Sailfish OS and Europe’s quiet bid for a private smartphone

Sailfish OS and Europe’s quiet bid for a private smartphone

Jolla matters because it is trying to solve a deeper problem than handset branding. Europe can still design hardware, regulate platforms, and build privacy law. What it has not had for years is a mobile operating system with real commercial continuity, its own identity, and at least some chance of being used outside a laboratory or a hobbyist forum. In March 2026, Android and iOS together accounted for roughly 99.5% of mobile operating system usage in Europe, leaving almost no room for anything else. Jolla’s answer is Sailfish OS, a Linux-based system from Finland that now sits behind a new Jolla Phone and a long-running argument about privacy, independence, and digital sovereignty.

Jolla also knows how to market the idea. Its recent press materials describe the Jolla Phone as “Europe’s only independent smartphone” and Sailfish as Europe’s own alternative to iOS, Android, and HarmonyOS. That line is sharp, memorable, and not quite precise enough on its own. Europe also has /e/OS and Ubuntu Touch, both of which are real projects with real users. The stronger case for Sailfish is narrower and more interesting: it is the closest thing Europe currently has to a commercially maintained, non-AOSP mobile OS with its own Linux lineage, its own licensing model, and a privacy pitch built into both software and hardware. That is an inference from the available sources, not a formal industry category.

A European phone sounds simple until you define it

A “European phone” can mean at least four different things. It can mean a device assembled in Europe. It can mean a handset sold by a European company. It can mean a phone that follows European privacy rules. Or it can mean something much harder: a phone whose operating system, account layer, update path, and core software direction are not controlled by American or Chinese platform companies. Jolla is aiming at that fourth definition. Its public materials say the company compiles the software itself and installs it in Finland, and its recent phone campaigns tie that software control directly to privacy and independence.

That ambition lands in a market that is brutally concentrated. Statcounter’s March 2026 figures for Europe show Android at 59.39% and iOS at 40.15%, with everything else reduced to rounding error. A challenger is not entering a crowded field. It is entering a locked gate. That matters because mobile operating systems shape far more than the home screen. They decide which app frameworks survive, how payments work, how device APIs are exposed, how default cloud services behave, how location and telemetry are handled, and which companies get to sit between users and the rest of the web.

Jolla’s own framing is intentionally big. In its December 2025 press release, the company said only four commercial-grade mobile operating systems remain in the world: Apple’s iOS, Google’s Android, Huawei’s HarmonyOS, and Jolla’s Sailfish OS. That is a company claim, not an independent market taxonomy, but it points to something real. The mobile OS layer has become so concentrated that even small, imperfect alternatives gain strategic weight. A niche platform can still matter if it restores a little bargaining power, a little technical knowledge, or a little policy leverage.

The privacy angle only makes sense inside that broader picture. A phone is not private because it has tasteful branding or a clean settings page. It is private if the system avoids compulsory identity lock-in, avoids unnecessary telemetry, gives the user meaningful control over local data, and does not force every ordinary task through one company’s account architecture. Jolla’s argument is that Sailfish gives Europe a shot at that sort of control. Whether it fully delivers is another question, but the question itself is worth taking seriously.

Sailfish comes from a different family tree

Sailfish is not an Android skin with a Nordic design language. Its roots run through MeeGo, Mer, and Nemo rather than through Google’s mobile stack. Jolla says the company was founded in 2011, continues the legacy of Nokia and MeeGo, and has been developing Sailfish for more than a decade. On the Sailfish info page, Jolla describes the platform as a continuation of the work left behind when the MeeGo team refused to quit and instead formed a new company. The first commercial Sailfish release arrived in 2013, and the official releases archive still shows a continuous line of updates stretching from the first 0.99 release in November 2013 to Sailfish 5 in 2025.

That lineage matters because it explains what Sailfish is trying to be. Jolla describes Sailfish as a classic Linux-style operating system built with Qt, QML, and Wayland, not as a repackaged Android distribution. WIRED made the same distinction in 2026, noting that Sailfish differs from competitors like GrapheneOS and /e/OS because it is not based on the Android Open Source Project. That makes Sailfish unusual in the privacy-phone discussion, where many alternatives are really attempts to reshape Android rather than replace it.

The open-source story is real, though not absolute. Sailfish’s own documentation says the OS consists of many components, most of which are open source, while some remain proprietary or closed, including certain hardware-specific modules and software licensed under commercial terms. Jolla also says the platform is based on Linux and more than 500 open-source projects, and that source code is available for the open parts. So Sailfish is neither fully closed nor fully open in the purist sense. It sits in the untidy middle that many commercial operating systems inhabit, especially once real device hardware enters the picture.

Its hardware strategy also explains why Sailfish has survived. Jolla’s documentation makes plain that Sailfish is designed to run on Android phones through hardware adaptation work. The Hardware Adaptation Development Kit says a GNU/Linux-based Sailfish OS can be ported onto Android phones, and the hardware adaptation documentation lists everything that must be made to work: kernel, display, touch, radio stack, Wi-Fi, GPS, camera, sensors, and power management. This reuse of existing Android-compatible hardware is not a side note. It is one of the reasons Sailfish still exists at all. Building a sovereign OS is hard; building a sovereign OS and a wholly sovereign silicon stack is far harder.

The platform is also still moving. Jolla’s February 2025 Sailfish 5 announcement said the release brought more than 300 improvements and over 200 bug fixes and marked the first major Sailfish release from the “new Jolla.” Whatever else can be said about Sailfish, it is not abandonware. That continuity is one of its strongest claims to seriousness. Plenty of alternative mobile platforms were exciting once. Very few are still shipping major releases after a decade.

Privacy in Sailfish is built at the system layer

Jolla’s privacy pitch starts with subtraction. The company says Sailfish OS sends no background data, contains no hidden analytics, and does not require a Google account. Those claims appear in the Jolla Phone press releases and in third-party coverage echoing Jolla’s position. That is the cleanest part of Sailfish’s appeal: it tries to remove the default assumption that a smartphone must report back to a platform owner to be useful.

Some of the privacy story is marketing language, and some of it is documented system behavior. The stronger documented pieces sit in the security and encryption materials. Sailfish’s documentation says user-data encryption is based on LUKS, uses 256-bit AES, and covers the /home directory where user data lives. The same documentation says the encryption service is present by default, and the device-lock page explains that the user area is encrypted and must be unlocked with the security code after restart. Jolla also makes the security code mandatory during initial setup. That is not a vague privacy posture. It is a concrete decision about local control over data at rest.

The enterprise side adds another layer. Sailfish’s main site says the OS supports configurable device policies and extension points for cloud accounts, VPN solutions, authentication methods, and security requirements tailored to corporate or governmental needs. That does not make Sailfish magically safer than every rival, but it does show that privacy is not treated as a wallpaper slogan inside the platform design. Jolla has been pushing a security-and-sovereignty message for years, including its older Sailfish Secure effort with SSH Communications Security and its licensing strategy for localized implementations.

The new Jolla Phone adds a hardware layer to that pitch. Jolla’s current phone materials say the device has a physical privacy switch that lets the user disable the microphone, camera, and other sensors at will. The pre-order page lists the switch as a headline feature, and recent coverage describes it as central to the device’s identity. That matters because hardware controls answer a different problem than software settings do. A software toggle is still software. A hardware switch tells the user, in a way a menu never quite can, that privacy is supposed to be immediate and legible.

None of this settles the harder question of security quality. Privacy and security overlap, but they are not interchangeable. WIRED notes that Sailfish has faced criticism for not being as secure as heavily hardened alternatives like GrapheneOS, and Sailfish’s own documentation admits that some components remain proprietary. An independent security research project funded by NLnet started in 2025 to examine Sailfish FOSS components, including cryptography, sandboxing, and isolation mechanisms. That is useful context. It suggests there is enough promise in Sailfish to justify outside scrutiny, and enough uncertainty that scrutiny is still needed.

Privacy claims and documented controls

LayerWhat the sources document
System identitySailfish does not require a Google account, according to Jolla’s current phone materials
Data at restUser data encryption is based on LUKS with 256-bit AES
Access controlA mandatory security code is tied to device lock and encrypted-user-data unlock
Hardware privacyThe new Jolla Phone adds a physical privacy switch for mic, camera, and other sensors

The table above works best as a map, not a verdict. Jolla’s privacy case is strongest where the sources describe clear system behavior or hardware controls, and weaker where the claim depends on trusting company statements without a completed independent audit.

The app problem never stopped being the central problem

Every alternative mobile OS runs into the same wall: people do not switch operating systems, they switch lives. A phone is not judged by philosophical elegance at 9 p.m. when a banking app breaks, a transit app refuses to launch, or a family messaging thread goes dark. Jolla understands that, which is why Sailfish has spent years treating Android compatibility as a survival tool rather than an embarrassing compromise. The documentation says Android AppSupport is available through the Jolla Store, is tied to the Sailfish OS licence on supported devices, and lets users install Android apps from sources like Aurora Store and F-Droid.

This is where Sailfish becomes more practical than many Linux-phone experiments. Jolla’s phone materials say users can still run banking apps, messaging services, and everyday applications through AppSupport. The Sailfish reference documentation also states that Sailfish includes Android compatibility, and the info page says the system can run Android applications while remaining a Linux-based OS. That bridge to the Android app ecosystem is the single most important reason Sailfish still deserves to be discussed as a daily-driver candidate rather than a museum piece.

The bridge is not perfect, and Jolla does not hide that in its own docs. The Android AppSupport help pages explain that some apps fail to launch or crash and may need the Android service restarted. The known-issues page notes that Android apps may sometimes lose mobile-network connectivity and that older AppSupport versions cannot install newer apps once API requirements outgrow the installed Android base. The Android settings page also warns that running AppSupport in the background consumes system resources and battery, while turning it off can stop messaging apps from communicating in the background. This is not frictionless emulation. It is a compromise engine.

That compromise still compares well with the alternatives available to a privacy-minded user who wants something more independent than stock Android. A pure Linux mobile stack without Android app access can feel cleaner and more principled, but the everyday cost is usually high. A de-Googled Android build may preserve app compatibility better, but it stays inside Android’s architectural world. Sailfish’s wager is different: keep a distinct Linux identity at the OS level, then import Android apps only where daily life demands them. Whether that feels elegant or awkward depends on the user, but it is at least a coherent strategy.

There is another catch. On many supported Xperia devices, AppSupport and other licensed features require signing in with the same Jolla account used to purchase the Sailfish licence. So even though Sailfish does not require a Google account, it can still require a Jolla account for the full commercial package on certain hardware. That is a much smaller form of dependency than Google’s ecosystem lock-in, though it is still dependency. Alternative platforms do not abolish trade-offs. They just move them around.

The new Jolla Phone gives the software a clearer home

For years, Sailfish had a presentation problem. The OS was real, but many people encountered it as something you flashed onto a Sony Xperia after unlocking the bootloader, reading careful instructions, and making peace with a slightly adventurous setup. Jolla’s own installation pages spell this out in detail: unlock code, fastboot, flashing scripts, bootloader warnings, manual sign-in for licensed content. That workflow is fine for enthusiasts. It is not how ordinary people buy phones.

The Jolla Phone changes that story because the software finally has a device built around its pitch. Jolla’s pre-order page lists Sailfish OS 5, Android AppSupport, a user-replaceable battery, replaceable back covers, dual nano-SIM, and the physical privacy switch as core features. The December 2025 release said final assembly would take place in Salo, Finland, and the March 2026 update said the company had secured 10,000 pre-orders and more than €5 million in committed sales during the campaign period. Those are company figures, not independently audited market numbers, but they do show real demand inside the niche Jolla is targeting.

The hardware itself is deliberately unglamorous in the right way. WIRED describes a midrange package: MediaTek Dimensity 7100 5G, 8 or 12 GB RAM, 256 GB storage, microSD, a 6.36-inch AMOLED display, and a removable cover that revives Jolla’s old “Other Half” idea of functional accessories. Jolla is not chasing the premium-camera arms race or trying to beat Samsung on silicon. It is selling a phone whose defining features are control, repairability, and software independence. That is a rarer proposition than many people realize.

The sourcing story is more honest than the branding might suggest. WIRED reports that components come from multiple countries, including Taiwan, Japan, South Korea, and China, while Jolla argues that the integrity point lies in compiling and installing the software in Finland. That is worth stating plainly because “European phone” can easily slide into fantasy. This is not a pure continental supply chain. It is a European control point placed on top of a global hardware chain. In the current smartphone industry, that is already a meaningful distinction.

The bigger shift is symbolic. A niche OS looks more credible when it is not always borrowing someone else’s body. Jolla still supports downloadable Sailfish images for selected Xperia models and the Jolla C2 community phone, but a dedicated handset makes the privacy argument easier to understand. People do not have to imagine what Sailfish is for anymore. They can see it. They can buy it. They can decide whether that package is worth living with. That is a small commercial step and a large rhetorical one.

Europe’s sovereignty debate gives Jolla more relevance than its market share suggests

Sailfish makes more sense once it is placed inside Europe’s sovereignty debate rather than inside ordinary smartphone market logic. The European Parliament’s briefing on digital sovereignty describes a growing concern that the EU is losing control over data, innovation capacity, and its ability to shape and enforce law in the digital environment. It defines digital sovereignty as Europe’s ability to act independently in the digital world and ties the issue directly to data protection, cybersecurity, and the influence of non-EU technology companies. That language could have been written as the political backdrop to Jolla’s entire pitch.

The EU’s regulatory response does not create a new operating system, but it shows how seriously Brussels now treats platform dependence. The European Commission designated Alphabet and Apple among the first DMA gatekeepers in 2023, and the DMA’s interoperability rules require Apple to provide developers and businesses with access to the same OS hardware and software features available to Apple’s own services and hardware. That will not hand Jolla market share on a plate. It does signal that Europe has stopped treating mobile ecosystems as naturally closed kingdoms.

Jolla has spent years positioning Sailfish as more than a consumer curiosity. Sailfish’s cases page says the OS has a regional licensing model that gives partners source-code-level access and supports local implementations. Older Sailfish strategy materials described country-specific versions, corporate deployments, custom encryption options, and government use cases. Some of those claims sit in older documents tied to earlier geopolitical moments, and they should be read with that context in mind. Still, the through-line is consistent: Jolla has long viewed Sailfish as infrastructure for sovereign or semi-sovereign deployments, not just as a phone OS for enthusiasts.

That is why the company keeps returning to the language of independence. On the Sailfish info page, Jolla says the platform is the only open-source-based and independent mobile OS without ties to big corporations. On its about page, it calls Sailfish the only alternative European mobile OS. Those are bold self-descriptions, and they deserve scrutiny. Yet the larger point survives the scrutiny: Europe’s dependence on foreign platform layers has become a strategic issue, not just a consumer-choice issue. Once you accept that, a small OS with limited market share can still have outsized relevance.

Jolla is unlikely to become a continental champion in the old Nokia sense. That misses the point. A platform can matter by existing credibly enough that regulators, enterprises, and technical communities have a reference case for independence. It can matter because it keeps certain skills alive. It can matter because it reminds everyone that the operating system layer is still a political object, not just a consumer convenience. Sailfish is one of the few European projects forcing that recognition back into view.

The competition is real, but Sailfish is not solving the same problem

Jolla’s own claim to be the only European alternative mobile OS is too broad if taken literally. Europe does have other mobile OS projects with privacy ambitions. The most obvious is /e/OS, whose official site describes it as a complete, de-Googled mobile ecosystem and explicitly says it runs on a fully de-Googled Android base. Ubuntu Touch is another, presented by UBports as a fully open-source Linux mobile OS developed by a worldwide volunteer community. So the honest framing is not that Sailfish stands alone. The honest framing is that it occupies a different slot.

That slot is defined by three things. First, Sailfish is commercially maintained by a Finnish company rather than by a volunteer foundation alone. Second, it is not built on AOSP, even though it can run Android applications. Third, it has a licensing model aimed at regional or institutional deployment as well as consumer use. /e/OS aims to make Android private enough for ordinary people without demanding a cultural leap away from Android. Ubuntu Touch aims for a freer Linux-mobile future driven by community. Sailfish aims for independence at the OS layer without giving up a bridge to mainstream apps.

A quick map of the European alternatives

ProjectTechnical baseMain daily-driver strategy
Sailfish OSLinux-based OS with Android app compatibilityKeep a distinct OS while using Android apps where needed
/e/OSDe-Googled AndroidPreserve Android familiarity while reducing Google dependence
Ubuntu TouchFully open-source Linux mobile OSOffer a community-built Linux phone experience first

The comparison helps clear up a common confusion. These projects overlap on privacy language, but they are not interchangeable products. Sailfish’s closest unique claim is not simply “European” or “private.” It is that it combines a non-AOSP OS identity, commercial maintenance, Android app support, and a current phone hardware story in one package. That combination is why WIRED singled it out as distinct from /e/OS and GrapheneOS, and why Jolla still has a real, if narrow, opening.

There is also a user-type difference. /e/OS is chasing people who want a more familiar smartphone life with less Google in it. Ubuntu Touch is still more attractive to people who enjoy open-source culture and can tolerate rough edges. Sailfish tries to sit between those worlds. It keeps a more independent technical identity than /e/OS while working harder than many Linux-phone projects to stay usable in ordinary app-heavy life. That middle position is difficult to hold, but it is also why Sailfish keeps resurfacing whenever the “third mobile ecosystem” argument returns.

A credible niche is still an achievement

Jolla is not about to overturn the mobile market. The company’s own chair told WIRED that most Android and iPhone users will not switch and that the phone should be seen as a stepping stone. That is the right scale of ambition. The app ecosystem is still a constraint. Security comparisons with the most hardened Android alternatives are still uncomfortable. The install-and-license path on supported Xperia devices still has hobbyist DNA. Market share remains microscopic. None of that needs to be hidden for Sailfish to matter.

What matters is whether Jolla can sustain a believable product niche where privacy is built into the device identity rather than bolted on after the fact. The current phone helps because it bundles the argument into something tangible: no Google account required, system-level privacy claims, encrypted user data, Android app access, repair-friendly hardware, and a physical privacy switch. It is easier to take Sailfish seriously when it arrives as a complete proposition rather than as a forum project and a flashing guide.

The larger significance is cultural and strategic. A European OS does not need a 20% market share to prove a point. It needs enough stability to show that the OS layer can still be contested, that privacy can still be designed below the app layer, and that Europe does not have to limit itself to regulating foreign platforms while outsourcing every foundational stack. Sailfish is still fragile, still niche, and still imperfect. It is also one of the few projects testing whether Europe can own more of the mobile experience again.

That is why Jolla keeps attracting attention out of proportion to its scale. People are not only reacting to another phone launch. They are reacting to the possibility that a smartphone might be something other than a compulsory entrance ticket to two giant ecosystems. Whether Jolla turns that possibility into a durable business is still unsettled. Whether it has identified a real need is no longer in much doubt.

FAQ

Is Sailfish OS really the only European mobile operating system?

Not in a literal sense. Europe also has /e/OS and Ubuntu Touch. The more precise claim is that Sailfish is the most developed commercial European mobile OS with its own Linux-based identity, Android app compatibility, and a regional licensing model, which is different from saying it is the only European project in the field.

Is Sailfish OS based on Android?

No, not in the same way /e/OS is. Jolla describes Sailfish as a Linux-based operating system with its own stack, though it uses Android compatibility layers and libraries to support hardware adaptation and Android apps. WIRED also highlighted that Sailfish is distinct because it is not based on AOSP.

Does Sailfish OS require a Google account?

Jolla says no. Its current phone materials state that Sailfish OS does not require a Google account and does not include hidden analytics or background data collection. On some supported Xperia devices, though, users still need a Jolla account to activate licensed features such as Android AppSupport.

Can Sailfish OS run Android apps well enough for daily use?

Often, yes, and that is one of its biggest strengths. Jolla documents AppSupport for Android apps and points users to stores like Aurora and F-Droid, but its own help pages also note that some apps can crash, require restarts, or behave inconsistently, especially depending on device and AppSupport version.

What privacy features are built into the Jolla Phone itself?

The headline hardware feature is the physical privacy switch, which Jolla says can disable the microphone, camera, and other sensors. On the software side, Sailfish documentation describes encrypted user data based on LUKS and AES-256, with the security code tied to unlocking that encrypted data.

Is Sailfish OS as secure as GrapheneOS?

The sources reviewed here do not support that claim. WIRED explicitly notes criticism that Sailfish is not as secure as GrapheneOS, and Sailfish’s own docs say some parts of the system remain proprietary. There is independent audit work underway on Sailfish FOSS components, which is a promising sign, though it is not the same as a completed public verdict.

Why does Sailfish matter if its market share is tiny?

Because the debate around it is not only about sales. European institutions have framed digital sovereignty as the ability to act independently in the digital world, and the DMA shows the EU is actively pushing against locked ecosystems. Sailfish matters because it keeps alive a European operating-system option at the layer where real platform power sits.

Author:
Jan Bielik
CEO & Founder of Webiano Digital & Marketing Agency

Sailfish OS and Europe’s quiet bid for a private smartphone
Sailfish OS and Europe’s quiet bid for a private smartphone

This article is an original analysis supported by the sources cited below

The Privacy Respecting European OS and AI Solution Provider
Jolla’s official homepage describing the company’s Finnish origin, 2011 founding date, and privacy-first positioning.

About
Jolla’s official background page outlining its MeeGo heritage and its claim that Sailfish is the only alternative European mobile OS.

Sailfish OS 5.0 Tampella is here!
Official release post confirming Sailfish 5 rollout and the scale of recent platform updates.

Jolla Phone Pre-order
Official product page listing the Jolla Phone’s privacy switch, replaceable battery, Android AppSupport, and core hardware specs.

The European Phone Makes Its Comeback
Jolla’s December 2025 press release describing Sailfish privacy claims, Salo assembly, and the first launch wave.

The world premiere of the European Phone
Jolla’s March 2026 press release with updated pre-order figures and the company’s current independence narrative.

Sailfish OS – European alternative for Mobile operating systems
Official Sailfish overview page covering privacy positioning, security-related extension points, and licensing language.

Info
Official Sailfish background page describing the OS history, architecture, Android app capability, and independence claims.

Cases
Official Sailfish licensing page explaining its regional licensing model and source-code-level access for partners.

Security
Official reference page for Sailfish’s security and privacy framing.

Encryption of User Data
Official documentation describing Sailfish encryption, LUKS usage, AES-256, and encrypted user-data behavior.

Device Lock and Security Code
Official documentation connecting the security code to device lock and encrypted data access.

Android AppSupport
Official documentation on installing Android applications, licence requirements, and supported app-store paths.

Android Application Settings
Official documentation explaining the Android runtime environment, its limits, and its battery implications.

Android Compatibility
Official reference page on the two forms of Android compatibility inside Sailfish OS.

Supported Devices
Official device support matrix for Sailfish OS 5 and Jolla-supported hardware.

Hardware Adaptation Development Kit
Official documentation describing how Sailfish can be ported to Android phones through Jolla’s adaptation toolkit.

HW Adaptation
Official technical overview of the hardware subsystems that must be adapted for Sailfish to run on a device.

Open Source
Official documentation clarifying that most Sailfish components are open source while some remain proprietary.

Installing Sailfish OS
Official installation overview explaining the flashing process for supported devices.

How to install Sailfish X on Xperia 10 III on Windows
Official step-by-step flashing guide showing the bootloader-unlock and install workflow for Xperia hardware.

How to install Sailfish X on Xperia 10 III on Linux
Official Linux installation guide confirming the same unlock-and-flash path for Xperia devices.

Known Issues
Official issue tracker page documenting Android AppSupport limitations and device-specific rough edges.

Digital sovereignty for Europe
European Parliament briefing defining digital sovereignty and explaining why foreign platform dependence matters.

DMA designated Gatekeepers
European Commission page listing official DMA gatekeepers, including Alphabet and Apple.

Interoperability – Digital Markets Act
European Commission explanation of DMA interoperability rules for iOS and iPadOS hardware and software features.

Mobile Operating System Market Share Europe
Current Statcounter market-share page showing the near-total Android and iOS dominance in Europe.

/e/OS is a complete, fully “deGoogled”, mobile ecosystem
Official /e/OS page confirming its privacy positioning and Android-derived base.

e Foundation – deGoogled unGoogled smartphone operating systems and online services
Official e Foundation homepage stating that /e/OS operates on a de-Googled Android base.

UBports | Ubuntu Touch: Private & Secure Mobile OS
Official UBports site describing Ubuntu Touch as a fully open-source Linux mobile OS built by volunteers.

The ‘European’ Jolla Phone Is an Anti-Big-Tech Smartphone
Recent third-party reporting that distinguishes Sailfish from AOSP-based alternatives and notes both its promise and its limits.

This privacy-focused Linux phone runs Android apps without all the intrusive tracking
Recent coverage summarizing Jolla’s privacy claims, Android-app story, and phone-level privacy switch.

Security audit of Sailfish FOSS components
Independent funding page showing that third-party security research into Sailfish FOSS components is underway.