Privacy & security terms, in plain language
The jargon around hardened phones and anonymous connectivity, defined honestly and without marketing spin. Each term links on to the tool or page where it actually matters, where there is one.
22 terms
Device & operating system
The hardware and software that decide how much a phone can be trusted before you type a single password into it.
- GrapheneOS
- A security- and privacy-focused mobile operating system based on the Android Open Source Project. It adds hardened defences — a stronger memory allocator, tighter sandboxing, and no Google services by default — and runs only on Google Pixel hardware, because those devices allow the bootloader to be re-locked after installation. It is free, open source, and independent; NordSecure is not affiliated with the project. how we install it
- Verified boot
- A hardware-backed check, run every time the phone powers on, that confirms the operating system hasn't been modified since it was installed. If anything was tampered with, the device warns you or refuses to boot. It only provides that guarantee when the bootloader is re-locked with the installed OS's own keys. verify it yourself
- Bootloader (locked / unlocked)
- The low-level code that starts the operating system. An unlocked bootloader will boot any system image, which is what makes installing a custom OS possible — but left unlocked it also means the phone can't prove it's running what it claims. Re-locking it after installation is the step that turns verified boot back on.
- Attestation
- A cryptographic process where the phone's security chip proves which operating system booted and whether verified boot is enforcing — a statement made by the hardware, not by an app that could lie about itself. The GrapheneOS Auditor app uses it to let you check a device against keys the seller doesn't hold. the attestation walkthrough
- Secure element (Titan M2)
- A dedicated tamper-resistant chip, separate from the main processor, that stores cryptographic keys and enforces limits on passcode guessing. On Pixel phones this is the Titan M2. It's what makes brute-forcing a strong PIN impractical even with physical access to the device.
- Sandboxed Google Play
- A way of running the ordinary Google Play apps as normal, unprivileged applications confined to a sandbox, instead of granting them the deep system access they have on a stock phone. Your banking or messaging apps still work, but Google Play can't reach across the rest of the device.
- Duress PIN
- A secondary PIN or password that, when entered, immediately and irreversibly wipes the device's encryption keys — rendering the data unrecoverable. It's a defence for situations where you may be forced to unlock a phone against your will.
- Hardened memory allocator
- A replacement for the system component that hands out memory to running programs, designed to make whole classes of exploitation (use-after-free, heap overflows) far harder to pull off. It's one of the low-level defences that runs invisibly, all the time, on a hardened OS.
Connectivity & eSIM
The identifiers and mechanics behind mobile data and numbers — and where your identity does, or doesn't, get attached.
- eSIM
- A SIM card built into the phone as software rather than a removable plastic card. An eSIM profile is installed by scanning a QR code, activates when it first connects to a network, and can run alongside a physical SIM so you keep your usual number. check your phone
- ICCID
- The Integrated Circuit Card Identifier — the unique serial number of a SIM or eSIM profile. It identifies the SIM itself, not you, and is what you use to top up or manage an anonymous eSIM without any account. top up by ICCID
- EID
- The eUICC Identifier — the serial number of the eSIM hardware embedded in a phone. Dialling *#06# shows it next to the IMEI; if an EID appears, the phone has eSIM support. eSIM compatibility checker
- IMEI
- The International Mobile Equipment Identity — a unique number identifying the physical phone on a mobile network, independent of the SIM in it. Networks can use it to block a specific handset. Dial *#06# to see it.
- Carrier number vs VoIP number
- A carrier number lives on a real mobile network and behaves like any normal mobile line; a VoIP number is an internet phone number. Many services (banks, and apps like Signal or WhatsApp) check for and reject VoIP numbers, which is why a real carrier number has a higher acceptance rate for verification. real carrier numbers
- SIM registration
- A legal requirement in some countries to tie a mobile number to a verified identity before it can be used. It applies to local carriers in those countries; travel data eSIMs are generally sold to visitors without it, though rules vary by country and change over time.
Network & browser privacy
What your connection and browser reveal about you — and the signals and leaks worth understanding before you trust a VPN.
- KYC (Know Your Customer)
- Identity-verification checks a business performs on customers — typically name, address, and government ID. "No-KYC" means a purchase completes without collecting any of that; you're identified by an order reference, not a verified identity.
- SIM swapping
- An attack where someone convinces your mobile carrier to move your number to a SIM they control, intercepting your calls and text-message login codes. It's why SMS is a weak second factor and why a number that isn't publicly tied to you is harder to target. how SIM swapping works
- WebRTC leak
- WebRTC is a browser feature for real-time audio and video. To connect two people it gathers your device's network addresses, and a web page can read them with JavaScript — sometimes exposing your real IP address even while a VPN is active. run a WebRTC leak test
- DNS leak
- When your device's domain lookups ("what's the IP for this website?") travel to your internet provider's resolver instead of through your VPN. Even with a working VPN, a DNS leak lets your provider see every site you visit. check your IP & DNS exposure
- Browser fingerprinting
- Recognising a browser by combining many small, individually-harmless details — screen size, timezone, fonts, graphics rendering — into a profile unique enough to track you across sites without any cookie. Blending in beats standing out. check your fingerprint
- Global Privacy Control (GPC)
- A browser signal that tells websites you opt out of the sale or sharing of your personal data. Unlike its predecessor Do Not Track, GPC carries legal weight in some jurisdictions — under laws such as California's CCPA/CPRA it must be honoured by covered businesses. check your privacy signals
- Do Not Track (DNT)
- An older browser setting that asked websites not to track you. It was a request with no legal force, almost universally ignored, and has since been removed or deprecated in most browsers. GPC is its successor with actual teeth. DNT & GPC checker
- IPv6
- The newer, longer format of internet address (like 2001:db8::1) that runs alongside the older IPv4. It matters for privacy because a VPN that only covers IPv4 can leave your real IPv6 address exposed while everything looks protected. check IPv6 exposure
From definitions to a phone that does this by default
Most of these terms describe defences you'd otherwise assemble yourself. NordSecure ships them pre-configured on privacy-hardened Pixel phones, alongside anonymous data eSIMs and free tools to test your own setup.