Nitrokey · Hardened phone
NitroPhone 10a
GrapheneOS on the Google Pixel 10a — the most affordable way into a de-Googled, hardened Android with the Titan M2 security chip. Same hardening as the flagship NitroPhones at the mid-range price.
$810
EU equivalent: €649 incl. VAT · nitrokey.comShips direct from Nitrokey (Germany) · typically 5–10 business days
Vegas batch closed — buy direct on Nitrokey, or get notified when the next bulk batch opens.
Get the next Nitrokey batch
The Vegas batch has closed. Need it now? Buy direct on Nitrokey. Rather wait for the next bulk run — group pricing, PO/invoicing, and event pickup? Tell us what you’d order and we’ll email you the moment it opens. No commitment; enough interest is what schedules the next batch.
Lithium-ion battery installedUN 3481
Contains a lithium-ion battery, so it ships by ground or on approved air services only. We handle the dangerous-goods paperwork; nothing is needed from you.
Carriers & cellular
Will it work on your network?
Partial US frequency coverage — check your carrier
GSM, LTE, 5G (sub-6 GHz) — no complete frequency coverage in the USA. NitroPhones work with all major carriers but not with all 5G networks. Check with your carrier to make sure your phone works on its 5G network.
— Google Pixel hardware manufacturer specification
CDMA is no longer the question
The old GSM-vs-CDMA split is history — US carriers retired their CDMA networks, and everything now runs on LTE and 5G. Any unlocked LTE/5G handset can technically attach to all three major networks.
VoLTE provisioning is the real gotcha
With 2G and 3G shut down, voice calls ride VoLTE. Carriers maintain lists of device models they enable it for, and an imported or less common model is not always on them. Data may work perfectly while calls do not. Check your specific model with your carrier before you buy — this is the single most common problem with any imported phone, ours included.
Sub-6 5G only, no mmWave
These handsets do sub-6 GHz 5G. The very high-frequency mmWave tier some US carriers deploy in dense areas is not supported, so you get normal 5G rather than the headline speeds advertised in a stadium.
Bands are a per-model fact, not a brand fact
A phone sold into the European market does not necessarily carry the same band set as the North American variant of the same handset. Where a vendor publishes the band list we show it; where they publish a caveat instead, we show the caveat rather than guessing.
Radio hardening on this device
- The baseband radio processor is isolated using an IOMMU, so a compromised modem cannot reach the rest of the system.
- Optional LTE-only mode disables 2G and 3G, removing the downgrade path most IMSI catchers rely on.
- Per-connection MAC randomisation stops nearby Wi-Fi scanners correlating the device across locations.
- Apps cannot read the IMEI, serial number, SIM serial or subscriber ID.
Consider skipping the carrier entirely
Every one of these handsets runs perfectly well with no SIM and no eSIM at all — Wi-Fi only, with calls and messages over an encrypted app instead of the carrier network. For some threat models that is the stronger configuration, and it is worth understanding why.
It removes the cell-site attack surface
IMSI catchers — the devices commonly called stingrays — work by impersonating a cell tower, persuading nearby handsets to attach, and harvesting the identifiers they present. Many attacks depend on forcing a downgrade to older, weaker 2G or 3G protocols. A handset with no cellular connection has nothing to catch. Short of that, GrapheneOS LTE-only mode closes the downgrade path while keeping the phone usable on a network.
It removes the carrier as a data holder
A SIM ties a subscriber identity to a location history held by a company that can be subpoenaed, breached, or socially engineered. No SIM means no carrier record of where the device has been, because the carrier never sees it.
What it costs you, honestly
No cellular data away from Wi-Fi. Emergency calling behaves differently and may not be available without a carrier connection — verify how your device and jurisdiction handle this before you rely on it. Anyone expecting to reach you on a normal phone number will need another route.
What it does not do
This is not invisibility. Wi-Fi networks, the IP addresses you use, and the services you sign into all produce their own metadata, and an app-based identity can be just as identifying as a phone number. Removing the SIM narrows one specific channel — a significant one — rather than closing all of them.
Why the NitroPhone 10a
What this hardened phone does that alternatives don't.
GrapheneOS hardening
Hardened memory allocator, full app sandboxing, granular network and sensor permission toggles, and no Google services by default.
Hardware root of trust
Titan M2 security chip with hardware-backed verified boot and attestation on trusted Pixel hardware.
The entry point to the line
The cheapest NitroPhone we list. If the 10 Pro's price is the blocker for a fleet rollout, this is the same OS and threat model on lighter hardware.
Specifications
Full technical details.
Compliance framework mapping
Controls this product satisfies across 12 frameworks.
Mobile device access control
Hardened mobile OS with per-app sensor controls, verified boot, and no background telemetry. Satisfies mobile device management and bring-your-own-device security requirements.
Supply chain risk — hardware and firmware
Open-source firmware is publicly auditable and reproducibly built. EU jurisdiction hardware is not subject to US National Security Letters. Directly addresses hardware supply chain risk in CMMC and NIS2.
Compared to
Honest comparisons against the most likely alternatives.
vs. NitroPhone 10
The 10 uses the higher-tier Pixel 10 with more RAM and camera hardware. Identical GrapheneOS hardening — the difference is the phone underneath, not the security model.
vs. a stock Pixel with GrapheneOS
Same OS, but shipped flashed, verified, and supported with a US-side RMA path — no self-flashing and no warranty ambiguity.
Shipping & returns
What to expect after you order.
Shipping
Ships from our Tennessee 3PL. 2-day FedEx to most US addresses, expedited options at checkout. Signature required. Business day processing — orders placed before 2pm ET ship same day.
Returns & RMA
30-day return window for unopened units. Defective units handled under Nitrokey's 2-year warranty — we manage the US-side RMA so you don't ship to Berlin.
Purchase orders
Net-30 terms available for approved organizations. W-9 on file. Generate a quote from the stack builder or email sales@securitygadgets.shop with your PO requirements.
Authorized reseller
We are an official Nitrokey authorized reseller. Full manufacturer warranty applies. Identical hardware and firmware to buying direct from nitrokey.com — with US inventory and support.
