Frequently asked questions

Is WraithLink GrapheneOS?

No. WraithLink is an independent build derived from the GrapheneOS and AOSP open-source projects. It is not affiliated with, endorsed by, or supported by GrapheneOS or Google. It keeps their security foundations and adds a coercion-resistance layer on top, and it preserves the upstream attribution their licenses require.

Why only Pixel phones?

WraithLink's guarantees depend on a bootloader that can be relocked with a custom key, a secure element that can genuinely destroy keys, and prompt firmware updates. In practice only Pixels provide all three. Running on hardware without them would make the duress feature untrustworthy. See Devices.

Does the decoy-duress PIN really hide my data from the police?

It depends entirely on when they copy the storage. If someone forces you to unlock and watches, the decoy PIN destroys the vault as it opens the phone, and they see a real device with nothing on it. If a lab images the storage before you ever enter a PIN, the copy already exists and nothing you do afterwards helps. For that threat use the panic wipe. Read the security model - we don't oversell this.

Can forensics tell WraithVault exists?

WraithLink hides the vault from everyday view, but a secondary profile is still detectable over ADB or with physical acquisition. We hide it from casual inspection, not from a lab, and we say so plainly.

Is it really a "blockchain" messenger?

Messages never touch a blockchain - that would make them permanent and public, the opposite of "no logs". The messenger is peer-to-peer over Tor with disappearing messages and mandatory verification. An optional ledger is used only to bind a handle to a key against impersonation, and it's off by default. See the messenger docs.

Will my banking / Play-store apps work?

Sandboxed Google Play is offered in the setup wizard and runs like a normal app with no special privileges, so most Play-store apps work. Some apps that demand strict hardware attestation may behave differently; WraithLink keeps attestation intact, which helps.

What happens if I lose my WraithVault backup?

If the decoy destroy fires and you have no backup, that data is gone for good - that's the nature of a real destroy. The setup wizard makes you back up before you can arm it, precisely so a destroy is always recoverable.

Do I need the X47 desktop?

No. It's an optional companion for remote tooling and automatic vault backups. Without it, back up to an encrypted USB-C drive instead.

Can I use my own DNS or VPN?

Yes. Mullvad is the default because it keeps no logs, but Private DNS accepts any DNS-over-TLS provider, and you can use any VPN app you like.

How do updates work?

WraithLink pulls signed updates from its own server and installs them in the background with the same seamless A/B mechanism as the base system. You never sideload updates by hand.