Our process & tiers

What actually happens to a unit before it reaches you, and what each tier means in practice.

How a unit gets here

  1. Acquired

    We source off-lease laptops and used/new Pixels — nothing sold here started life as e-waste we didn't inspect first.

  2. Refurb

    Cleaned, SSD/RAM upgraded where it makes sense, a full hardware inventory recorded for the unit.

  3. QA

    A real diagnostic pass — battery health, disk health (SMART), Wi-Fi/Bluetooth, webcam, mic, ports, keyboard, trackpad, and a burn-in test. Anything that fails gets fixed or the unit doesn't get listed.

  4. Listed

    OS installed for the tier you're buying, encryption configured, and the unit goes up in the shop.

  5. Sold & delivered

    You pick your OS/app/policy configuration at checkout, we build it, and hand it off — in person where possible, so there's no shipping-interception step between us finishing setup and you having the device.

Laptop tiers

Tier 1 — Everyday

$200–300

A clean, reliable Linux laptop for daily use — browsing, office work, media. No privacy background required.

  • Linux Mint Cinnamon (LTS)
  • Firefox, LibreOffice, Thunderbird, VLC, GIMP
  • Full-disk encryption, set up before handoff
  • Firmware updates applied (fwupd)
  • Timeshift configured for automatic backups

Tier 2 — Privacy

$300–400

Everything in Tier 1, plus a privacy-focused app set for buyers who want to reduce what they leak day to day.

  • Debian stable (or Fedora on request)
  • Signal Desktop, KeePassXC, VeraCrypt
  • Tor Browser, Mullvad Browser, uBlock Origin
  • Everything from Tier 1

Tier 3 — Journalist / Hardened

$450+

For journalists, activists, and anyone with a real threat model. Built together with you, not off a shelf.

  • Qubes OS with qube separation (work / personal / offline vault / disposable) on hardware that supports it, or a hardened Debian fallback otherwise
  • A Tails USB included
  • Disk encryption passphrase set by you, in person, at handoff — we never know it
  • A short threat-model conversation before we configure anything

Exact pricing depends on the specific unit's hardware — see individual listings for the actual price.

GrapheneOS Pixels

  • Flashed via the official GrapheneOS web installer, domain verified
  • Bootloader re-locked afterward — verified boot stays on
  • Vanadium kept as the default browser
  • Signal and other privacy apps preinstalled on request
  • Sandboxed Google Play only if you ask for it, and only in a separate profile — never the owner profile