Hermes — hardened mobile deployment
From $2,500 per engagement. A Pixel running GrapheneOS, compartmented, attested, and handed over with the training to keep it that way.
You are buying expertise, not hardware. You buy the phone. We do not mark up devices, hold stock, or have any interest in what you paid for it.
Why this is a service and not a wiki page
The flashing instructions are free and public. Almost nobody in a leadership role is going to follow them, and that is a rational decision rather than a failure of nerve — the install is the easy part.
What is hard is everything after: deciding what lives in which compartment, knowing which convenience feature quietly re-opens the thing you closed, proving the device is still the device you set up, and being able to rebuild it under pressure without losing the accounts it holds. Those are judgement calls, and getting one wrong produces a phone that feels hardened and is not.
What gets built
Five compartments, not one locked box. Work, personal, untrusted, and two purpose-built profiles. Cross-profile leakage is the failure mode that actually happens, so the boundaries are designed first and the apps are placed into them second — not the other way round.
Remote attestation. The device periodically proves to you that its boot chain and OS are unmodified. Without this you have a hardened phone you believe is still hardened. With it, tampering produces an alert instead of a silence.
Hardware security keys, not codes. Critical accounts are promoted from one-time codes to physical keys, enrolled in pairs so losing one is an inconvenience rather than a lockout.
Data at rest, actually at rest. The device auto-reboots after 18 hours idle, which returns everything to the pre-first-unlock state. A phone seized on a Friday is not sitting warm all weekend.
A printed recovery card. Paper, kept with the backup key. It is a map, not a key — it contains no passwords, so somebody who steals it learns your procedure and gains nothing. Written on the assumption that the person reading it remembers nothing, because the moment you need it is the moment you are least able to think.
Training, and a rehearsal twice a year. A control nobody has practised is a control nobody has.
The part that proves it works
On 17 August 2026 our own reference device was destroyed by accident. A duress PIN was entered by mistake in the untrusted profile. The keys were wiped instantly, every profile went, and the phone presented as corrupted storage — which is exactly what a genuine hardware failure looks like, because recovery cannot tell the two apart.
Nothing was recoverable. Nothing needed to be.
It was rebuilt the same afternoon, in about three hours, with no account lost, because the recovery design assumed this would happen. That is the difference between a hardened phone and a hardened practice: the first one survives until something goes wrong.
We tell you this rather than a case study with the names changed, because a recovery procedure nobody has actually executed is a document, not a capability.
The duress PIN is a real feature with a real edge, and it wipes every profile rather than the one it was typed into. Whether you should have one enabled is a conversation we will have with you, not a default we will set quietly.
What this is not
Not a burner phone. It is your daily device, hardened. If you want something disposable, you do not need us.
Not anonymity. It reduces what your device leaks and what a thief or an opportunist can reach. It does not make you unattributable, and anyone selling you that is selling you something they cannot prove.
Not a licence to skip the boring controls. A hardened phone attached to a mailbox with no second factor has moved the problem, not solved it.
Scope and price
From $2,500, scoped per engagement. The variables are how many devices, how many people need training, and whether you want the recovery drill run with your team or documented for them.
Adjacent work — the sovereign network edge and the portable secure workspace — is on the sovereignty page, and is at specification stage rather than orderable.