Aegis Hardening Suite
Duress-aware protection that layers on top of GrapheneOS. If your phone is taken — snatched, seized, or handed over under pressure — 28 standing defenses make sure your data doesn’t go with it.
Buy the Aegis licence
Lifetime licence for one device, 12 months of updates, installer kit and setup guide delivered by email. No account needed.
Three steps to a hardened phone
Buy the licence
One-off payment of £99. The installer kit and setup guide are emailed to you — no account, no subscription, no activation server.
Run guided setup
Around 30 minutes on your own Pixel: the installer arms the suite, generates your duress PINs and recovery sheet, and applies every protection.
Carry it without fear
The suite runs silently underneath GrapheneOS. Verified boot stays intact, updates keep flowing, and every defense stands armed.
Self-wipe triggers
A wipe starts in seconds — no countdown, no warning, no way to tell it apart from a normal unlock.
Trigger a self wipe
Any duress input wipes the phone instantly and silently. There is nothing displayed, nothing logged on screen and nothing an observer can do to interrupt it once triggered.
Multiple duress PINs
Devices come preset with several randomised duress PINs. An adversary can never know which entry is the real one, so brute-forcing the OS lock screen has no safe outcome for them.
Quick wipe
Press the power button eight times in quick succession to wipe — even with the screen locked. Works from a pocket, in a scuffle, one-handed.
Remote wipe
Text the phone a secret code from any other phone — a burner, a friend’s handset, anything that can send an SMS — and it wipes on receipt.
Automated wipes
Timers watch the device so you don’t have to. Thresholds are set during guided setup and changeable only from the private profile.
Lock timer
Wipes if the phone isn’t unlocked within the time you set — two weeks, two days, two hours. If you are separated from it for longer than that, its data shouldn’t survive.
Network-loss timer
Cut off from every network for too long — a signal-blocking bag, a dead-zone holding cell — and the device wipes. Silence is treated as a threat, not as a coincidence.
Incorrect password wipe
Wipes after the number of wrong PINs you choose. A blank attempt isn’t counted, so pocket dials and accidental taps won’t burn the device.
Anti-adversary countermeasures
Every classic move an attacker makes — snatching, probing, pulling power, freezing — has a scripted response.
Anti-snatch lock
The instant the phone is grabbed from your hand, the screen turns off and the device locks. What they are holding becomes a locked brick.
Decoy VAULT app
A fake app called VAULT sits on the everyday profile’s home screen. Anyone who opens it looking for your hidden files wipes the phone instead.
Battery-removal protection
Pulling the battery to stop the timers won’t work: when power returns, the removal is detected and the device wipes on boot.
Temperature & voltage monitoring
Freezing attacks and voltage tampering trigger a reboot back to the fully locked state, closing the cold-boot window while the hardware is exposed.
Attack window reduction
The Owner profile automatically reboots every six minutes — locked or unlocked — preventing ongoing exploit attempts. The hidden user profile is unaffected.
Wireless charger detectionoptional
Reboots the device upon detecting a wireless charger, blocking charger-based injection attempts before they get a session to work with.
High-risk mode
Have to hand the phone to someone for a short period? High-risk mode forces a bootloop with a continuous error message for a timeframe you set — then recovers by itself.
Security hardening
The port charges, nothing mounts, nothing calls out. Extraction tooling finds a device with no interfaces left to talk to.
Safe boot disabled
Prevents booting a modified state that could be used to bypass wipes — the recovery path an attacker would reach for first is closed.
Developer mode disabled
No developer options and no debugging surface. The most common first step of an on-device attack simply isn’t there to take.
USB data disabled
The port only charges. Data-extraction tools connect by cable, so they find nothing to talk to when they do.
Screenshots & screen recording disabledoptional
Prevents any screenshots or recordings, on either profile. A session on the device can’t be captured and exfiltrated while it happens.
Camera & microphone disabledoptional
Disables the camera and microphone so nothing can be seen or heard through the device while armed.
Physical media mounting disabled
Prevents any fake-media mounting exploits — rogue drives and implants have no mount path into the system.
2G blocked, LTE forced
Prevents fake cell towers from forcing the device onto weaker 2G connections. LTE only, always, with no downgrade path.
NFC disabled
Turns off contactless communication so nothing can be read from — or pushed to — the device by tapping it.
Backups disabled
No copy of your data can be kept anywhere a wipe cannot reach. What wipes, wipes everywhere.
App installs blocked on Owner profile
No installations or app updates on the Owner / Admin profile — no malware, no extraction tools. Your private profile is unaffected.
Private profile & network
What an adversary sees is not where your life is. The everyday phone is a stage set.
Private profile
A separate profile with your real apps and data, opened only by your secret code. It never appears in the app list, the switcher or the settings.
Hidden login
Unlock the private profile through the calculator or another secret method you choose — there is no visible way in.
Locked-down settings
The everyday profile shows no other users or apps, and its settings can’t be changed from that profile.
VPN kill switch
Mullvad VPN with its kill switch enforced: nothing leaves the phone outside the VPN tunnel, ever — not DNS, not telemetry, nothing.
What happens when it matters
Six situations, six scripted responses. This is the suite doing its job.
The phone is snatched in the street
Anti-snatch lock blacks the screen the instant it’s grabbed, and a duress PIN wipes it the moment the lock screen is tried.
You’re forced to hand it over for a while
High-risk mode bootloops the device with a continuous error message for the window you set — then recovers on its own.
It disappears into a signal-blocking bag
The network-loss timer counts down in the dark and wipes at the threshold you configured.
Someone hunts around for hidden files
They find VAULT sitting on the home screen. Opening it wipes the phone — the decoy is the trap.
The battery is pulled to stop the timers
Power-loss detection catches it: the device wipes on next boot, timers or no timers.
A cable or charger gets plugged in
The USB port is charge-only, and wireless charger detection reboots the device before anything can establish a session.
Frequently asked questions
Is this legal to use?
Yes. Aegis configures protections on a device you own, against theft, loss and coercion — the same category as remote wipe or Find My Device, just far more thorough. It operates only on your own property and never interferes with anyone else’s device or data. How you use the protections is your responsibility as the owner.
What exactly do I get for £99?
A lifetime license for one Pixel, the installer kit and setup guide delivered by email, all 28 defenses including every optional toggle, 12 months of suite updates tracked against GrapheneOS releases, priority email support, and the 14-day refund policy. No subscription, no renewal fee, no activation server phoning home.
Does Aegis survive GrapheneOS updates?
Generally yes — the suite is versioned against the GrapheneOS release channels and re-arms itself after an OS update. A major version jump may ask you to re-run a short re-arm step; the installer walks you through it, and updates within your first 12 months are covered by the license.
What if I forget my own PINs?
Guided setup generates a recovery sheet for your owner credentials — store it somewhere safe and offline. The duress PINs deliberately have no recovery path: that is the entire point of them. If a duress PIN is entered, the device wipes; that is what you asked it to do.
Can I remove or disable Aegis later?
Yes — from the private profile with your owner code, or by re-flashing the device entirely. What nobody can do is silently disable it from the everyday profile: there is no visible settings surface there to change, and no app list entry to uninstall.
How does remote wipe reach a phone with data off?
The wipe code travels as an ordinary SMS over the cellular network, so mobile data being off doesn’t matter — any phone that can send a text can trigger it. If the device is fully offline, such as inside a Faraday bag, the network-loss timer takes over and wipes after the threshold you set.
Why is checkout through PayPal?
So your payment details never touch our servers — PayPal processes the entire transaction and tells us only that it completed. Where your account and region allow it, PayPal also takes card and bank payments directly.
Your data leaves on your terms — or not at all
28 defenses. 9 independent wipe paths. One one-off payment of £99.