How the work is actually done, and what we do not claim it achieves.
In person, always. Devices are procured, configured and handed over face to face. Never shipped, never configured remotely, never cloned from an image.
Verified by a person. Every step is carried out and checked by an engineer who can explain why it is there. No automated hardening scripts, no AI in the loop.
Telemetry severed. Reporting channels are disabled at system level rather than toggled in a settings menu, because menu settings return after updates.
Annual integrity audit. A yearly check that the bootloader remains locked, the configuration is intact, and nothing unverified is running. Sealed status depends on it.
We cannot watch you. There is no monitoring capability, by design. Remote wipe exists and fires only on your authenticated instruction or a lawful order, and you may decline it at configuration.
What we do not claim. No device defeats every adversary. We reduce exposure substantially and describe the limits honestly, rather than selling immunity.
This summary is written for clarity and is not the agreement. The full text below is the binding document, and it governs wherever the two differ.