Operational Guide
Kill Switch
The kill switch is a software-triggered emergency wipe. It destroys the keys protecting the encrypted filesystem so that data is no longer recoverable. Read this before you need it — in an emergency, you will not have time to learn the procedure.
Honest disclosure
There are no physical circuit-cutting kill switches on this device. The hardware is a Google Pixel; there is nothing to physically sever. The kill switch destroys the encryption keys in software.
Activation
- From the lock screen, enter the duress PIN you configured during onboarding.
- The device confirms the wipe is in progress with a single brief flash — no warning dialog, no cancel option.
- Wipe completes within seconds. The device reboots into a re-provisioning state and is unusable until support re-provisions it.
The duress PIN must be different from your normal unlock PIN. We recommend rehearsing the keystroke sequence on a non-production device before you carry the phone into a high-risk environment.
Scope of the Wipe
Destroyed
- • Filesystem encryption keys
- • Signal message database
- • Tor circuit state and credentials
- • eSIM profile (must be re-provisioned)
- • All user data, contacts, and history
Survives
- • Stock distribution image (re-installable)
- • Bootloader state (still IP-verified / locked)
- • Hardware itself (the Pixel is unharmed)
The wipe destroys keys, not the storage cells. Forensic recovery of the encrypted ciphertext is possible, but without the keys it is computationally infeasible. We do not market this as hardware-attested erasure — because it is not.
Recovery / Re-Provisioning
- Contact VaultPhone support over Signal (see emergency contact below). Identify yourself with your order alias.
- Support verifies the device serial against the order record and issues a re-provisioning token.
- Boot the wiped device, enter the token, and download a fresh distribution image. The bootloader remains locked throughout.
- Re-provision a new eSIM profile (see the eSIM guide).
- Reinstall Signal and re-register if you intend to keep the same Signal identity. Otherwise, register a new identity.
Emergency Support Contact
If you have triggered the kill switch and need re-provisioning, or if your device has been seized, contact support over Signal — do not use email, SMS, or any account that can be tied to your identity.