOS).

It replaces the operating system Google ships on a Pixel. It is not an app, a launcher or a management tool sitting on top of stock Android. Its work centres on defending against vulnerabilities that are not yet known, through attack surface reduction, exploit mitigations such as a hardened memory allocator, and sandboxing (Source: GrapheneOS).

It is a de-Googled Android in a specific sense: Google apps and services are not included and the project says they will never be bundled with the OS, but Google Play can be installed as a sandboxed app if staff need it (Source: GrapheneOS). It also adds controls that stock Android does not offer. In our view several of them matter most when a phone is lost or stolen, or when an app asks for more access than it needs; GrapheneOS describes each one on its features page (Source: GrapheneOS):

Every device on the current official list is a Google Pixel phone, Pixel Fold or Pixel Tablet, and the Pixel 10, 10 Pro, 10 Pro XL, 10 Pro Fold and 10a are all supported (Source: GrapheneOS). The project chooses devices on their merits rather than aiming for broad device support, which it says would run counter to its aims (Source: GrapheneOS).

Two practical points follow. The project strongly recommends buying only one of its listed devices, from the Pixel 8 to the Pixel 10a; a newer Pixel is not covered unless the project adds it to that list, so check the list before buying. It describes its extended support releases for older models as a stopgap that cannot provide full security patches. It also notes that carrier-locked phones may not be able to install GrapheneOS, mainly an issue with US carriers, so a UK business should buy unlocked handsets (Source: GrapheneOS).

The project says it plans to partner with device makers to produce phones meeting all its requirements, but presents that as a plan rather than a product. Its FAQ publishes the hardware and firmware requirements a device must meet, and states that those standards are met or exceeded by devices from the Pixel 8 through the Pixel 10a (Source: GrapheneOS). The requirements include:

Google says Pixel 8 and later phones get seven years of OS and security updates, counted from when the device first became available on the Google Store in the US (Source: Google). The clock therefore starts at the US launch, not on the day a UK business buys the phone.

This matters under UK guidance. Under "Choose supported devices", the NCSC's Android guide notes that update schedules vary by manufacturer and points to Google's list of end-of-support dates for Pixels; it says a device that has reached end of life should be replaced (Source: NCSC). Since 29 April 2024, the regime under Part 1 of the Product Security and Telecommunications Infrastructure Act 2022 and the 2023 Regulations has required manufacturers of relevant connectable products to publish a minimum security update period (Source: GOV.UK); paragraph 3 of Schedule 1 to the Regulations states that the defined support period must be published (Source: legislation.gov.uk). This article is general information, not legal advice; whether a given product is in scope depends on the Act and the Regulations.

GrapheneOS can only provide full security updates while the manufacturer still releases them, and its FAQ says official Pixel updates typically end shortly after the guaranteed period, so do not plan around extra months (Source: GrapheneOS). Its dates rest on Google meeting its commitment; they are not promises from GrapheneOS. On those dates, a Pixel 10 issued in November 2026 has a little under six years of its minimum support period left. The minimum support end dates the FAQ lists are (Source: GrapheneOS):

Sandboxed Google Play is a compatibility layer that runs official Google Play releases in the standard app sandbox, as regular apps; in the project's words, "Google Play receives absolutely no special access or privileges on GrapheneOS" (Source: GrapheneOS). It is installed from the GrapheneOS App Store, per user or work profile, and only apps in that profile can use it (Source: GrapheneOS).

Staff will also see more permission choices. With Contact Scopes, an app starts with no access to contacts and can be granted read access by data type, single contact or group. With Storage Scopes, an app cannot see files created by other apps unless the user grants specific files or folders (Source: GrapheneOS). Decide in advance which work apps need which permissions.

Banking apps need testing. The project calls them a particularly problematic class of apps for alternative operating systems. Many depend on Play services, so installing sandboxed Google Play in the same profile often helps. Some check that the OS is certified by Google; GrapheneOS is not certified and does not try to spoof these checks. Developers can use hardware attestation to permit GrapheneOS, and the project publishes a guide for them (Source: GrapheneOS). Test every banking, authenticator and line-of-business app your staff rely on before rollout.

Updates arrive in the background: the System Updater checks roughly every six hours on a permitted network and verifies signatures (Source: GrapheneOS). Device management needs its own conversation. The NCSC recommends organisation-managed devices with a mobile device management service (Source: NCSC), while the GrapheneOS FAQ does not cover mobile device management or Android Enterprise, so confirm how your management tool will work before you commit.

Verified boot is Android's mechanism for making sure all executed code comes from a trusted source. It builds a chain of trust from a hardware-protected root of trust to the bootloader, the boot partition and the other verified partitions, with each stage checking the next before handing over. Rollback protection stops a device returning to an older version, so an exploit cannot persist after an update (Source: Android Open Source Project).

GrapheneOS is installed with the bootloader unlocked, then the bootloader is locked again; the project does not support GrapheneOS running with an unlocked bootloader (Source: GrapheneOS). When a Pixel loads an operating system other than Google's, it shows a yellow notice at boot. On sixth-generation Pixels and later this shows the full SHA-256 hash of the verified boot public key, which you compare with the official value for your model on the GrapheneOS install page (Source: GrapheneOS).

The Auditor app goes further, using hardware key attestation. A second Android 13 or later device with a camera acts as the Auditor, and the two phones scan each other's QR codes. The Auditor shows a fingerprint and the first or last verification time for each paired phone. For ongoing checks, remote verification through an account at attestation.app can email an alert if the phone fails to provide valid attestations in time (Source: GrapheneOS). A phone that checks out shows three things:

The project is direct about this: "We are currently not affiliated with or endorse any company selling devices with GrapheneOS," and its official recommendation is to buy a supported device and install GrapheneOS yourself. It says doing so is likely to be a lot cheaper and that the web installer is easy to use (Source: GrapheneOS).

The web installer needs a computer with 2GB of free memory and 32GB of free storage, a USB cable and a supported browser. You enable OEM unlocking, unlock the bootloader, flash the images and lock the bootloader again; unlocking and locking each wipe the phone (Source: GrapheneOS).

The project says redistributed derivatives should use their own branding and be clearly distinct from GrapheneOS (Source: GrapheneOS). So ask any supplier whether the phone runs the official build, which the hash check confirms, with configuration applied as settings and apps on top.

If you buy a phone with GrapheneOS already installed, the FAQ recommends these steps (Source: GrapheneOS):

GrapheneOS focuses on defending against exploitation of unknown vulnerabilities, and adds controls such as auto reboot and Storage and Contact Scopes (Source: GrapheneOS). DatSov names two residual risks that are not removed by any operating system: "the person holding the phone, including if they are legally compelled to unlock it; and the cellular modem with the network's own records".

Both have a basis in UK law. Section 49, in Part III of the Regulation of Investigatory Powers Act 2000, allows a notice requiring disclosure of protected information, for example by handing over a key, in defined circumstances (Source: legislation.gov.uk). Section 87, in Part 4 of the Investigatory Powers Act 2016, allows a notice requiring a telecommunications operator to retain communications data for up to 12 months (Source: legislation.gov.uk). LTE-only mode narrows the cellular attack surface (Source: GrapheneOS); it does not change what the network records.

DatSov states a further limit: attestation proves the software, not the silicon, and DatSov cannot prove a device was untouched before it reached DatSov.

DatSov's Sovereign Phone is Pixel hardware with an official, attestable GrapheneOS build configured by DatSov, plus the monthly DatSov Secure Service. The editions are built on the Pixel 10a, the Pixel 10, and the Pixel 10 Pro XL or Pixel 10 Pro Fold. Every edition ships as a relocked, attestable GrapheneOS install you can independently verify, and the Secure Service includes managed updates with a monthly attestation check.

None of that replaces the checks above. The GrapheneOS project endorses no seller, DatSov included, and you can check the hash and run Auditor on any phone DatSov supplies. A factory reset from recovery wipes all data, including DatSov's configuration, so agree before delivery whether you will reset the phone and reapply the configuration yourself.

Google Pixel is a trademark of Google LLC. GrapheneOS is a trademark of the GrapheneOS project. DatSov is not affiliated with, endorsed by or supported by either. Devices are supplied with official GrapheneOS builds, configured and verified by DatSov.