Bern · Basel · Zurich · Geneva
A Google Pixel with GrapheneOS, set up and checked by us and handed over in person. Your data stays encrypted. Camera, microphone, radio and cable are under your control.
Protection in seven layersTap
Step 01 / 07
Titan M2 security chip
The keys to your data depend on the chip and on your PIN. The chip slows down wrong entries. The emergency PIN wipes the device.
Step 02 / 07
Verified start
7F3A 09BC E41D 5A2CSignature matchesAt every start the device checks, starting from the hardware, that the system is unchanged.
Step 03 / 07
GrapheneOS
A hardened system without advertising and analytics services. If the device stays locked for long, it restarts and seals the data again.
Step 04 / 07
Separate profiles
Everyday life and confidential matters with their own apps, data and keys. An ended profile is encrypted again. Separation, not a hiding place.
Step 05 / 07
Permissions, radio and cable
You control camera, microphone and radio one by one. On a locked device USB-C passes power only.
Step 06 / 07
Protected connection
With Gold the confidential profile only goes online encrypted. If the connection drops, there is no network instead of unprotected data.
Step 07 / 07
Messenger without a number
Meet at 2 pm?No phone number, no email, no ID. A message is readable only for you and the recipient.
01Why
A standard device keeps sending data to manufacturers, ad networks and companies you have never met. Most of the time you notice nothing.
An OpSek device is set up to report as little as possible to the outside. What you store and write stays encrypted. Only someone with the key can read it.
Move your mouse over it.Drag your finger across it. Your key sits under the lens. Only with it does the message become readable.
Example from three points of view: with your key the message is readable. The messenger's provider sees only encrypted characters and no phone number. After a restart the key is not in memory, and without your PIN everything stays encrypted.
02What you get
A new Google Pixel from Swiss retail, set up from scratch. Every device is checked individually before it is handed over.
A handbook for your setup. It explains what runs on your device, why it is set up that way and what to watch for in everyday use. Made for looking things up, not for reading once.
Anyone who has a device from us belongs to it. Your questions and experiences are welcome, and we keep building this together.
03The layers
Scroll down: the device builds up from the bottom, from the chip as its foundation to the message at the top. Each layer protects something different. Each one also says where its limit lies.
Layer 01 Foundation
Everything starts in the hardware. The keys to your data depend on the Titan M2 security chip and on your PIN. The chip slows down wrong PIN entries with growing wait times. A second PIN, the emergency PIN, wipes the device immediately and irreversibly if you wish, including the eSIM.
LimitA short PIN is guessed quickly. At handover we show you how long it should be.
Layer 02 Hardware checks software
At every start the device checks, starting from the hardware, that the system is unchanged (Verified Boot). At handover we check the signature together with you, so you can see that nobody changed anything in between.
LimitThe check says the system is genuine. It says nothing about apps you install later.
Layer 03 GrapheneOS
GrapheneOS is open source and hardened against attacks. It runs without advertising and analytics services. Updates arrive signed. If the device stays locked for long, it restarts and seals your data again. Apps that demand Google services run in a sandbox if you want them to.
LimitA device without updates ages. Install them when they arrive.
Layer 04 Separate spaces
Everyday life and confidential matters run in separate profiles, each with its own apps, data and key. We set up two. GrapheneOS allows up to 32, for example one for travel or one for an app you do not trust. When you end a profile, its apps stop and its key is wiped from memory.
Everyday active · other profiles ended
LimitA profile is separation, not a hiding place. Anyone holding your unlocked device sees the profiles.
Layer 05 You decide
Every app gets only what it needs. Camera, microphone, location, network and sensors are released one by one, and one tap switches camera and microphone off completely. NFC and Bluetooth are off from the start, and Wi-Fi and Bluetooth switch themselves off after a while. In every Wi-Fi network the device shows a new address. On a locked device the USB-C port passes power only, no data.
LimitAn app you grant a permission can use it. And your mobile provider still sees where your device is registered.
Layer 06 With Gold
With Gold the confidential profile only goes online through an encrypted connection (VPN, 12 months included) and is also routed through several stations. If the protected connection drops, the profile has no network instead of sending unprotected. With Base you decide per app whether it may go online at all.
LimitThe provider of the encrypted connection sees where you connect to. Anyone who signs in somewhere with their name is still recognisable there.
Layer 07 At the top
A messenger that needs no phone number, no email address and no user ID. Your contact keys are created on the device and stay there. Messages are end-to-end encrypted and travel through servers that are independent of each other. There is no central account and no directory of all users. With Gold it runs in the confidential profile only through the protected connection, and messages disappear after a set time.
LimitWhoever you write with can read your messages. A screenshot on the other side cannot be prevented.
04On the way
A message is encrypted on your device and only opened again by the recipient. On the way in between, relay points see nothing but unreadable characters.
In the diagram, messages travel through changing relays. On the way the content stays encrypted. It is readable only on the two devices.
LimitAnyone reading at the start or the end of the route, for example on the recipient's device, sees the message in plain text. Encryption protects the route, not the ends.
05Compared
GrapheneOS runs on the same Pixel hardware as regular Android. The difference lies in the system: more protection against attacks, more control, no telemetry. Here is the comparison with the Pixel as shipped and the iPhone, point by point, including where the others are ahead.
Android
Pixel as shipped
7 / 26 · Yes in this selection
iOS
iPhone
5 / 26 · Yes in this selection
GrapheneOS
Pixel, set up by us
22 / 26 · Yes in this selection
| Feature | Android | iOS | GrapheneOS |
|---|---|---|---|
| Hardware | |||
| Security chip protects keys and slows down PIN guessingPixel: Titan M2 · iPhone: Secure Enclave | Yes | Yes | Yes |
| Memory protection against attacks across the system (MTE)Android: supported apps only, with Advanced Protection · iOS: latest iPhone chips only | Partly | Partly | Yes |
| USB-C data access lockable in steps, charging only while locked by defaultAndroid: with Advanced Protection · iOS: blocked after one hour | Partly | Partly | Yes |
| Device authenticity verifiable with an app (hardware attestation) | No | No | Yes |
| Encryption | |||
| Data encrypted (AES-256) | Yes | Yes | Yes |
| Separate profiles with their own keyiOS: no profiles | Yes | No | Yes |
| Access protection | |||
| Emergency PIN wipes the device including the eSIM | No | No | Yes |
| Automatic restart freely adjustable, after 18 hours by defaultAndroid and iOS: fixed at 72 hours, Android only with Advanced Protection | Partly | Partly | Yes |
| Fingerprint plus PIN as two factors | No | No | Yes |
| PIN pad in random order | No | No | Yes |
| Up to 32 separate profilesAndroid: multiple users possible · iOS: no profiles | Partly | No | Yes |
| Exploit protection | |||
| Hardened memory allocatoriOS: its own hardening | No | Partly | Yes |
| Hardened kernel, no loading of code at runtimeiOS: in Lockdown Mode | No | Partly | Yes |
| Exploit protection adjustable per app | No | No | Yes |
| Privacy | |||
| No telemetry in the systemiOS: analytics can be switched off | No | Partly | Yes |
| Block network access per appiOS: mobile data only | No | Partly | Yes |
| Block sensors per app | No | No | Yes |
| Apps only see the files and contacts you releaseAndroid: photo picker · iOS: limited access | Partly | Partly | Yes |
| Google services only as a normal app, without special rightsAndroid: deep in the system · iOS: not applicable | No | Not applicable | Yes |
| New Wi-Fi address for every connection | Partly | Partly | Yes |
| No traffic leaking past the VPN | Partly | Partly | Yes |
| Own servers for time and connectivity checks instead of the manufacturer | No | No | Yes |
| Everyday use | |||
| Every banking app runsGrapheneOS: many, not all | Yes | Yes | Partly |
| Contactless payment with the phoneGrapheneOS: Google Wallet does not work | Yes | Yes | No |
| Find my device and activation lockGrapheneOS: deliberately without | Yes | Yes | No |
| Wide choice of devicesiOS: iPhone only · GrapheneOS: Pixel only | Yes | Partly | Partly |
Partly limited or only with an extra mode (Advanced Protection, Lockdown Mode) · No not found in the official documentation · – not applicable
LimitIn everyday use the others are more convenient: not every banking app runs, contactless payment with Google Wallet does not work and there is no find-my-device. We check whether your apps run before you buy.
As of 27 October 2026. Based on the official documentation of GrapheneOS, Google (Advanced Protection) and Apple (Platform Security). Features can change with updates.
06Base and Gold
Base contains all seven layers. Gold extends the sixth and also protects where your confidential connections go.
For anyone who wants to keep everyday life and confidential matters cleanly apart.
For anyone who communicates confidentially for work or travels often.
What do you want to protect?From whom?What happens if it goes wrong?
Security people start with these three questions. If your concern is data collectors and keeping everyday life apart from work, Base is enough. If you travel for work, or you do not want your provider to see where your confidential connections go, take Gold. If you expect targeted attacks by well-resourced adversaries, no device is enough on its own. Then write to us first.
07Process
You write to us, ideally from a separate address that does not carry your name.
We clarify what you want to protect and whether Base or Gold fits.
We buy a new Pixel from Swiss retail.
Set up and checked in a fixed procedure, within 5 to 10 working days.
In person in Bern, Basel, Zurich or Geneva, or insured shipping. We check authenticity together, and you set your own PINs.
08Honestly
Against targeted attacks by well-resourced adversaries a device helps, but it is not enough on its own.
Profiles separate. They do not hide that they exist.
Your mobile provider sees where your device is registered, even with Gold.
Your PIN, your updates and the apps you install help determine how secure the device stays.
09Who it is for
10Data sheet
AES-256-XTSAES-256-CTSSources: grapheneos.org/features, grapheneos.org/faq, Google Store. As of October 2026. Features can change with updates.
11FAQ
Your question missing? Write to us, we reply personally.
Ask a questionMost of them, yes. Apps that demand Google services run in a sandbox if you want them to, with normal app permissions. It is best to install them in the everyday profile, not the confidential one.
No. You set all PINs yourself at handover. We do not see them and we store nothing of your content.
Tell us briefly what you need it for. You will get a reply with an offer for Base and Gold.
OpSek is a one-time sale. In return you get the manual to keep and access to the community, where questions are welcome.
No. The device arrives fully set up. At handover we go through the most important steps together.
12Who we are
People who take digital security seriously. The core is in Bern, Basel and Zurich. Around us, more people work on the same questions, from IT, from university and from practice. There is no hierarchy, only a shared conviction: a smartphone should work for you.
You do not have to buy anything to be part of it. If you want to think along or build along, write to us. You need no technical knowledge, it is enough that you ask the same questions.
Join in13Accessories
No shop and no obligation. If you would like something tangible to go with the device, you can ask for it. We settle prices and availability in conversation.
Accounts · always twoPair only
What does that mean?Two small keys for your online accounts, like a house key and a spare. Without the key nobody gets into the account, not even with your password.
Radio · pouch
What does that mean?A pouch that shields radio signals. Like an envelope made of metal: what lies inside does not transmit to the outside.
Screen · film
What does that mean?A film for the screen. From the front you see everything, from the side it goes dark. Whoever sits next to you cannot read along.
All together
Key pair, shielding pouch and privacy screen as a set. Can also be requested without a device.
14Contact
A click does not open an email. It opens a short guide first on how to write to us with as little data as possible.
Interested in a device, a question or just a conversation. We reply personally.
TipDo not write to us with your name and your main address. The short guide behind the address explains how. None of it is mandatory.