GrapheneOS Privacy Stack: eSIM + Proxy + SMS

Most GrapheneOS setup guides end at the same place. Flash the OS, toggle a few hardening switches, install Signal, install Mullvad, screenshot the settings page, publish. Done. Those guides aren't wrong - they're just incomplete. Once the OS is locked down, the phone still needs to connect to something. Carrier data, account verifications, browsing that doesn't immediately get flagged. Nobody writes about that part.

Spend five minutes on r/GrapheneOS and the same questions show up every week: "which eSIM actually works without Google Play?" and "how do I verify accounts without giving up a personal number?" No authoritative answer exists. Just scattered Reddit threads pointing at providers that are either US-only, overpriced, or routing traffic through a single country.

A de-Googled phone with no connectivity strategy is basically a brick that happens to respect your privacy. What you need is a complete privacy phone stack - OS hardening plus the infrastructure underneath it.

Where Every Other Guide Stops (And Why It Matters)

IntelTechniques covers OS-level settings thoroughly. Permissions, sensor toggles, network preferences. Ventral Digital's guide acknowledges eSIMs exist but doesn't name a provider worth using. GitHub's GrapheneOS-Guide lists KeepGo and Cape as options. Cape is a genuinely strong privacy carrier - no-KYC, IMSI rotation every 24 hours, encrypted voicemail, last-mile SMS encryption, and SIM swap protection. At $99/month it's a premium US-based carrier replacement, not a toolkit. KeepGo requires an email and credit card. Silent.Link offers no-KYC eSIMs but routes all data through a single country (previously Poland, now UK), so every connection exits from the same small pool of IPs. Mullvad, while excellent as a VPN, hands out datacenter IPs that platforms like Google, Meta, and banking apps flag on sight.

So the GrapheneOS privacy model breaks down into a surprisingly simple problem: private OS, non-private pipes.

Three gaps specifically:

1. Carrier-routed data - not datacenter, not a single-country exit node
2. Real-SIM SMS verification - numbers that pass HLR lookups, not VoIP lines that get rejected
3. Mobile-IP browsing - traffic that looks like a normal phone user, not a server rack in Frankfurt

Building the Connectivity Layer: eSIM Activation Without Google Play

GrapheneOS eSIM setup is the first thing that trips people up. On stock Android, scanning a QR code goes through the carrier's app, which usually requires Google Play Services. GrapheneOS handles this natively. As of 2026, eSIM management on GrapheneOS does not require Google Play - it uses proprietary Google functionality that is isolated from Play Services and never shares data with Google. It won't connect to a Google service unless the carrier itself uses one. The official GrapheneOS usage guide confirms this explicitly.

To enable: navigate to Settings > Network & internet > eSIM support and toggle it on. This toggle is persistent across every reboot. From there, tap + to add a new eSIM and scan the provider's QR code. No Play Store. No sideloaded APK. No permissions granted to anything.

Provider choice matters more than most people realize. A no-KYC eSIM activated with crypto, delivered as a QR code, is the baseline. VoidMob's eSIMs work this way: scan the QR from the dashboard, activate in settings, no email required, pay with crypto. Traffic provisions through standard carrier infrastructure with transparent routing - it exits through the carrier's native network in whatever region the plan covers. Not a VPN tunnel. Not Poland. You see the carrier name and IP exit country for every plan before purchase - pick a USA T-Mobile plan and your IP exits through USA, pick a Germany Vodafone plan and your IP exits through Germany.

For a full breakdown of how no-KYC eSIM providers compare on routing transparency, anonymous activation, and actual IP behavior, see No-KYC eSIM Providers Compared 2026.

Dual SIM: Physical SIM + VoidMob eSIM

GrapheneOS Pixel phones support a physical nano-SIM and eSIM simultaneously. This opens up a practical dual-SIM strategy: keep a physical SIM in the tray for calls and texts on a primary number, and use the VoidMob eSIM exclusively for data - all privacy-sensitive browsing and app traffic routes through the eSIM's carrier IP, completely separate from your voice line.

GrapheneOS supports cross-SIM calling (backup calling), which lets you make calls over your primary SIM using the VoidMob eSIM's data connection when the primary SIM has no signal. Enable it at Settings > Network & internet > SIMs > Automatic data switching. When active, "Backup Calling" appears next to the carrier name.

LTE-Only Mode

After activation, switch to LTE-only mode. 5G NSA (non-standalone) can fall back to 4G control planes in ways that leak IMSI data to rogue base stations.

A 2024 study published in MDPI validated three attacks on commercial 5G NSA devices, including an IMSI leak that consistently exposed user information with no security mitigation. Separate research presented at NDSS 2025 confirmed that IMSI-exposing messages remain a threat across 2G, 3G, 4G, and 5G-NSA networks. As Zetier's analysis puts it: "any 5G Non-Standalone deployments have all of the same vulnerabilities as 4G."

The GrapheneOS project recommends LTE-only to reduce attack surface - it disables massive codebases for legacy 2G/3G and bleeding-edge 5G protocols.

On GrapheneOS, navigate to Settings > Network & internet > SIMs > [your eSIM] > Preferred network type and select LTE only. Some Pixel models bury this under *#*#4636#*#* in the dialer, then Phone information > Set preferred network type.

LTE encryption protects against some forms of interception but is not a replacement for end-to-end encryption - always use Signal or SimpleX for calls and messages, regardless of network mode.

SMS Verification That Actually Works

Here's where most GrapheneOS privacy setups fall apart in practice. Hardened phone, no-KYC eSIM for data, everything looking good - and then ProtonMail wants a phone number. Telegram wants a phone number. Literally anything worth signing up for wants a phone number.

Your personal number is the single biggest identifier tying your real identity to your digital life - linked to your name, address, bank accounts, every platform you've ever verified. Using it on a privacy phone defeats the purpose entirely.

VoIP numbers face 60-80% rejection rates on platforms with active fraud detection. Services run HLR (Home Location Register) lookups to check whether a number is attached to a real SIM on a real carrier - phone intelligence APIs return the line type (mobile, landline, VoIP), carrier name, and reachability status, making it straightforward to identify and block virtual numbers. VoIP fails. Google Voice fails. Most "free SMS" services fail. It's become a real bottleneck for anyone running a de-Googled setup. For a deeper look at how these detection mechanisms work, see How Platforms Detect Virtual Phone Numbers in 2026.

Non-VoIP SMS verification through real SIM-card numbers is the only reliable path at this point. VoidMob's SMS service provides this through a web dashboard with no app install, no Play Store dependency, and no account creation requiring email. Pick a number from the pool, request the verification, read the code on the dashboard. Non-VoIP numbers typically show 95%+ success rates across major platforms, compared to the 20-40% success rates VoIP numbers achieve. Over 250 platforms supported - Signal, Telegram, WhatsApp, Discord, Instagram, crypto exchanges, and more.

Because it's web-based, verification happens in Vanadium (GrapheneOS's hardened Chromium fork) or any browser. No sideloaded APK. No permissions granted.

Mobile Proxy as a GrapheneOS VPN Alternative

Mullvad is good software. A datacenter IP is still a datacenter IP though, and platforms maintain lists. Someone logging into Instagram from a Mullvad exit node is connecting from an IP already flagged as "commercial VPN / hosting provider" in databases like MaxMind and IP intelligence scoring APIs. Captchas, blocks, forced re-verification. It defeats half the purpose of having a privacy phone in the first place.

A GrapheneOS VPN alternative that actually works for daily use relies on mobile proxy infrastructure. Real 4G/5G IPs assigned by carriers to real devices. These IPs sit in residential/mobile ranges that platforms trust because they look like a person on a phone - because they are. The difference between a mobile IP and a datacenter IP is visible at the ASN level: mobile IPs belong to carrier ASNs, while datacenter IPs belong to hosting provider ASNs that platforms specifically flag.

VoidMob's dedicated 5G mobile proxies support VLESS protocol over Xray, meaning they can be configured in VPN mode on GrapheneOS using apps like V2rayNG (available on F-Droid via IzzyOnDroid repo). Three details worth highlighting:

1. Carrier-native DNS resolution. DNS queries don't leak to Google or Cloudflare - they resolve through the carrier's own DNS servers. Exactly what a normal phone does. No DNS/IP mismatch for platforms to detect.
2. Full UDP support via SOCKS5 and VPN mode. VoIP calls, QUIC/HTTP3, WebRTC all work natively - most proxy providers only support TCP, silently dropping or encapsulating UDP traffic.
3. Real device p0f fingerprint. The proxy runs on actual 5G hardware, so TCP/IP stack fingerprints (TTL, window size, MSS) match a real mobile device. Datacenter VPNs leak Linux server fingerprints that platforms detect with passive OS fingerprinting.

The combination of carrier-native DNS, real device fingerprint, and full UDP means the proxy is indistinguishable from a normal phone connection at every layer platforms inspect.

VLESS Configuration for V2rayNG

1
{
2
"outbounds": [
3
  {
4
    "protocol": "vless",
5
    "settings": {
6
      "vnext": [
7
        {
8
          "address": "your-proxy-endpoint.voidmob.com",
9
          "port": 443,
10
          "users": [
11
            {
12
              "id": "your-uuid-here",
13
              "encryption": "none"
14
            }
15
          ]
16
        }
17
      ]
18
    },
19
    "streamSettings": {
20
      "network": "ws",
21
      "security": "tls",
22
      "wsSettings": {
23
        "path": "/vless"
24
      }
25
    }
26
  }
27
]
28
}

After importing the config and connecting, verify everything is clean. Run the platform trust score tool - it checks your IP type, fingerprint, WebRTC leaks, and location consistency in one pass. If the proxy is configured correctly, you'll see a mobile/residential IP classification, no WebRTC leak, and matching timezone/geolocation signals. For more on VLESS proxy configuration patterns and why the protocol handles geo-access better than standard VPNs, see VLESS Xray Private Mobile Proxies: Undetected Geo Access.

Enabling the VPN Kill Switch

After configuring V2rayNG, enable GrapheneOS's kill switch: Settings > Network & internet > VPN > [V2rayNG] > Always-on VPN + Block connections without VPN. All traffic now routes through the GrapheneOS mobile proxy with a carrier-grade IP. No leaks.

Private DNS: Don't Override Your Carrier-Native DNS

This is a detail most guides get wrong. If you've set Private DNS to Quad9 (dns.quad9.net) or Cloudflare (1dot1dot1dot1.cloudflare-dns.com) in Settings > Network & internet > Private DNS, it will override the carrier-native DNS that VoidMob's proxy provides. The result: your IP says T-Mobile but your DNS queries resolve through Cloudflare - a mismatch that sophisticated platforms detect and flag. DNS resolution is one of the first signals checked when platforms assess whether a connection is consistent with its claimed origin.

When using VoidMob proxy in VPN mode, set Private DNS to Off or Automatic. This allows DNS queries to resolve through the carrier's own infrastructure, matching your IP's ASN perfectly. If you're not connected to the proxy (e.g., on trusted home wifi), you can switch Private DNS back to your preferred resolver.

Profile Compartmentalization With Separate Proxy IPs

GrapheneOS supports multiple user profiles (Owner, Work, and additional user profiles), each sandboxed from the others. Apps and data cannot cross between profiles. This is where things get genuinely interesting for operational security.

Each profile can have its own V2rayNG configuration pointing to a different VoidMob proxy IP. Owner profile gets a US mobile IP. Work profile gets a UK mobile IP. A third profile for sensitive accounts gets a rotating IP from a different region entirely. Traffic from each profile exits through a completely different carrier endpoint, so even if one profile is compromised or correlated, the others stay isolated.

Setting this up is straightforward: install V2rayNG separately in each profile (GrapheneOS treats each profile as an independent Android user with its own app sandbox), import distinct VLESS configs, enable the VPN kill switch per-profile.

On top of that, each profile can use separate VoidMob SMS numbers for verification. Profile A verifies with number X, Profile B with number Y. No cross-contamination between identities.

GrapheneOS also offers Private Space - a newer feature that lets you lock and hide apps with separate VPN configurations directly in the app drawer, without full profile switching. Simpler for users who don't need complete profile isolation but want to compartmentalize a few sensitive apps behind a different proxy IP.

The End Session function fully shuts down a profile when you're done, stopping all background processes and telemetry. The profile's data remains encrypted and inaccessible until you switch back to it and authenticate.

Duress PIN, Auto-Reboot, and Border Crossing OPSEC

Duress PIN and eSIM Wipe

GrapheneOS supports a duress PIN - a secondary PIN/password that triggers a full device wipe when entered at the lock screen. When triggered, the device deletes decryption keys, shuts down, and presents as a factory-fresh device on next boot. Critically, the wipe includes all installed eSIM profiles - the number, the carrier association, and any session data are destroyed along with everything else.

A softer approach exists though. Before crossing, delete the eSIM profile entirely (Settings > Network & internet > SIMs > [eSIM] > Delete). Now the phone presents as a clean device with no carrier connection, no call logs, no SMS history tied to a number. After crossing, re-scan the QR code from VoidMob's dashboard (accessible via any browser on any device) and re-provision in under 60 seconds. Same data plan, fully restored. No interaction with a carrier store. No ID check.

Auto-Reboot: Clearing Memory Automatically

GrapheneOS's auto-reboot feature (Settings > Security & privacy > Exploit protection > Auto reboot) automatically reboots the device after a configurable period of inactivity (recommended: 18-24 hours). After reboot, the device returns to a fully encrypted BFU (Before First Unlock) state - all user data, eSIM session tokens, decrypted keys, and cached credentials are purged from memory. This protects against forensic extraction tools that exploit data sitting in RAM on unlocked devices.

Set it and forget it. If your phone sits overnight without being unlocked, it reboots into a state where even Cellebrite can't extract meaningful data without your PIN.

MAC Randomization

GrapheneOS randomizes your device's MAC address on every wifi connection by default. Combined with the VoidMob stack, this means: your device doesn't leak a persistent hardware identifier on networks (MAC randomization), your IP doesn't trace back to your identity (no-KYC eSIM + mobile proxy), and your phone verification doesn't link to your real number (non-VoIP SMS). Three layers of separation between your physical device and your digital footprint. The EFF's privacy guidance frames this kind of layered approach - identifier separation at hardware, network, and application layers - as the baseline for effective privacy hygiene.

Troubleshooting Common Issues

eSIM won't activate after QR scan: Reboot into safe mode and re-scan. Some Pixel firmware versions cache a failed provisioning attempt. Clearing the carrier services cache (Settings > Apps > Show system > Carrier Services > Clear cache) resolves this in most cases. Also confirm the eSIM support toggle is enabled at Settings > Network & internet > eSIM support - this is separate from the SIM management screen.

V2rayNG shows "failed to start" with VLESS config: Check that the UUID and WebSocket path match exactly. A trailing slash in the path (/vless/ vs /vless) will silently break the handshake. Also confirm the system clock is accurate - TLS certificate validation fails with clock drift beyond approximately 90 seconds. Once connected, run the platform trust score tool to confirm your IP registers as mobile/residential and not datacenter.

"Block connections without VPN" kills eSIM data: Expected behavior. That kill switch blocks ALL non-VPN traffic, including carrier data that isn't tunneled. V2rayNG needs to be set as the system VPN before enabling the toggle. If data drops, toggle airplane mode on/off to force a reconnection through the proxy.

DNS queries still resolving through Cloudflare/Google despite proxy: Check Private DNS settings. If set to a specific provider hostname, it overrides the proxy's carrier-native DNS. Set to Off or Automatic when using VoidMob proxy in VPN mode.

SMS code never arrives: Confirm the target platform isn't geo-restricting the number. Some services reject US numbers for non-US account creation. In those cases, request a number matching the account's region from the VoidMob SMS dashboard.

FAQ

Wrapping Up

A proper GrapheneOS setup doesn't end at the OS layer. Carrier connectivity, SMS verification, and browsing through trusted IPs are what actually determine whether the phone works as a daily driver or just sits in a drawer looking secure. VoidMob consolidates all three into a single no-KYC dashboard with crypto payments and no app dependencies: eSIM, non-VoIP SMS, and mobile proxy. That's the full GrapheneOS privacy stack, from silicon to signal.

For a deeper comparison of eSIM providers and how their routing affects your privacy posture, see No-KYC eSIM Providers Compared 2026.