Security Configuration

Step 1 – Enable Developer Mode

On a stock Pixel:

• Settings → About Phone → Tap Build Number 8 times

Step 2 – Enable OEM Unlocking

• Settings → System → Developer Options → Enable OEM Unlocking

Step 3 – Power Off Device

• Power the device off completely

Step 4 – Enter Fastboot Mode

• Hold Volume Down → Press the Power Button while holding Volume Down

Step 5 – Open GrapheneOS Web Installer

https://grapheneos.org/install/web

Step 6 – Unlock Bootloader

• Connect phone to PC via USB → Click Unlock Bootloader
• Select your Pixel when prompted → Click Connect

Step 7 – Install GrapheneOS

• Click Download Release and wait for completion
• Click Flash Release and wait for completion

Step 8 – Lock Bootloader

• Click Lock Bootloader on the Web Portal.
• Press Volume Down to select Lock Bootloader → Press Power Button to confirm

Step 1 – Complete Initial Setup

Power device on and proceed through the GrapheneOS setup.

Step 2 – Re-enable Developer Mode

• Settings → About Phone → Tap Build Number 8 times
• Settings → System → Developer Options → Enable USB Debugging

Step 3 – Configure Duress PIN

Settings → Security & Privacy → Device Unlock → Duress Password

Set the Duress PIN for all 4 boxes to:

5555

Step 4 – Configure Auto Reboot

Settings → Security & Privacy → Exploit Protection → Auto Reboot

Set to:

4 Hours

Step 1 – Validate License

www.pfsecured.com

• Enter your License Key and Validate.

Step 2 – Connect Device

• Connect phone to PC via USB → Click Connect Phone Via USB
• Select your Pixel when prompted → Click Connect
• Unlock the phone screen → Press Allow on the phones ADB prompt

Step 3 – Select Applications

Choose the APKs you want installed.

Step 4 – Run Installation

• Press Run Security Install → Wait 5-15 Minutes for this to complete

If Installation Fails

- Launcher Selection -

(Somewhere along the setup, usually after reboot or lock, the device will prompt you with Launcher set up. When this happens, untick all options except the last two as per the image below - It will say "Cannot load purchase options" - Simply press Exit)

Step 1 – Disable Running in Background for "Guest" Profile

Settings → System → Users → Guest

• Disable/Untick Running In Background

Step 2 – Restrict USB to Charging Only

Settings → Security & Privacy → Exploit Protection → USB-C Port

• Set this to Charging Only (Enter passcode when prompted)

Step 3 – Enable eSIM Support

Settings → Network & Internet → Enable eSIM Support

• Device will Reboot

Step 1 – Switch To Guest Profile

• Swipe down twice from the top of the screen → Press red user icon

• Select Guest → Log in using 0000

Step 2 – Configure Mullvad VPN

• Open Mullvad VPN and log in using the account provided
• Click on Connect and allow

Step 3 – Return To Owner Profile

• Hold the Power Button → Select End Session

Step 1 – Restore Desktop Layout

• Hold finger on empty area of the home screen
• When the menu pops up, press "Show All Settings" to view all options and select Backup

"Select Backup Folder" → Continue → Pictures → Use This Folder → Allow → Click on the maindesktop picture → Restore → Ok

Step 2 – Open PfShield

• Open PfShield (Located on the bottom right corner of desktop)
• Enter default Owner Profile passcode 0000

Step 3 – Enable Notification Access

• When menu pops up, select PfShield and toggle Notification Permissions on
• Click the top left arrow twice to go back

Step 4 – Allow Background Permissions

• Allow - When prompted for Let App Always Run in Background
• Allow - When prompted for Notifications Permission

Step 5 – Apply Security Configuration

• Press Start Protection Service (The button should turn green)
• Press it again to stop Protection Service (The button should turn red)

Recommended Default Setup

Lock Timer

This wipes the device if the Owner Profile has not been unlocked within the selected timeframe.

• Do not set this below 3 days
• Guest Profile unlocks do not reset this timer
• Only Owner Profile unlocks reset this timer. Since our auto reboot is set to 4 hours, upon waking up in the morning, phone will automatically have rebooted back into owner profile. Unlocking device will then reset this timer

Network Timer

This wipes the device if it has no internet connection for the selected timeframe.

• Wi-Fi or mobile data connection will reset the timer
• Logging in to Owner Profile will reset the timer
• Turning the phone off pauses the timer
• The timer only counts while the phone is powered on. This means if you have cellular issues, or are about to fly on a plane or travel in remote areas, simply turn the device off to pause the timer. Upon turning on and logging in, this timer will reset

Failed Passcode Attempts

Wipes the device after the configured number of failed Owner Profile passcode attempts.

Notification Message Wipe

Airplane Wipe Shortcut

• Swipe down twice → Pencil Icon → Remove default Airplane tile (Press the - Button) → Press + to add another random time (such as NFC or Cast) → Scroll to bottom to find the fake Airplane Toggle (Should have Shield Logo next to it) → Press + to add to second page of shortcuts

Decoy Notes Shortcut

If enabled, a fake app called Encrypted Privacy Notes will appear. Opening it will wipe the device.

USB Wipe

This will wipe if the device is connected to a data connection such as a PC or CarPlay. As USB has been completely disabled, this function can be left off. This is much safer than purposely allowing USB to connect to Data/Tools and hoping it wipes

Wallpaper Passcode Text

This controls the passcode message displayed on the lock screen wallpaper.

This device belongs to COMPANY PHONE. PASSCODE: 5555

If you change the Duress PIN, you should update this text in PfShield so both values match.

Sensitivity

This locks the screen after sudden movement such as dropping, snatching, or throwing the device.

• When triggered, biometrics are temporarily disabled until the full password is entered.

Step 1 – Start Protection Services

• Once closed, hold desktop icon and click "Remove Icon" to hide the app (If you need to access app again, Settings → Apps → All Apps → PfShield → Top right Square icon to launch app → Enter Owner Password)

Step 2 – Set Up eSIM

Settings → Network & Internet → SIMs → Set up an eSIM → Allow Camera permission → Scan QR code provided → Follow Prompts → Toggle eSim On

Step 3 – Configure Network Type

Settings → Network & Internet → SIMs →

• Scroll down and set Preferred Network Type to 5G & LTE (or 5G & 4G) Only
• Enable 2G Network Protection

Step 4 – Set Owner Profile Password

Settings → Security & Privacy → Device Unlock → Screen Lock → Password

Use a strong password. We recommend 20+ characters.

Step 5 – Set Guest Profile Password

• Set a new Guest Profile password (Same process as above in the Screen Lock → Password Menu

Step 6 – Set Fingerprint Authentication

Settings → Security & Privacy → Device Unlock → Fingerprint → Add Fingerprint

• Once fingerprint is set up, scroll down to the new option labelled Enable Second Factor PIN → Set an 8 digit PIN for fingerprint authentication

Emergency Wipe

Profiles

You should install apps and be on Guest profile at all times. Owner profile is only for admin/logging in. Do NOT install Apps or daily use Owner Profile.

Owner Profile Reboot

The device will automatically reboot into the Owner Profile overnight or after 4 hours.
The Owner Profile wallpaper should be white so you can easily identify it.

Network Loss Timer

The network loss timer can wipe the device after the configured period without internet.

VPN Code

Do not share or reuse the VPN code elsewhere. If you need a new VPN code, contact support.

Notes Storage

For notes, use Standard Notes.

You may set up cloud sync using a false email and password to allow recovery if the device is wiped.

Step 1 – Set Up SimpleX On Pixel

• Open SimpleX on the Owner Profile
• Press Get Started
• Enter a profile name
• Create profile
• Set notifications to Instant

Step 2 – Create Public Address

• Select Let Someone Connect To You
• Select Create Public Address
• Save the URL or QR code

Step 3 – Connect From Another Device

• Install SimpleX on another device
• Add the Pixel using the saved URL or QR code
• Send a message
• Accept the chat request on the Pixel

Step 4 – Test Remote Wipe

Send this test phrase:

testcode

If a notification appears saying test successful, remote wipe is ready.

Step 5 – Wipe Device Remotely

Send the configured wipe phrase exactly as saved in PfShield.

Default wipe phrase:

!forget

Remote Wipe Limitations

Owner Profile Behaviour

• If the phone is unlocked in Owner Profile, it will wipe
• If the phone is locked in Owner Profile, it should wipe once the notification is received

Guest Profile Behaviour

• If the phone is in Guest Profile, it will not wipe immediately
• If the user ends the session back to Owner Profile, it may wipe once the notification arrives
• If the phone reboots before the notification is received, the original notification may be lost