How a phone goes quiet.

The only link.

Most mobile security work is a defence of the network path. Harden the browser, sandbox the app, encrypt the DNS, patch the parser, ship the fix faster than the exploit. The path stays, and so does everything that can arrive on it.

GuardTalkOS starts at the other end. The path is removed from the phone rather than defended on it. What remains is one link, and that link goes to hardware you own: the GuardTalk Gateway.

The build offers no cellular data path. It offers no second route to the internet for an application, a system service or an implant to find. Whatever the phone sends or receives crosses the same link, to the same peer, through a device you hold.

That is the whole of the OS-layer air gap, and it is structural rather than a setting. There is no switch in this build that turns a direct internet path back on, because no such path was built.

The diagram below is the family air-gap diagram, cut to the segment this site can speak for. Everything past the Gateway — its defences, Tor, the destination — belongs to the system, and is documented on the parent site.

Nothing to phish into.

Commercial spyware has to do three things in order: arrive, run, and report. Arrival is the part this operating system addresses, because arrival needs a component on the phone that is willing to receive attacker input.

The delivery chains this class of tooling is known for follow the same shape. A link is opened in a browser engine. A payload arrives at a messaging, mail or media surface and is parsed before anything is shown to the person holding the phone. Code that has landed then beacons out to the operator's command-and-control infrastructure for instructions and for the data it took.

Each step needs a named component on the phone. Removing the component ends the chain at that step.

A link is opened.

The chain needs a browser engine that will fetch and render content the attacker controls. It is the oldest delivery route in the class and still the cheapest.

No browser is built into this image, and there is no path to install one. A link that reaches the device has nothing to open in.

A payload arrives without interaction.

The chain needs a surface that parses attacker input before a person sees anything. A messaging or media handler will do, as will a store client or a proximity radio.

The app store and the sideload path are not built in. Bluetooth, NFC, USB debugging and location paths are not built in. The GuardTalk Messenger is the one messaging surface that remains, and it is handled as a real surface rather than as an exception.

Landed code reports back.

The chain needs a route to the operator's infrastructure — for instructions, and for the data it took.

No cellular data path exists on this build, and no direct internet path exists at all. The only route out is the Gateway link, and it goes to hardware you hold.

A delivery channel that does not exist cannot be exploited. That is the entire claim, and it is worth being exact about what it is not. It is not a claim that the device is beyond reach, and it is not a claim about channels that do exist.

Two channels do exist. The Gateway link is one, and the GuardTalk Messenger is the other. Both are real attack surface, covered by the Gateway's defences and the system threat model rather than by this operating system. The Wi-Fi stack and the launcher remain on the device too, and a well-resourced zero-day can still reach one of them.

Exfiltration has to cross the Gateway.

Arrival is half of an intrusion. The other half is the part that costs the target something: data leaving. On an ordinary phone that flow is invisible by design. It is mixed into background traffic on a cellular link the user never sees and cannot inspect.

On this device there is one egress. Anything that wants out crosses Wi-Fi to the Gateway, which is hardware you own and physically hold. Silent theft becomes an event at a boundary that belongs to you rather than to a carrier or a vendor.

The limit is precise and it matters. The operating system does not inspect that traffic; the Gateway does. Interception defence, intrusion detection and the kill switch are Gateway properties, not OS properties. Without the Gateway there is no checkpoint, and GuardTalkOS is a stripped ROM with a Wi-Fi radio and no protection at the network boundary.

How the Gateway inspects and blocks↗

What you give up — stated plainly.

This design has a price, and the price is ordinary smartphone convenience. It is not hidden in a footnote, because a person deciding whether to carry this phone needs it in front of them.

• No browser. None is built into the image, and there is no path to install one.
• No app store and no sideloading. The app set is what the image ships, and nothing else.
• No cellular data path. The build offers none, so there is nothing to harden around.
• No Bluetooth and no NFC. Both are removed as delivery and proximity surfaces.
• No location services. The device is not asking where it is, and nothing on it is answering.
• No USB debugging. The path a forensic tool or an attacker with a cable would reach for is absent.
• A limited app set. What is on the device is what was built into the image for this job.

That is the accepted cost, deliberately paid, for a phone whose delivery channels do not exist. If the cost is not acceptable for how you work, that is a legitimate answer and a common one. The comparison that says so in plain terms is on the comparison page.

What happens at seizure.

A duress wipe and an infrastructure failsafe exist as system capabilities. They belong to the GuardTalk Mobile Protector, not to this operating system, and this site describes them only in the family's wording.

We do not publish how they are triggered, what they reach, or how long they take. Publishing that would hand the operational detail to whoever is holding the phone when it matters. The threat model states the boundary instead of the mechanism.

What can be said plainly is the limit. Physical coercion beyond the system's duress wipe is out of scope. A person who can compel a passphrase can compel a passphrase, and no operating system changes that.

// confirm §19.10family duress and failsafe wording, counsel-confirmed

Day to day.

Only what is real today is described here. The device runs a shipped launcher with a limited app grid. It runs the GuardTalk Messenger. It pairs with the Gateway over Wi-Fi, and that pairing is the phone's entire relationship with the network.

The on-device brand system — boot animation, wallpapers, launcher and app icons — ships as a palette-locked asset pack. It is cosmetic, it changes nothing about the threat model, and it is listed last for that reason.

Anything not in those paragraphs is either planned or not yet decided. It is labelled that way on the status board rather than described here as though it shipped.