Private phones for small teams
What it actually takes to move a five-person company off stock Android and Google Workspace — the setup we recommend, the costs, and what breaks.
Most degoogling advice is written for individuals with infinite patience. A business has different constraints: phones must work on day one, the setup must survive an employee who doesn’t care about privacy, and someone has to be able to say what it costs. This is the playbook we recommend for teams of roughly 3–15 people — a composite of the setups we’ve researched and tested, with real numbers.
Why a small business would want private phones
Three reasons that aren’t ideology:
- Client confidentiality is a selling point. Law, health, consulting, journalism, security — “our phones don’t report to an ad company” is a sentence clients understand.
- Attack surface. A stock Android fleet full of personal Google accounts, ad SDKs and sideloaded junk is the soft target. GrapheneOS phones with a curated app set are dramatically harder to phish and exploit.
- Data protection compliance gets simpler when telemetry isn’t leaving the building by default.
The recommended fleet
Pixel 9a (new) or Pixel 8 (renewed) + GrapheneOS. One model for everyone — support burden scales with variety, not headcount. The 9a is cheap enough to buy new with updates into the 2030s; renewed Pixel 8s cut the price further with the same 7-year hardware promise.
Price a Pixel 9a fleet on Amazon
affiliate link — same price for you, small commission for us
Why GrapheneOS and not /e/OS or CalyxOS for business? Sandboxed Google Play. Your team will have some app that assumes real Play services — an airline app, a bank, a client’s portal. On GrapheneOS those almost always just work; on microG-based systems “almost always” becomes “usually,” and “usually” generates support tickets. (For a one-person business willing to tinker, the calculus is different.)
Don’t want to flash five phones? NitroPhone and Above sell Pixels with GrapheneOS preinstalled at a markup of roughly €100–200 per device — often worth it for the warranty-with-support relationship alone.
The services layer
Phones are half the migration; Google Workspace is the other half.
- Email/calendar/storage: Proton for Business — closest like-for-like Workspace replacement with custom domain, shared calendars and Drive. If you have any IT capacity, self-hosted Nextcloud on a small server replaces Drive/Docs/Photos for the price of the hardware.
- Messaging: Signal for external, anything E2E for internal.
- Passwords: Bitwarden Teams — shared collections are the feature that makes offboarding sane.
- 2FA: Aegis on each phone, vault exports stored in Bitwarden.
The rest of the per-phone setup is the starter pack, installed identically on every device.
Get the next guide in your inbox
One email a week: new degoogling guides, OS and device-support news that matters, and one privacy fix you can do in five minutes. No tracking pixels.
Management, honestly
Here’s the part vendors gloss over: GrapheneOS does not integrate with traditional MDM suites. You will not push policies from Intune. For a 5-person team this matters less than it sounds — what works instead:
- A written one-page setup standard (OS, app list, screen-lock policy, update settings) applied at handout.
- Owner/profile separation: company apps in the owner profile, anything personal in a separate user profile. Built into GrapheneOS, takes minutes.
- Auto-updates are on by default for both OS and apps — the fleet stays patched without an admin console.
- A spare configured phone on a shelf. Fastest incident response a small company can buy.
If regulatory requirements genuinely mandate MDM, stop here — you need a different article and probably different phones.
What breaks
- Tap-to-pay, outside Europe. Google Wallet won’t run on a degoogled phone. UK and EEA teams can close this gap with Curve Pay or a bank app that does its own contactless; US teams keep company cards physical.
- One legacy app, somewhere. In every migration there’s one — a fuel-card app, a courier portal — that misbehaves. Test your five most critical apps on one phone in week one, before buying five.
- Google Meet links from clients work fine in the browser or the sandboxed app; nobody on the outside will notice anything changed.
The bill, roughly
For a five-person team: five Pixel 9a class phones (~€2,500 new, or ~€1,700 renewed 8s), Proton Business at ~€13/user/month, Bitwarden Teams ~€4/user/month, plus one afternoon per phone of setup the first time (an hour each once you’ve done one). Call it ~€3,000 up front and ~€85/month — for a fleet where the operating system’s business model isn’t your data.
Run your own phones through the device checker first if you’re hoping to reuse existing hardware — carrier-locked devices are the usual dealbreaker.