GrapheneOS is a hardened Android that only officially runs on Google Pixel phones. Play Store apps can be installed inside a sandbox: they run as ordinary apps, not as the privileged Google services on a stock phone. Verified boot, a relocked bootloader, and extra exploit hardening are the point. The modem is fenced off from the main processor on those Pixels. It is not a modem you can read.
Banks and some government apps use Google’s Play Integrity check and refuse the phone because Google did not certify the OS. GrapheneOS will not ship a spoofer for that. Motorola support is aimed at 2027 for hardware that meets their rules. Those phones are not shipping with GrapheneOS preinstalled today. You buy a Pixel and you install it.
Use it if you can live with a Pixel and a few missing apps. grapheneos.org
Install GrapheneOS with the official web installer, then relock the bootloader. An unlocked Pixel is not the product. Sandboxed Play is optional. If you do not need banking apps, skip it and keep that profile empty. Expect a few apps to call the phone insecure. They mean it failed Play Integrity. That is Google’s allowlist, not a broken install. Buy the Pixel for the hardware locks, not for the stock software.
