← All Guides

How to Use a Secure Phone Properly

A hardened device is only as secure as the person using it. Hardware and software provide the foundation, but your daily habits determine whether that foundation holds. This guide covers the practices that matter.

Use separate profiles

GrapheneOS supports multiple user profiles, each with its own isolated app data, storage, and permissions. Use them deliberately.

• Owner profile: Keep this minimal. System settings, VPN, and core utilities only.
• Work profile: Business apps, email, documents. Sandboxed Google Play if needed for compatibility.
• Personal profile: Messaging, browsing, media. Separate from work data entirely.
• Sensitive profile: For high-risk communications. No unnecessary apps. No accounts linked to your real identity.

When a profile is not active, its data is encrypted and inaccessible. This is real compartmentalisation, not just separate app folders.

Practice app discipline

Every app you install is a potential data channel. Be selective.

• Install only what you actively use. Remove everything else.
• Prefer open-source apps from F-Droid where possible.
• Review permissions after installation. Deny location, contacts, and microphone access unless genuinely required.
• Avoid apps that require a Google account to function. If you must use one, run it in the sandboxed Play compatibility layer.
• Do not install social media apps on your secure profile. Use the browser instead.

Manage network behaviour

Your network connections reveal as much as your app activity.

• Use a VPN at all times. Mullvad is configured on every device we ship. Keep it on.
• Avoid connecting to public Wi-Fi without VPN active. Open networks expose your traffic to anyone nearby.
• Use private DNS. GrapheneOS supports DNS-over-TLS natively. Configure it to prevent DNS leak.
• Disable Wi-Fi and Bluetooth when not in use. Both can be used for location tracking via nearby access points and beacons.
• Be aware of your eSIM and SIM activity. Your carrier always knows your approximate location when cellular is active.

Keep your device updated

GrapheneOS receives security patches directly, often ahead of stock Android. Install updates as soon as they are available. Do not delay. Security vulnerabilities are actively exploited, and patches close those windows.

Enable auto-reboot (configured on devices we ship). This forces the device to restart after a period of inactivity, returning it to the encrypted "Before First Unlock" state. If someone gains physical access after a reboot, they face fully-encrypted storage rather than a live, unlocked filesystem.

Think before you act

The most common security failures are behavioural, not technical. Do not click links from unknown sources. Do not enter credentials on unfamiliar pages. Do not share your device PIN. Do not leave your device unlocked and unattended. Do not assume that because the device is secure, you are immune to social engineering.

Common social engineering tactics to recognise

A hardened device does nothing to stop you from being talked into handing over access. The tactics are mundane and repeat constantly:

• Smishing (SMS phishing): a text claiming to be a delivery notice, bank alert, or toll notice, with a link to a fake login page. Banks and carriers do not ask you to "verify" your account via SMS link.
• Impersonation calls: someone claiming to be from your bank, telco, or "tech support," creating urgency to get you to read out a one-time code or install remote-access software.
• Fake app updates: a prompt outside the normal update flow (sandboxed Play Store or F-Droid) asking you to install an "update" from a link. Only ever update through the app store you installed from.
• QR code swaps: a QR code on a poster, parking meter, or menu that leads to a phishing page instead of the real site. If a QR code takes you to a login page, check the URL before entering anything.

None of these require breaking encryption. They only require you to act quickly, under pressure, without checking. Slowing down is the actual defence.

This guide covers behaviour; for the settings underneath it, see the device hardening guide and first boot setup.

Frequently asked questions

What is the single most important habit?

Keeping your real accounts and data out of the profile you use for anything higher-risk. Compartmentalisation via separate GrapheneOS profiles does more for practical security than any individual setting.

Can social engineering defeat a hardened device?

Yes — that is the point of this guide. Hardware and OS hardening do not stop you from being talked into reading out a one-time code or clicking a phishing link. Recognising the tactics (smishing, impersonation calls, fake update prompts) is a behavioural skill, not a device setting.

How often should I review app permissions?

After every app update at minimum, and roughly monthly as routine maintenance. Permissions can be reset by updates without notice.