GrapheneOS
Security and privacy hardened Android forms the upstream operating system foundation for Obris SecureOS.
SOURCE & TRANSPARENCY
Transparency you can verify. Innovation we can protect.
Obris SecureOS builds on open source foundations. We publish the material people need to understand what they are trusting, meet applicable source and attribution obligations, and verify authentic releases without publishing every Obris developed commercial implementation.
Our trust model combines open upstream foundations, documented security architecture, release verification and independent review of proprietary Obris security components.
01 · OPEN FOUNDATIONS
Start with code that is already open.
Obris SecureOS is derived from GrapheneOS and the Android Open Source Project. Those projects remain the upstream foundation. Obris maintains its own modifications and product integration on top.
Android Open Source Project
AOSP provides the underlying Android platform and the open source components on which the operating system is built.
Licences & attribution
Obris tracks component licences and publishes source, notices and attribution where an applicable licence requires it.
References to GrapheneOS describe the upstream technical foundation and do not imply that Obris SecureOS is an official GrapheneOS product.
02 · WHAT WE PUBLISH
Evidence you can check without receiving our commercial source tree.
Trust should come from concrete artefacts, not a broad claim that everything is open source.
Required source & notices
Source code, licence notices and attribution are made available where the applicable component licence requires distribution.
Security architecture
Document the security boundaries, supported devices, Security User model, YubiKey workflow and the responsibilities of each Obris layer.
Release identity
Publish release identifiers, supported device information, security patch information and the public material needed to identify an authentic release.
Hashes & signatures
Provide cryptographic hashes and public verification information so downloaded release artefacts can be checked independently.
Changelog
Describe security relevant changes and fixes without exposing credentials, private infrastructure or anti abuse controls.
Dependency inventory
Build toward a maintained component and dependency inventory, including an SBOM where it provides meaningful verification value.
03 · PROPRIETARY OBRIS TECHNOLOGY
Not every Obris component needs to be public to be reviewable.
Some Obris developed technology is commercial intellectual property. We can protect that implementation while still giving qualified independent reviewers controlled access to evaluate its security properties.
Protected commercial implementation
Proprietary components can remain outside public repositories. That includes technology where publication would disclose Obris implementation details without materially improving a customer's ability to verify an installed release.
- Obris specific commercial implementation details
- Subscription, entitlement and customer service logic
- Backend orchestration and operational tooling
- Fraud, abuse and internal monitoring controls
- Infrastructure configuration and deployment systems
TRUST WITHOUT PUBLICATION
Independent review under controlled access.
The intended model is to let an independent security firm inspect selected proprietary security critical components under appropriate confidentiality terms, then publish the audit scope, reviewed version, findings and remediation status.
Independent Obris review programmePlanned — no completed audit is claimed on this page.
04 · VERIFY A RELEASE
Connect the documentation to the software you actually install.
For each production release, the goal is to publish a compact verification record that ties the documented release to its downloadable artefacts.
Release IDPublished per production release
DeviceSupported Pixel model & codename
PlatformAndroid / security patch level
Artefact hashSHA-256
Release signaturePublicly verifiable
Source referenceApplicable published source / notices
01DownloadObtain the signed Obris release.
→
02HashCompare the published artefact hash.
→
03VerifyValidate the release signature.
→
04MatchConfirm the release identity and documentation.
05 · WHAT NEVER BELONGS IN PUBLIC SOURCE
Transparency does not mean publishing authority or credentials.
Private signing material and operational credentials are not source transparency. Publishing them would reduce security rather than increase trust.
Release signing private keysPrivate
AVB / OTA private signing materialPrivate
Database & service credentialsPrivate
Cloud & SSH credentialsPrivate
Customer cryptographic private materialPrivate
Internal operational security configurationPrivate
06 · TRANSPARENCY ROADMAP
Trust claims should have visible status.
We will distinguish between what is available now, what is being prepared and what remains a future security assurance milestone.
AVAILABLE / REQUIRED
Upstream source, licensing and attribution
Maintain access to upstream source and satisfy applicable source and notice obligations for distributed components.
IN PROGRESS
Obris release verification records
Standardise release identifiers, hashes, signature information and source references for production SecureOS releases.
PLANNED
Independent security review
Commission qualified third party review of selected proprietary security critical components and publish meaningful results.
Open foundations. Transparent architecture. Audited proprietary innovation. Verifiable releases.
That model gives customers evidence about the security of Obris products while preserving the commercial implementation that differentiates them.