Nitrokey · Hardened phone
NitroPhone 10 Pro
GrapheneOS hardened Pixel 10 Pro. Verified boot, sensor controls, no Google services unless you opt in. Built in Berlin on open hardware and firmware, fulfilled from a US 3PL with 2-day shipping.
$1,235
$1,435 Sale EU equivalent: €989 incl. VAT · nitrokey.comShips direct from Nitrokey (Germany) · typically 5–10 business days
Vegas batch closed — buy direct on Nitrokey, or get notified when the next bulk batch opens.
STORAGE
CONFIGURATION SERVICE (OPTIONAL)
Get the next Nitrokey batch
The Vegas batch has closed. Need it now? Buy direct on Nitrokey. Rather wait for the next bulk run — group pricing, PO/invoicing, and event pickup? Tell us what you’d order and we’ll email you the moment it opens. No commitment; enough interest is what schedules the next batch.
Lithium-ion battery installedUN 3481
Contains a lithium-ion battery, so it ships by ground or on approved air services only. We handle the dangerous-goods paperwork; nothing is needed from you.
Carriers & cellular
Will it work on your network?
Partial US frequency coverage — check your carrier
GSM, LTE, 5G (sub-6 GHz) — no complete frequency coverage in the USA. NitroPhones work with all major carriers but not with all 5G networks. Check with your carrier to make sure your phone works on its 5G network.
— Google Pixel hardware manufacturer specification
CDMA is no longer the question
The old GSM-vs-CDMA split is history — US carriers retired their CDMA networks, and everything now runs on LTE and 5G. Any unlocked LTE/5G handset can technically attach to all three major networks.
VoLTE provisioning is the real gotcha
With 2G and 3G shut down, voice calls ride VoLTE. Carriers maintain lists of device models they enable it for, and an imported or less common model is not always on them. Data may work perfectly while calls do not. Check your specific model with your carrier before you buy — this is the single most common problem with any imported phone, ours included.
Sub-6 5G only, no mmWave
These handsets do sub-6 GHz 5G. The very high-frequency mmWave tier some US carriers deploy in dense areas is not supported, so you get normal 5G rather than the headline speeds advertised in a stadium.
Bands are a per-model fact, not a brand fact
A phone sold into the European market does not necessarily carry the same band set as the North American variant of the same handset. Where a vendor publishes the band list we show it; where they publish a caveat instead, we show the caveat rather than guessing.
Radio hardening on this device
- The baseband radio processor is isolated using an IOMMU, so a compromised modem cannot reach the rest of the system.
- Optional LTE-only mode disables 2G and 3G, removing the downgrade path most IMSI catchers rely on.
- Per-connection MAC randomisation stops nearby Wi-Fi scanners correlating the device across locations.
- Apps cannot read the IMEI, serial number, SIM serial or subscriber ID.
Consider skipping the carrier entirely
Every one of these handsets runs perfectly well with no SIM and no eSIM at all — Wi-Fi only, with calls and messages over an encrypted app instead of the carrier network. For some threat models that is the stronger configuration, and it is worth understanding why.
It removes the cell-site attack surface
IMSI catchers — the devices commonly called stingrays — work by impersonating a cell tower, persuading nearby handsets to attach, and harvesting the identifiers they present. Many attacks depend on forcing a downgrade to older, weaker 2G or 3G protocols. A handset with no cellular connection has nothing to catch. Short of that, GrapheneOS LTE-only mode closes the downgrade path while keeping the phone usable on a network.
It removes the carrier as a data holder
A SIM ties a subscriber identity to a location history held by a company that can be subpoenaed, breached, or socially engineered. No SIM means no carrier record of where the device has been, because the carrier never sees it.
What it costs you, honestly
No cellular data away from Wi-Fi. Emergency calling behaves differently and may not be available without a carrier connection — verify how your device and jurisdiction handle this before you rely on it. Anyone expecting to reach you on a normal phone number will need another route.
What it does not do
This is not invisibility. Wi-Fi networks, the IP addresses you use, and the services you sign into all produce their own metadata, and an app-based identity can be just as identifying as a phone number. Removing the SIM narrows one specific channel — a significant one — rather than closing all of them.
Why the NitroPhone 10 Pro
What this hardened phone does that alternatives don't.
Sensor-level controls
Per-app toggles for camera, microphone, network, sensors, and storage. Not feature-disable like Lockdown Mode — granular permission.
Verified boot, open firmware
GrapheneOS audits the entire boot chain. Pixel hardware retains its secure element while you get full firmware transparency.
No Google services by default
Sandboxed Google Play if you need it. Most executives keep it off. No background telemetry, no location pings to ad networks.
Specifications
Full technical details.
Compliance framework mapping
Controls this product satisfies across 12 frameworks.
Mobile device access control
Hardened mobile OS with per-app sensor controls, verified boot, and no background telemetry. Satisfies mobile device management and bring-your-own-device security requirements.
Supply chain risk — hardware and firmware
Open-source firmware is publicly auditable and reproducibly built. EU jurisdiction hardware is not subject to US National Security Letters. Directly addresses hardware supply chain risk in CMMC and NIS2.
Transmission confidentiality and integrity
Verified boot ensures the TLS stack is unmodified before communication. VPN gateway encrypts all remote access traffic. Hardware-backed keys prevent interception even if endpoints are observed.
Compared to
Honest comparisons against the most likely alternatives.
vs iPhone in Lockdown Mode
Lockdown disables features. GrapheneOS hardens the OS while keeping app compatibility through sandboxed Google Play.
vs stock Pixel + GrapheneOS DIY
Same software, with verified hardware procurement, optional pre-configuration, and US-side warranty + RMA.
vs Purism Librem 5
Different tradeoff. NitroPhone uses Pixel hardware with hardened software; Librem 5 uses fully open hardware with Linux.
vs Samsung Knox / Galaxy
Knox is Samsung's enterprise wrapper. NitroPhone replaces the OS entirely with audited open source.
Frequently bought together
Save $115 vs. buying separately.
NitroPhone 10 Pro · Executive bundle
Phone, hardware key, signal-blocking sleeve, and charging-port defense.
· NitroPhone 10 Pro (128 GB) — $1,235
· Nitrokey 3C NFC — $80
· Faraday sleeve for phone — $55
· Data blocker USB-C — $9
Bundle price
$1,264
$1,379 separately
Shipping & returns
What to expect after you order.
Shipping
Ships from our Tennessee 3PL. 2-day FedEx to most US addresses, expedited options at checkout. Signature required. Business day processing — orders placed before 2pm ET ship same day.
Returns & RMA
30-day return window for unopened units. Defective units handled under Nitrokey's 2-year warranty — we manage the US-side RMA so you don't ship to Berlin.
Purchase orders
Net-30 terms available for approved organizations. W-9 on file. Generate a quote from the stack builder or email sales@securitygadgets.shop with your PO requirements.
Authorized reseller
We are an official Nitrokey authorized reseller. Full manufacturer warranty applies. Identical hardware and firmware to buying direct from nitrokey.com — with US inventory and support.
