INDEX / DIRECTORY / GRAPHENEOS / DIGITAL

GrapheneOS DIGITAL

DIGITAL INFRASTRUCTURE AUDIT UPDATED 2026-09-07
Digital Score 0.00 /10 E GrapheneOS - BDS-1000 0
Digital 0.00

Evidence-only forensic audit. Scoring happens downstream - see the main dossier for the composite assessment.

Forensic audits like this are reader-funded - no sponsors, no ads. Support OpenIntel →

Enterprise Technology Stack & Vendor Relationships

GrapheneOS Foundation is an active Canadian federal not-for-profit corporation incorporated on 17 March 2023, and the federal register lists its registered office in Toronto, Ontario 1.

The federal register lists Khalykbek Yelshibekov, Daniel Micay, and Dmytro Mukhomor as directors, while GrapheneOS identifies Daniel Micay as founder of the underlying project in late 2014 1, 2, 3.

GrapheneOS states that the Foundation was created to receive and distribute donations, which it says support developer payments, hardware, infrastructure, and legal fees 4, 5.

The project states that its code copyright remains with individual GrapheneOS developers and that no copyright assignment has occurred 4.

GrapheneOS’s published server inventory identifies DataPacket, Xenyth, Vultr, Misaka.io, Cherry Servers, ReliableSite, Zare, netcup, and BuyVM as providers or sponsors for listed services 6.

That inventory does not identify Check Point, Wiz, SentinelOne, CyberArk, Nice, Verint, Claroty, Palo Alto Networks, or another Israeli-origin enterprise-security vendor 6.

No public evidence identified of a GrapheneOS procurement, licensing, subscription, integration, systems-integrator, outsourcing, or reseller relationship involving Israeli-origin enterprise software.

GrapheneOS states that a former sponsor associated with the project’s CopperheadOS period is no longer associated with GrapheneOS, and the cited history does not document an Israeli commercial relationship or continuing connection to that former sponsor 2.

Surveillance, Biometrics & Retail Technology

No public evidence identified that GrapheneOS uses or provides Israeli-origin facial recognition, biometric identification, behavioural analytics, gait analysis, predictive policing, sentiment analysis, social-media monitoring, or workforce-surveillance technology 6, 7.

No public evidence identified that such technologies reach GrapheneOS through a named managed-security provider or bundled enterprise suite 6.

GrapheneOS describes its product as an Android-compatible mobile operating system and does not present it in the reviewed materials as a retail-technology, biometric, or surveillance platform 7, 8.

Cloud Infrastructure, Data Residency & Sovereign Cloud Participation

GrapheneOS publishes locations for public DNS, website and network, release, geocoding, attestation, and mail services, including locations in Europe, North America, South America, Asia, and Australia 6.

No Israel location appears in that published infrastructure inventory 6.

Listed network services include release and app-repository delivery, connectivity checks, time services, location and geocoding proxies, and selected reverse proxies 6.

The published endpoints include proxies to Google remote provisioning and SUPL, Apple network location, OpenStreetMap Nominatim, and Chromium update services 6.

GrapheneOS does not bundle Google applications or services, although its documentation states that users may choose to install official Google Play services as ordinary sandboxed applications in a selected profile 7.

GrapheneOS states that sandboxed Google Play services receive no special operating-system privileges and require user-granted permissions for profile data 7.

This optional end-user configuration does not establish a GrapheneOS commercial, licensing, procurement, or cloud-contract relationship with Google 7, 8.

Project Nimbus official materials identify Google Cloud as a supplier of public-cloud services to Israeli government entities and state that local cloud sites process and store information inside Israel 9, 10.

The cited Nimbus materials do not name GrapheneOS as a contractor, subcontractor, participant, or customer 9, 10.

No public evidence identified of GrapheneOS data-centre operations in Israel, Project Nimbus participation, Israeli government-cloud contracting, or services marketed to Israeli state or military bodies for data sovereignty or resilience 6, 9, 10.

The available project materials do not provide a complete map of downstream routing by user-installed applications, mobile carriers, device vendors, app developers, or third-party services 6, 7.

Defence, Intelligence & Security Sector Technology Relationships

No public evidence identified of a contract, partnership, service agreement, app-distribution arrangement, procurement relationship, or technical integration between GrapheneOS and the Israeli Ministry of Defence, the IDF, Israeli intelligence agencies, Israeli police, or another Israeli state-security body 6, 7, 11.

No public evidence identified that GrapheneOS develops, sells, licenses, or maintains offensive-cyber tools, zero-day exploit capabilities, exploit tools, or digital weapons systems for Israeli state actors 2, 7.

The reviewed public materials describe a non-profit open-source mobile-OS project rather than a defence or security-sector supplier 4, 8.

No primary procurement record naming GrapheneOS was located within the bounded research represented by this memo.

AI, Algorithmic & Autonomous Systems

No public evidence identified that GrapheneOS provides AI or machine-learning, computer-vision, autonomous decision-support, target-generation, automated tracking, or surveillance-derived-data systems to Israeli state, military, intelligence, or security bodies 7, 9, 10.

No public evidence identified that GrapheneOS models or platforms were trained on, or provided access to, civilian-population data, intercepted communications, or surveillance data from Israel or the occupied Palestinian territory 7, 11.

No public evidence identified of GrapheneOS provision of purpose-built autonomous targeting, fire-control, target-generation, or autonomous tracking systems 2, 7.

The supplied review of the UN Human Rights Council report A/HRC/59/23 found no mention of GrapheneOS, which is a document-scoped result rather than evidence of database-wide absence 11.

Technology Ecosystem & R&D Footprint

GrapheneOS states that Daniel Micay founded the project in late 2014 and that a company incorporated in late 2015 later served as a sponsor during the CopperheadOS period 2.

GrapheneOS states that this former sponsor is no longer associated with the project following a 2018 dispute 2.

The cited project history supplies no Israeli R&D, investment, acquisition, patent, university co-development, or defence-industry affiliation 2.

No public evidence identified of GrapheneOS-operated Israeli R&D facilities, engineering offices, innovation labs, accelerators, acquisitions, strategic investments, venture-fund investments, patent-licensing arrangements, or research co-development with Israeli-domiciled companies or institutions 2, 6, 8.

GrapheneOS states that its code is owned by its developers and distributed under open-source licences, and its reviewed materials do not disclose an Israeli-domiciled intellectual-property counterparty 4, 8.

No public evidence identified in the reviewed corporate and project materials of an Israeli incorporation, office, branch, subsidiary, parent company, franchisee, or disclosed shareholding structure 1, 4, 2.

Civil Society Scrutiny & Regulatory History

The supplied deterministic full-text pre-scan found no GrapheneOS mention in the reviewed UN A/HRC/59/23 report, OHCHR settlement-business database updates, BDS corporate-priority materials, and the other specified NGO and UN documents 11, 12, 13.

That result is limited to the identified documents and editions and does not establish database-wide, sector-wide, or exhaustive absence of relevant activity 11, 12, 13.

No public evidence identified of a published boycott, divestment, or sanctions campaign specifically directed at GrapheneOS for technology provision to Israel or occupied territories 11, 12, 13.

No public evidence identified of regulatory inquiries, export-control actions, sanctions investigations, or legal challenges concerning GrapheneOS technology sales or services to Israeli state entities 1, 11.

The federal register records annual returns for 2024, 2025, and 2026 and lists the Foundation’s last annual meeting as 29 June 2025 1.

The reviewed public materials do not identify a current CEO, chair, complete board, C-suite, shareholder register, or controlling-owner list 1, 4, 2.

Footnotes

  1. https://ised-isde.canada.ca/cc/lgcy/fdrlCrpDtls.html?corpId=14857577&p=0 ↩ ↩2 ↩3 ↩4 ↩5 ↩6

  2. https://grapheneos.org/history/ ↩ ↩2 ↩3 ↩4 ↩5 ↩6 ↩7 ↩8 ↩9 ↩10

  3. https://github.com/thestinger ↩

  4. https://grapheneos.org/faq ↩ ↩2 ↩3 ↩4 ↩5 ↩6

  5. https://grapheneos.org/donate ↩

  6. https://grapheneos.org/articles/grapheneos-servers ↩ ↩2 ↩3 ↩4 ↩5 ↩6 ↩7 ↩8 ↩9 ↩10 ↩11 ↩12

  7. https://grapheneos.org/usage ↩ ↩2 ↩3 ↩4 ↩5 ↩6 ↩7 ↩8 ↩9 ↩10 ↩11

  8. https://grapheneos.org/ ↩ ↩2 ↩3 ↩4 ↩5

  9. https://www.gov.il/en/pages/_bpress_20102022 ↩ ↩2 ↩3 ↩4

  10. https://cloud.google.com/blog/topics/inside-google-cloud/google-cloud-selected-to-provide-cloud-services-to-the-state-of-israel ↩ ↩2 ↩3 ↩4

  11. https://docs.un.org/en/A/HRC/59/23 ↩ ↩2 ↩3 ↩4 ↩5 ↩6 ↩7

  12. https://www.ohchr.org/en/press-releases/2025/09/un-human-rights-office-updates-database-businesses-involved-israeli ↩ ↩2 ↩3

  13. https://bdsmovement.net/Guide-to-BDS-Boycott ↩ ↩2 ↩3