Built on Android. Hardened at every layer of the operating system. Your private keys live in the device’s secure chip and never leave it. When everything else fails, SOS still works.
EVERY SCREEN, EXPLAINED
The compact preview at the top cycles through the six core screens automatically. Below, the full preview lets you pin one, read what it actually shows, and inspect the four design decisions behind it.
HOME
Your apps, your messengers, your wallet — plus a small set of LyDos apps for sovereign identity, the audit chain, and the emergency mesh.
All Play Store and side-loaded apps run sandboxed — the way Android does it.
ID, Wallet, Messenger, Resilience, Audit — small, signed, auditable.
No ads, no telemetry pop-ups, no dark patterns. This is your home screen.
Work, travel, press — separate profiles with their own permissions and apps.
HOW IT WORKS
Hardware-backed keys you keep · an immune system that watches the OS · updates that require three independent signatures. Without these three, the rest of the stack doesn’t matter. With them, the phone can defend itself.
The private key that proves it’s you stays locked inside the phone’s secure chip. Our servers never see it. To extract it, an attacker would need to physically tear apart the chip — software alone cannot copy it.
Built into the operating system: an immune-system that watches for tampering, anomalies, and impossible behavior. It can quietly downshift the phone into safe mode — or, if needed, full lockdown — while keeping the SOS broadcast alive.
Every over-the-air update has to be signed by three independent roles — release engineering, security, and operations — and its binary hash must match. If even one signature is missing, the phone refuses to install it.
SOVEREIGN IDENTITY
On LyDos, an identity is derived from your device keys: computed offline, identical on every device, owned by no server. The living mesh is the quorum of sovereign engines that vouches for it.
Each face is derived deterministically from a decentralised identifier (DID). No image is stored or fetched — the same seed draws the same avatar on every device, offline.
Identity needs no camera roll — the key is the face.
Drawn on-device from the seed; nothing is uploaded.
One DID renders identically across every LyDos device.
Rotate the key and the identity cleanly re-derives.
STILL ANDROID
LyDos Phone runs on AOSP 15. You keep the Android you know — apps, store, push, ecosystem — but the operating system underneath defends itself and proves itself in ways stock Android can’t.
AOSP 15 base. Every app you already use keeps working — we harden the floor, not the ceiling.
Built on AOSP 15. Play Store sandbox, side-loaded APKs, your messengers, banking, work tools and games run exactly as they do on stock Android — Treble-compliant CTS + LyDos CTS suites pass on every release.
GMS runs as an unprivileged user app, not a system component. Per-profile toggle to enable or disable it. Apps that depend on it stay opt-in; apps that don’t, never see it.
Network, storage scopes, sensors, contacts, location, clipboard — toggleable per app, per session. Defaults are deny. Save profiles (Work · Travel · Press) and switch with one tap.
File-based encryption keys are wrapped by the secure chip, not by your password alone. Lose the chip — lose the data. No offline brute force, no key transfer to another phone.
Thirteen Rust daemons that watch the OS, sign every important decision, and refuse to write when the chain breaks.
Master key sealed in the secure element, ML-DSA-87 signatures. Private bytes never leave the chip; userspace only sees a fingerprint. kslctl exposes counters and rotation jobs.
247 kernel + syscall hooks watched live. State machine: NORMAL → DEGRADED → SAFE → CRITICAL LOCKDOWN. In LOCKDOWN every sovereign write is short-circuited to LsiaVetoed before it reaches the engine.
Every OTA carries a manifest signed by Release + Security + Ops + Compliance officers. M-of-N quorum, role coverage, binary SHA-256 verified twice (controller + agent). Reject is fail-closed — no --skip-checks.
Every important decision (signature, permission, policy, update) is appended to a hash-chained log on a write-once partition. Tamper any entry and the chain visibly breaks at the next boot attest.
Default Settlement Layer is the only path apps can sign through. Audit emit must succeed before KSL signs; if the audit fails, the signature never happens. There is no settled-without-trail path.
Cross-node consistency (GCE) and privacy-preserving pattern federation (GCI). Only hashed signals and /24 IP prefixes leave the device. Raw payloads, emails, user ids — never.
When the cell network drops, the phone keeps talking. Eight independent radio paths, signed cell-broadcasts, kill-switch combos.
Emergency calls and SOS work with no SIM, on any carrier, or with the cellular modem off — over satellite or mesh. AFAD/EU-Alert/WEA cell broadcasts are verified by signature before they reach the lock screen.
Cospas-Sarsat distress, Iridium short-burst, Starlink Direct-to-Cell, 3GPP NTN, LoRa multi-hop, Wi-Fi Aware, Bluetooth mesh, ultra-wideband. SOS routes through whichever is healthiest — auto-failover, no menu.
Disruption-Tolerant Networking transport queues messages on the device and replicates through neighboring LyDos phones when the cell network is gone. Bandwidth scheduled, persisted across reboots.
Boot-completed ResilienceService comes up before the launcher — mesh telemetry never goes dark. Kill-switch combo (vol-down ×3 + power 3 s) wipes the device, but only after the wipe is audited.
Apps that need to trust the phone prove it cryptographically, without learning who you are.
Android Verified Boot + LyDos trusted update + on-device attestation. Each layer signs the next. If any signature breaks at boot, the phone enters SAFE mode automatically and the chain explains why.
Banks and work suites get a remote attestation that this is a real, untampered LyDos Phone with a known boot chain — without learning your DID, your apps, or your location. App identity, not user identity.
DID derived deterministically from the KSL master fingerprint — no central issuer. Halo2 prover runs on-device; the witness never crosses the binder boundary. Prove a fact, reveal nothing else.
Notifications for critical apps go through an on-device signed push channel. No Google Cloud Messaging dependency — your messenger keeps delivering even without GMS, and a spoofed notification is rejected at the channel.
Reproducible builds, signed packages, a status CLI you can run yourself.
factory-img-builder + release-pack-signer produce deterministic factory images. SHA-256 published with the build; compile the source yourself, hash the result, compare. If the numbers don’t match — sound the alarm.
Single command dumps the live state of all 13 engines: KSL counters, LSIA mode, TUP last-verified release, ASR chain head, GCE drift, mesh peers. Read-only, signed output you can paste into a bug report.
ota-delta keeps update bandwidth tiny on satellite links. Officer keys rotated through a documented Faraday-cage ceremony — air-gapped, ed25519 + Dilithium3 hybrid, mode 0400 enforced.
THE 13 ENGINES
Each engine watches the others. If one is silenced, the rest stop writing. If one falsely signs, the chain catches it. We didn’t add features to Android — we added a sovereign nervous system.
Your private key never leaves the Secure Element. Our servers never see it.
Every critical action (payment, OTA install, policy change) requires an on-device signature.
OS-level immune system — automatically downshifts from normal → safe → lockdown on threat.
Kernel-level eBPF veto. In lockdown, every sovereign write is cancelled — SOS still works.
No update installs without three independent signatures (release + security + ops).
AVB rollback index + signed delta patch (≤500 MB) + audit trail emission.
When one phone spots an exploit, all phones learn — without ever sharing your data.
Only SHA-256 hashed patterns + region buckets gossip across the fleet. No IPs. No emails.
Every important decision is recorded in an append-only, hash-chained ledger you can inspect.
Forensic-grade write-once-read-many partition. Chain breaks are alarms.
Critical decisions require 2-of-3 independent nodes to agree. No single point of failure.
Multi-node consensus over a federated network — falls back gracefully under outage.
Layered key hierarchy with the root key locked inside a hardware security module.
Root ceremony requires M-of-N officers; intermediate keys rotate yearly.
Secrets are sealed to your device’s measured state — they refuse to open on a tampered phone.
ARM TrustZone + StrongBox sealing. Remote attestation challenge for sensitive flows.
Every transaction carries a per-transaction proof. Double-entry invariants are enforced live.
Payments require on-device signature + policy gate + custody chain. No silent fallbacks.
Hardware → bootloader → kernel → userspace → app → trust graph. Each layer audits the one below.
If the attestation chain ever breaks at boot, the phone enters safe mode automatically.
Signed + approved + proven = settled. There is no other path. Silent shortcuts are impossible.
Settlement state machine rejects any transaction missing the three required proofs.
Detects state drift between nodes and automatically degrades writes until consensus restores.
Merkle root divergence triggers degraded mode — reads continue, writes pause until safe.
Device-bound credentials and signed manifests keep working even with no internet for weeks.
Signed app manifests + offline policy cache + replay protection.
WHAT IT DOES
Each item below is a real, measurable behavior — tested on real hardware, verifiable by anyone who reads the source. No promises we don’t back with a build artifact.
Early-warning sub-second broadcast pipeline. Pulls from seven independent government sources — AFAD-TR, JMA Japan, USGS, EMSC Europe, KMA Korea, NDMA India, PHIVOLCS — and emits an authenticated alert before the shaking reaches you.
When cell towers fail, your phone keeps talking — through LoRa, Wi-Fi Aware, BLE Mesh, NFC, ultrasonic and FM-RDS fallbacks. Stress-tested by deliberately dropping 60% of nodes in disaster simulations.
If the phone is attacked, lost, locked, or even in its highest security state, the SOS broadcast stays on. No password required. No exception. The screen can be dark, the OS can be frozen — the beacon goes out.
A new patch format trims full Android updates down by 20× — so it actually finishes on satellite or bad cellular. Every patch is signed, hash-checked, size-capped, and refused if anything looks wrong.
All critical signatures use NIST post-quantum standards (ML-DSA, ML-KEM, SLH-DSA). When the cryptographic ground shifts under the industry, this phone is already there. Hybrid mode keeps old systems working.
A real physical switch on Press Edition hardware. Hold a three-second combo to instantly revoke the device key, wipe user data, and seal the audit trail. Used by journalists and human-rights defenders at borders.
Every important decision the phone makes is linked into a hash chain — the kind of forensic record you can take to a courtroom. Manipulation requires breaking SHA-256 retroactively.
Only hashed patterns and region buckets ever leave the device. No raw IP, no email, no phone number, no GPS coordinate. This is not a policy choice — it is enforced at the operating system layer with runtime tests.
We publish the exact source, build flags, and base image for every release. You compile, you hash, you compare to your device. If the numbers do not match — alarm. No backdoor can hide in something you built.
WHEN THE GRID FAILS
Eight independent radio paths, satellite distress beacons, store-and-forward messaging that hops through neighboring phones. Tested in a 7.2-magnitude government earthquake drill — alerts under three seconds, 95% message delivery with 60% of the network gone.
The phone tries them in order, top to bottom. Whichever one connects first wins. If cell towers, internet, and Wi-Fi are all gone, it can still send a satellite beacon — or hop through neighboring phones over LoRa, Bluetooth, and Wi-Fi.
Distress beacon — works anywhere on Earth
Short text and ping
Mainstream texting and light data
Low-power IoT-style messages
Phone-to-phone messages, multi-hop
Short-range mesh + indoor ranging
Crowd-routing in urban areas
Centimeter-accurate location indoors
DISASTER DRILL · GOVERNMENT EXERCISE
COMPARE
GrapheneOS, CalyxOS, /e/OS, NitroPhone, Purism Librem 5, Pine64, stock Pixel. Built from public documentation. No spin. Look up every cell.
| Dimension | LyDos Phone AOSP 15 + LyDos sovereign stack | GrapheneOS AOSP + hardened userspace | CalyxOS AOSP + microG | /e/OS (Murena) LineageOS + deGoogle | NitroPhone (Nitrokey) GrapheneOS pre-installed | Purism Librem 5 PureOS (Linux) | Pine64 PinePhone Pro Multiple distros | Pixel + stock Android AOSP + Google Play |
|---|---|---|---|---|---|---|---|---|
| Hardware kill-switch | Yes | Partial | Partial | No | Yes | Yes | Yes | No |
| Update signing model | 3-signature quorum | Single key | Single key | Single vendor | Single key | User-signed | User-signed | Single vendor |
| Cross-device immunity | Hashed only | None | None | Opt-in telemetry | None | None | None | Opt-in telemetry |
| Post-quantum crypto | Shipping | Planned | None | None | Planned | None | None | Planned |
| Reproducible build | Verified | Verified | Partial | Partial | Verified | Partial | Partial | None |
| Automatic immunity | Kernel-level | Sandbox only | Sandbox only | Sandbox only | Sandbox only | None | None | Sandbox only |
| Journalist mode | First-class | Manual install | Manual install | Manual install | Manual install | Manual install | Manual install | None |
Sources: LyDos Phone → this site · GrapheneOS → grapheneos.org · CalyxOS → calyxos.org · /e/OS (Murena) → murena.com · NitroPhone (Nitrokey) → nitrokey.com · Purism Librem 5 → puri.sm · Pine64 PinePhone Pro → pine64.org · Pixel + stock Android → android.com
DEVICES
One software, multiple hardware paths. Pixel 8 Pro and Pixel 9 Pro are the first developer and activist devices. Fairphone 6 build is in partner testing for Europe. The clean-sheet reference device — open secure element, dual satellite, removable battery — is in design.
First fully sovereign Android — signed updates already shipping.
Second wave — adds hardware-attested secure element flow.
Sibling to the 9 Pro — same software, smaller body.
Partner build paused on vendor source release. We will not ship without it.
OPEN STANDARDS
No closed protocols. Every layer uses public NIST, IETF, OASIS, 3GPP, IEEE, and ISO standards. You can audit what we built — because what we built was already published.
TRANSPARENCY
Every release ships with deterministic build instructions and a signed manifest. Compile the source yourself, hash the result, compare to the image on your device. If the numbers don’t match — sound the alarm.
REPRODUCIBLE BUILD · LIVE PROOF
# Clone the public manifest, sync, build, verify. git clone --depth 1 https://git.lydos.ailydian.com/lydos/lydos-phone-manifest -b husky-2026.06.r1 repo init -u . && repo sync -j8 . build/envsetup.sh && lunch lydos_husky-user # Build the same image, then check the hash of your build against ours. m -j$(nproc) target-files-package ./verify-bundle.sh out/dist/lydos_husky-target_files-*.zip # expects: build_sha256 == published_release_sha256
If your build does not produce the same hash as the published release, the image on the device did not come from this source. That is the alarm. There is no other path.
WHERE WE ARE
The sovereign core and the emergency mesh are live and tested. The user-facing apps and the satellite stack are being polished now. The reference device, the independent audits, and the public launch are ahead.
On-device key sovereignty, self-immunity engine, three-signature updates, federated immunity, audit ledger — all live.
Earthquake alerts in under three seconds, eight-radio fallback (LoRa, Bluetooth, Wi-Fi Aware, satellite), tested in disaster drills.
Launcher, messenger (Signal + post-quantum + mesh + satellite), wallet, on-device AI, audit viewer — under polish for the beta.
Iridium, Starlink Direct-to-Cell, 3GPP non-terrestrial, Cospas-Sarsat — unified behind one secure tunnel.
Talk to cars (CAN, OBD-II), drones (MAVLink), boats (NMEA + AIS), smart-home (Matter + Thread), industry (OPC UA, BACnet).
Open-silicon secure element (OpenTitan), physical-unclonable identity, side-channel-resistant cryptography, hardware kill-switch.
A new device designed from the ground up: open secure element, dual satellite, removable battery, Faraday liner option.
Citizen Lab, Amnesty Tech, EFF — independent verification before public launch. Academic papers planned for USENIX, IEEE S&P, DEF CON.
First public availability at Mobile World Congress 2027. Enterprise pilots open earlier; press and human-rights program even earlier.
SOFTWARE PHASE · W1 — W18
The software phase closed in eighteen public sprints, each with a dated report in docs/SPRINT_W*.md. What follows is the public record of what shipped.
SOVEREIGN APPS · W5 — W10
Every sovereign app talks to a real HAL via binder. When the HAL is absent, a typed sentinel returns failure — never a canned success. The full slot table is frozen by a pytest CI gate.
Verifiable credentials. Halo2 proofs. No PII crosses the binder.
Scenario · journalist crossing a border
Border control wants to know you are over 18. You hand them a zero-knowledge proof that says so — without your birthday, without your name, without a phone-number lookup. The verifier sees a 32-byte challenge response, nothing else.
EVM + Lightning. KSL device signature. ASR audit-before-settle.
Scenario · humanitarian field officer
You are paying a local supplier 15 000 sats over a satellite link. The wallet signs the payment via the on-device DSL HAL → ASR audit emits the chain entry before the transaction returns success. If audit fails, the signature aborts — never a settled-without-trail payment.
Hybrid PQ signing. Multi-lane transport. LSIA lane veto.
Scenario · source in a hostile network
Your story is meeting an editor for the first time. Cell network is poisoned, Wi-Fi is sniffed. The messenger routes the envelope through LRM mesh + Iridium SBD, signs with the KSL device key, and falls back lane-by-lane. If LSIA flips to lockdown mid-send, the envelope queues — never gets delivered through an untrusted route.
Read-only view onto the ASR ledger. Chain verify off-device.
Scenario · compliance officer
An auditor asks: show me every kill-switch arm event in Q2. You hand them the hash-chained ASR ledger. They pull a single tip hash, verify the entire chain offline, and confirm not one entry was rewritten — the device proves its own history.
TUP role-quorum install. ASR audit emit BEFORE the install bit flips.
Scenario · OS engineer pushing an update
A 3-MB application package arrives. The registry hands it to ITupHal::verifyManifest. Three signatures (Security + Operations + Release) must all check, the publisher fingerprint must not be on the revocation list, the package SHA-256 must match the manifest, and an ASR audit must emit before install — if any single step fails, the install collapses.
On-device inference first. PII redacted. Federation needs KSL signature.
Scenario · user asking a private question
You ask a personal question that includes a phone number and an email. The PII redactor strips both before the prompt ever enters the IInferenceHal binder. On-device llama daemon answers from a TUP-signed local model. If you choose federation, the request body's SHA-512 digest is KSL-signed; the federation endpoint receives only the redacted prompt + signed digest header.
GMS surface replaced by sovereign attestation. Caller UID never spoofed.
Scenario · developer running a 3rd-party app
A bank app needs Play Integrity attestation. The sandbox does NOT call Google — it returns a locally-issued integrity token via IKslHal attestation. PermissionBroker resolves the caller UID through Binder.getCallingUid() (kernel-supplied — caller-claimed UID is ignored), runs the PermissionShim matrix, and either delegates to system or denies silently.
Lock-screen replacement. Mesh telemetry. Kill-switch combo.
Scenario · press device under panic combo
Border guards demand you unlock. You hold power, tap volume-down three times within two seconds, keep holding for three more seconds. A kernel-side daemon emits HARDWARE_KILL_COMBO. The receiver checks the Press lock state, emits an ASR audit FIRST, then revokes the device key via IKslHal::deleteKey. The device can no longer sign anything — even its own factory reset.
Mode-aware home. SystemProperties cache. App-launch policy gate.
Scenario · everyday user
Your home screen shows what the device is actually doing. The status chip on top reflects LSIA mode in real time. The launcher subscribes to ModeBroadcastBus — when the immune system flips to safe mode mid-day, your sovereign tiles get a soft red border and the federation-dependent tiles dim out.
SHIPPING PIPELINE · W11 — W18
factory-img-builder produces a deterministic manifest hash. release-quorum collects three role signatures and proves the build is reproducible. lyd-flasher verifies the bundle on the device before the first partition is touched.
SCENARIO REELS
Side by side: what stock Android does, what LYDOS does. Same hardware. Same network. Different invariant.
VERSUS STOCK ANDROID
Honest comparison — Pixel, Samsung, GrapheneOS, CalyxOS. Highlighted rows are the ones we believe matter most for journalists, NGOs, and at-risk operators.
| Feature | LYDOS | Pixel | Samsung | GrapheneOS | CalyxOS |
|---|---|---|---|---|---|
| Master signing key location | OpenTitan SE, sealed | Titan M2, vendor-controlled | Knox vault, vendor-controlled | Titan M2, vendor-controlled | Titan M2, vendor-controlled |
| Update signature quorum | 3-role (Security + Ops + Release) | 1-party (Google) | 1-party (Samsung) | 1-party (Graphene) | 1-party (Calyx) |
| Audit ledger | Hash-chained ASR HAL, on-device export | Not user-visible | Knox attestation logs, vendor-held | Not user-visible | Not user-visible |
| GMS surface | Replaced by sovereign attestation | Full Play Services | Full Play Services + Samsung | Sandboxed Play | microG |
| Hardware kill-switch combo | vol-down + power × 3 + 3 s hold → KSL key revoke | Power × 5 = emergency call | Power × 3 = camera | Not present | Not present |
| Emergency mesh | 8 paths (sat / LoRa / Wi-Fi Aware / BLE mesh / UWB / 3GPP NTN / Iridium / Cospas-Sarsat) | Satellite SOS (US only) | Satellite SOS (US only) | None | None |
| On-device AI federation | KSL-signed, allow-listed endpoints | Gemini cloud, vendor-controlled | Galaxy AI cloud, vendor-controlled | Disabled | Disabled |
| Locale parity | TR · EN · AR · RU · FA, full key parity | 100+ locales, partial parity | 100+ locales, partial parity | EN-only with community translations | Mixed |
| Reproducible build proof | repro-status CLI · CI gate | Partial (since Android 14) | No | Yes, periodic | Best effort |
| Public CI gate count | 177 frozen assertions (13 pytest + 164 cargo) | Internal only | Internal only | Selected build verifications | Selected build verifications |
CI GATE EVIDENCE
Every gate is in tools/ and sovereign-templates/*/cargo test --lib. Anyone can clone the repo and run them.
tools/aidl-slot-check/test_slots.py · 3tools/i18n-audit/test_parity.py · 2tools/telemetry-smoke/test_pipeline.py · 4tools/press-edition/test_combo.py · 4lyd-flasher38factory-img-builder32release-quorum35telemetry-pipeline53press-hardware-combo6field_mismatches : 0 · policy_violations : 0 · extras_only_in_left : [] · extras_only_in_right : []
GLOBAL MESH — NO NODE STANDS ALONE
Below the apps and the engines sits a federation layer: twelve Rust crates that let LyDos phones discover each other, agree on what is true, carry an alert across a dead grid, and vouch for one another's audit history. Only hashed patterns and region buckets ever cross the wire — never an IP, an email, or an identity.
peer-discovery → roadmap-pin, all Rust, all shipped
hashed patterns + region buckets only (KURAL 23)
alerts and ledgers need independent witnesses, not one node
Finds nearby sovereign phones through signed announce packets — and rejects the fakes.
A spoof detector scores every announce; unsigned or replayed beacons never enter the peer registry.
Two phones prove who they are to each other before a single byte of mesh traffic flows.
Challenge-nonce mutual auth + capability negotiation, anchored to a KSL-signed session — no anonymous peers.
Every peer earns a trust score from how it actually behaves on the mesh.
Behavioural metrics drive a trust evaluator; a misbehaving node is moved to quarantine state and shed.
Mesh sessions are short-lived and rekey themselves — a captured key dies in minutes.
Bounded session lifetime + scheduled rekey + revocation list; a revoked peer is cut mid-stream.
Carries a message across many hops when no single phone can reach the destination.
Every hop adds its own signature and a loop detector kills cycles — a tampered relay path is provable.
Remembers good paths so the next message takes the fast route instead of re-flooding the mesh.
Path records keyed and aged out by signed invalidation signals — stale routes can't linger.
Spreads an emergency alert across the whole region in seconds — once, not a thousand times.
OASIS CAP envelopes fan out under a multi-witness quorum; a dedupe window stops alert storms.
One federation can cryptographically vouch for another's audit history.
Cross-federation Merkle witness receipts with a dispute window — a forged history is challengeable.
When something attacks the fleet, the whole fleet has a tamper-evident record of it.
Federation-wide incident chain exported into ASR; events are hashed, never raw (KURAL 23).
Produces signed proof of regulatory compliance without leaking the underlying data.
Framework-aware attestation signer emits a disclosure pack governed by an explicit retention policy.
Watches whether the federation keeps its delivery and latency promises.
Delivery counters + a latency histogram feed an SLA evaluator; a blown quorum budget raises the alarm.
The federation agrees, by consensus, on exactly which build each region may run.
A signed pin manifest fixes the module + release window so no region drifts onto an unapproved build.
QUESTIONS
No. Hardened forks rebuild Android with stricter defaults. LyDos Phone goes deeper: thirteen security engines and seven hardware interfaces underneath the OS turn the device into a sovereign node that produces its own proofs. We track GrapheneOS upstream and reuse what already works — we don’t replace it, we build on top of it.
Yes. The master private key lives inside the secure chip (Titan M2, StrongBox, OpenTitan). Our servers never see it. Every critical action — payments, OTA installs, policy changes — requires an on-device signature. If we wanted to steal your key, we couldn’t — by design.
Yes. The SOS path stays open in every security mode — normal, degraded, safe, or even critical lockdown. No password needed. If the device is stolen, the user is unconscious, or the screen is unresponsive, the emergency beacon still goes out through whichever radio is alive.
The phone tries eight alternatives in order: Cospas-Sarsat satellite distress beacon → Iridium → Starlink Direct-to-Cell → 3GPP NTN → LoRa mesh → Wi-Fi Aware → Bluetooth mesh → ultra-wideband. Messages can hop from phone to phone through delay-tolerant networking — they will reach the world even if your local infrastructure is gone.
No. All satellite traffic is wrapped in a sovereign tunnel with post-quantum + AEAD encryption and an on-device signature. The carrier sees an opaque, signed packet — not its content. The federated immunity layer only shares hashed patterns and region buckets — never your IP, your email, or your location.
Reproducible builds. We publish the exact source, build flags, and base image for every release. You compile, you hash, you compare to the device’s real image. If the numbers don’t match — alarm. Independent verifiers like Citizen Lab and EFF are part of the launch.
Every OTA needs three independent signatures (release, security, ops), a manifest, and a matching binary hash. If even one key is stolen, the update is still blocked. We also use delta updates (≤500 MB) instead of full 4–8 GB images, so updates finish over satellite or weak cellular.
First on Pixel 8 Pro, then Pixel 9 Pro and Pixel 9. A Fairphone 6 build is in partner testing for the European market. A clean-sheet reference device — open secure element, dual satellite radios, removable battery, optional Faraday liner — is the long-term target.
Beta lists open for select journalists, human-rights defenders, and developers first. The full sovereign core is already in production; the user-facing apps and satellite stack are being polished now. Mobile World Congress 2027 is the public unveiling.
We really don’t. The signup form sends a 32-byte random token from your browser plus a region bucket — nothing else. No email, no IP, no IMEI, no phone number, no location. The privacy policy is enforced at the operating-system layer by an automated test that fails the build if raw data ever leaks.
JOIN THE LIST
To recognize you on launch day, all we need is a one-time random token your browser generates locally — plus the broad region you’re in. No email, no IMEI, no IP. You’ll be told two weeks before beta units ship.
To recognize you on launch day we ask for two things only: a random one-time token your browser generates locally, and the broad region you’re in. No email, no IMEI, no IP. Ever.
▸ 32-byte random token generated in your browser · payload is the token + region only · no other data leaves your device