Citadel OS operates with a verified boot chain. If the bootloader is tampered with or integrity checks fail, the device triggers an automatic self-destruction process to prevent data exposure. This automated wipe also occurs if you forget to lock the device after using our web installer.
Citadel OS & Citadel Chat
The Smartphone Reborn for Absolute Privacy
The modern smartphone is designed to harvest your data. We designed Citadel to protect it. A bespoke, zero-trust mobile operating system paired with military-grade encrypted messaging.
5
Hardware modules disabled
AES-256
Message encryption
3
Levels of location removal
0
Logs, histories, contact lists
The Problem
Don't trust the modern smartphone
Standard devices are easy targets for social engineering, malware and continuous location tracking. Every quality that makes them convenient also makes them a liability.
Convenient Private
A vector for tracking users.
Easy Secure
Access for surveillance and forensics.
Powerful Yours
Location monitoring, around the clock.
Essential Trusted
A target for social engineering.
Always Connected Protected
To third-party data collection.
A regular smartphone user can't be anonymous. You pay for free apps with unprecedented access to your most sensitive data.
Citadel OS
Zero-trust mobile architecture
Citadel OS is a hardened, custom-built operating system designed specifically to eliminate modern smartphone vulnerabilities. We have engineered a fortress around your data by permanently removing the attack vectors that standard operating systems leave open.
Stripped of Tracking
Complete removal of Google services, internet browsers and third-party application installations.
Hardware Disabled
GPS modules, Bluetooth, NFC, USB data transfer and biometrics are disabled at the hardware abstraction layer, ensuring location and physical data sovereignty.
Anti-Forensic Defense
The system is certified against physical extraction, with penetration testing verifying that leading forensic tools cannot extract data from a Citadel device.
Tamper-Proofing
Any attempt to manipulate the firmware triggers an automatic data wipe.
Over-The-Air Updates
Rapid, secure OTA updates over WiFi instantly patch emerging vulnerabilities.
Managed Deployment
Applications cannot be installed by users. Everything on the device arrives through our managed Mobile Device Management system.
Technology should shield your data, not expose it.
Citadel comes installed on select authentic Google Pixel devices for a no-compromise approach to security.
Disabled Hardware
- GPS
- Biometrics
- Bluetooth
- NFC
- USB data transfer
Removed Software
- Web browsing
- Third-party apps
- Google services
- Advertising services
Citadel Chat
Uncompromising end-to-end encryption
Operating seamlessly within Citadel OS, Citadel Chat is a complete communication suite offering text, voice messaging and encrypted calling.
Proprietary Cryptography
ECCurve25519, AES-256 (CTR) and Double Ratchet algorithms guarantee Perfect Forward Secrecy for every message.
Data Sovereignty
Private keys are generated and held exclusively on the user's device. Servers retain zero logs, chat histories or contact lists.
Self-Destructing Data
Automated self-destruct timers for messages and media across both sender and receiver devices.
Secure Peripherals
A custom in-house keyboard prevents keystroke logging, and a secured camera encrypts photos immediately without saving them to a public gallery.
Duress Capabilities
Establish a specialized duress password. If entered under pressure, the device instantly wipes all information.
Hidden Notebook
A secure, optional lock-screen notebook for highly sensitive encrypted notes.
Location Kill-Chain
Stop broadcasting your position
We have taken unprecedented steps to make sure location services are disabled at every level of the operating system. Removing the on-screen toggle is not enough — the stack underneath it has to go too.
- Emergency Location Services Eliminated
- Bluetooth & NFC Tracking Eliminated
Operating System Stack
System Location UI
Controls removed
Fused Location Provider
Jammed via null location
Hardware Abstraction Layer
GPS drivers removed
GPS Module
Inaccessible
Forensic Resistance
The best defence never rests
Custom device and infrastructure enhancements mean that your data is safe, even from forensic tools like UFED analyzers and remote vulnerabilities like Pegasus.
Penetration testing unequivocally verified that not a single commercially available forensic device is capable of extracting data from Citadel's fortified ecosystem.
Independent penetration testing
-
01
Custom Kernel
Citadel reinforces all aspects of the device, right down to fortifying the fundamental architecture against any type of hardware or digital attack.
-
02
Android Verified Boot
On start-up, Citadel verifies the integrity and authenticity of all executable code with custom signed certificates, ensuring the device is uncompromised.
-
03
OTA Updates
Digital threats are constantly evolving. Citadel allows for rapid and secure over-the-air updates on WiFi, delivering the latest security at the highest speed.
Infrastructure
A legion of fortified server technology behind you
Citadel OS
Device, on-device keys
Secure Socket Tunnel
REST API, load balancer
Microservices
In-memory databases, AMQP messaging layer
Microservice Infrastructure
Services are fully scalable for flexibility and agility, with redundant layers built in to reliably and instantaneously deliver services.
Citadel Mobile Device Management
A custom-designed Secure Socket Tunnel operates without any use of Google Firebase Cloud Messaging.
Data Center
Restricted access, 24/7 monitoring, and collection of only the minimum operational information required to run the service.
FAQ
Core system architecture & security
We leverage the device's hardware-backed security components for cryptographic protections and integrity validation. Sensitive operations are completely isolated from the main OS, significantly reducing the attack surface for key extraction or privilege escalation.
Security-critical functions run exclusively within the trusted execution environment to ensure separation from the main operating system. This architecture protects sensitive processes from compromise, even if the primary OS environment is targeted.
We reduce exposure to chip-level and baseband attack vectors by minimizing the overall attack surface. Standard Android services such as SMS, MMS, emergency services, telephony services (except for data) and the Play Store are entirely removed. Applications cannot be installed by users and are only deployed through our managed Mobile Device Management system.
Citadel Chat provides multi-layered protection, securing your data in transit, at rest and in use. It relies on a proprietary protocol combining ECCurve25519 and a Double Ratchet algorithm to ensure Perfect Forward Secrecy — generating new keys for every single message. Individual messages are then encrypted using AES-256 (CTR). Crucially, all private keys are generated directly on your local device and are never transmitted to or stored on our servers.
Citadel Chat supports completely anonymous, encrypted group messaging. Within these closed communication groups, the contact information and identities of individual participants remain entirely hidden from one another. This ensures that group collaboration can occur without sacrificing the individual privacy of the members.
Contact
Arm yourself with true mobile security
Talk to us about a deployment or request a live demonstration tailored to your operational requirements.
Mon–Fri 8:00–20:00 CET · We reply within 1 business day