Device fleet management on GrapheneOS
A fleet of corporate phones on GrapheneOS, managed by your own server. Nothing stands between the phones and that server: no app store, no vendor cloud.
GrapheneOS is an independent open source project. It is Android without Google services, hardened against exploits. Wyrd adds corporate management of work profiles on top of that foundation.
A work profile is created on the employee's phone, and the system touches nothing else. The personal half of the device is out of its reach. The phone states plainly that the profile is managed by the organisation, and that cannot be hidden.
You upload an application file to the panel and push it to the devices you choose. No app store and no Google services are involved. Applications can be configured in advance, and installing anything else into the work profile can be blocked.
Moving work data into the personal half is closed off. The clipboard shared between the work and personal halves is turned on or off from the management panel. Policies are enforced continuously and cannot be removed on the phone itself.
Model, system version, patch level and bootloader state for every device. You see the fact that USB debugging is on, a SIM change, failed unlocks and the network calls applications make.
The server matches the patch level of every device against the Android vulnerability catalogue. The catalogue refreshes itself automatically.
You define the rules: failed unlock attempts, a device that stopped reporting, vulnerabilities above a severity you pick, an entry in the security log. An alert clears itself once its cause is gone.
From the panel the work profile is locked, and wiped if the device is not coming back. If the phone is offline, it gets the command the moment it comes back online.
Coordinates are collected only after the phone's owner grants explicit permission. That permission can be withdrawn.
The server is updated by installing a newer Debian package over the old one. It picks up the latest version of the mobile application itself and distributes it to the devices.
Architectural limits and commitments.
Personal applications, messages, photos and accounts are invisible to the administrator. They are never collected and never wiped.
Only the work profile is wiped. The product has no command that erases the phone itself.
Phones and mobile service are not part of the product.
No fleet management system stops a person from showing their screen, reading a message aloud or handing over an unlocked phone. The system reduces the risk of loss, theft and infection. It does not replace your rules for handling information.
You install the package on your server and open the management panel.
Without a key the server handles up to two phones. The key raises that limit.
Each device is connected to a computer by cable. The flashing tool installs GrapheneOS, creates the work profile and connects the phone to your server. If GrapheneOS is already installed, the data on the phone is kept.
From then on you work in the management panel: policies, the set of applications, the state of the fleet, commands to devices.
The plan sets the number of devices and the way support works.
$0
Permanent
Up to 2 devices
$15per 30 days
$160 per year, which is $13.3 a month
Up to 10 devices
On request
Device count, term and price by agreement
Any number of devices
When a licence expires the fleet is not blocked. The panel and the list of devices stay in place, and the server stops accepting new data from the phones.
Rent a virtual server, install the package by the guide and connect the first phone. Two devices need no licence.