SilverMetal/docs/platform-matrix.md

Platform Matrix

The honest per-platform capability and pros/cons table. This is what a buyer sees on each product page so they can choose based on their actual constraint.

Hardening tiers

Tier	What it means
A — Fully controllable	We own the kernel, boot chain, MAC framework, and update infrastructure
B — Firmware-controllable	We replace the OS stack but not every firmware blob
C — Config-controllable	Proprietary kernel; we harden at config + app layer
D — Policy-controllable	Closed platform; we ship profiles + curated apps + setup only

Capability summary

Platform	Tier	Deliverable	Stack support
SilverMetal Linux	A	Custom Debian/Kicksecure-based ISO	Full, native
SilverMetal Droid (Pixel)	B	GrapheneOS-fork ROM	Full, native
SilverMetal Droid (Samsung)	C	LineageOS-fork ROM where bootloader unlocks; profile + Stack elsewhere	Full where ROM, Stack-only otherwise
SilverMetal Droid (Motorola)	C	DivestOS/LineageOS-fork ROM on supported models	Full where supported
SilverMetal Droid (generic)	D	"Harden any Android" — Stack + work-profile config	Stack + config only
SilverMetal Windows	C	LTSC IoT installer + hardening + Stack	Full (Stack apps run native)
SilverMetal macOS	C-D	Signed config profile + setup script + Stack	Full (Stack apps run native)
SilverMetal iOS	D	MDM profile + Stack from App Store	Full (Stack apps via App Store)

Per-platform pros / cons

SilverMetal Linux (Tier A)

Reference setup. The strongest possible SilverMetal device.

Pros

• Full kernel-level hardening (KSPP, linux-hardened, hardened_malloc)
• Verified boot we control end-to-end (Secure Boot with our shim/MOK, TPM2 PCR-bound LUKS2)
• AppArmor strict profiles for every networked surface
• Reproducible builds; we publish SBOMs and build attestations
• Zero upstream telemetry — every Microsoft/Google/Mozilla/Canonical phone-home removed
• Full SilverLABS Stack runs natively
• Update channel and signing keys are ours

Cons

• Learning curve for users coming from Windows/Mac
• Some commercial software does not run natively (Adobe CC, MS Office native — though web/Office365 work, native MS Office does not)
• Some games, particularly anti-cheat-protected titles, will not run
• Hardware compatibility needs checking before purchase (Coreboot SKUs are best-supported)

Best for: users whose work is browser + email + office docs + dev + comms; anyone who would otherwise install Linux themselves; the maximum-privacy buyer.

---

SilverMetal Droid — Pixel flagship (Tier B)

The secure-phone flagship. GrapheneOS-tier engineering.

Pros

• Verified boot we control via Pixel's relockable bootloader
• Hardened Android kernel (GrapheneOS patches)
• App-level sandbox enforced; sandboxed Google Play optional, not required
• Per-app network/sensor/storage permissions
• Duress wipe (v1.1)
• Daily-driveable as a phone

Cons

• Pixel hardware only (4a 5G and newer — others EOL)
• Some banking apps and corporate apps refuse to run on non-Play-Integrity devices (workaround: sandboxed Play, but breaks the airtight model)
• Not all carriers support all Pixel models cleanly

Best for: the "secure phone" buyer, journalists, activists, anyone who would otherwise buy an Encrochat-style rebadged phone but wants real engineering.

---

SilverMetal Droid — Samsung (Tier C)

For users on Samsung hardware. Variable depending on model and region.

Pros

• Wide hardware availability and price range
• LineageOS / DivestOS fork for unlocked-bootloader regions gives most of the benefit
• Knox security layer is genuinely capable on locked models
• Full SilverLABS Stack supported either way

Cons

• Many Samsung models — especially US-carrier models — have permanently locked bootloaders; we cannot replace the OS
• Even on unlocked bootloader, we lose verified boot rooting back to our key
• Knox tripped flag is permanent; some Samsung features (Samsung Pay, Knox-protected work apps) may stop working

Best for: existing Samsung owners; buyers wanting a non-Pixel Android with strong-enough hardening.

---

SilverMetal Droid — Motorola (Tier C)

For users on Motorola hardware. Best Android option after Pixel for unlocked-bootloader hardening.

Pros

• Many Moto models support bootloader unlock cleanly
• DivestOS / LineageOS support is good for popular models
• More affordable than Pixel
• Full SilverLABS Stack supported

Cons

• Verified boot weaker than Pixel — no relockable bootloader on most models
• Hardware longevity / update support varies by model
• Driver / firmware blob situation messier than Pixel

Best for: budget-conscious buyer wanting custom-ROM-tier hardening without Pixel pricing.

---

SilverMetal Droid — Generic / "harden my existing Android" (Tier D)

For users who already own an Android and won't / can't replace the ROM.

Pros

• Works on virtually any Android 13+ device
• Full SilverLABS Stack runs (Browser, VPN, Sync, etc.)
• Work-profile-based isolation contains tracking apps in a managed sandbox
• No bootloader unlock required; no warranty void

Cons

• We do not control the OS — Google + your OEM still do
• Verified boot is your OEM's, not ours
• Telemetry from OS-level Google services cannot be fully blocked without a ROM swap
• Honest tier label: D, weakest Android tier

Best for: existing Android owners who want privacy improvements without buying new hardware or unlocking their bootloader.

---

SilverMetal Windows (Tier C)

For users locked into Windows-only software.

Pros

• Keeps full compatibility with Windows-native software, including Adobe CC, MS Office native, Windows-only line-of-business apps, anti-cheat-protected games
• Removes ~90% of Microsoft telemetry (Group Policy + hosts + service disabling, verified)
• Enforces BitLocker (TPM-bound), Defender ASR rules at maximum, AppLocker allow-listing
• LTSC IoT base = no Cortana, no Store, no Edge baked in, supportable for ~10 years
• Full SilverLABS Stack runs native
• Edge / Chrome replaced with SilverBrowser

Cons

• We do not control the kernel, the boot chain, or Windows Update
• Microsoft can change things in updates we cannot prevent
• Some telemetry channels Microsoft does not expose for disabling
• Honest tier label: C, config-layer only — we say this in marketing
• Requires LTSC IoT licensing for the strongest variant; standard Win 11 Pro is supported but weaker

Best for: business users and creatives who can't leave Windows but want every privacy dial turned to maximum.

---

SilverMetal macOS (Tier C-D)

For Mac-committed users.

Pros

• Apple hardware quality is excellent; Secure Enclave + FileVault are genuinely strong when configured
• Lockdown Mode dramatically reduces remote-attack surface
• Apple's app sandboxing is robust at the kernel layer
• Full SilverLABS Stack runs native (universal binaries)
• Safari replaced with SilverBrowser by default
• Telemetry / Siri / analytics all disabled by our profile

Cons

• We cannot modify macOS itself
• Apple still receives device-linked metadata we cannot fully stop (App Store auth, OS update checks, Apple ID)
• iCloud is required for some OS features; we scope it to absolute minimum
• Honest positioning: "hardened Mac," not "anonymous Mac"

Best for: Mac-committed users (creative professionals, developers on Apple Silicon) who want maximum-feasible hardening on hardware they're keeping.

---

SilverMetal iOS (Tier D)

For iPhone users.

Pros

• iOS sandbox + Secure Enclave + Lockdown Mode are genuinely strong against remote attack, in some respects stronger than any other consumer platform
• Full SilverLABS Stack available via App Store (Browser, VPN, Sync, Keys, Chat once approved)
• Hardware-key 2FA (YubiKey/Lightning) supported and recommended in our setup guide
• "Disposable Apple ID" guidance reduces account-graph exposure

Cons

• The most restrictive platform — Apple ID is unavoidable for App Store
• Cannot replace many default services (Mail.app, FaceTime, iMessage) — only complement them
• App-level replacements only via App Store (no sideloading in most regions yet)
• Configuration profile + MDM applies; cannot modify iOS itself
• Honest tier label: D, weakest tier in the family — we say this in marketing

Best for: users whose threat model is commercial surveillance (not state-actor targeting) and who need to stay on iPhone for personal/work reasons.

Decision flowchart

Does the user need maximum privacy and is software-flexible?
  → SilverMetal Linux

Does the user need a phone, primarily?
  → Pixel? → SilverMetal Droid Flagship
  → Samsung/Motorola with unlocked bootloader? → matching ROM tier
  → iPhone or locked Android? → corresponding profile tier

Does the user need Windows-only software?
  → SilverMetal Windows

Is the user Mac-committed?
  → SilverMetal macOS

Does the user already own a device they're keeping?
  → The corresponding "profile" or "harden existing" tier

We do not push users between tiers. We tell them what each can deliver and let them choose.