Know every computer and phone your team uses meets your standards, whether company-owned or personal. No IT team needed.
XFA asks them to install the app. They need no admin rights and no codes to copy, and about a minute later they are signed in.
“With XFA, we don’t need extra people or external people to manage that.”
Andreas CretenFounder & CEO, madewithlove
Read the madewithlove storyA new colleague’s first day
XFA plugs into your sign-in as an MFA method or as an external identity provider. Four steps, and every sign-in gets checked from then on.
Sign up and add your organization’s details.
As an MFA method or as an external identity provider. You copy 3 values across.
Then choose who gets checked.
Decide when XFA warns and when it blocks. You can try it without locking anyone out.
Press Fix and approve the suggested fix, or follow the step by step guide.
XFA alerts them by email, and in 
Slack or 
Teams if you choose, until it is fixed.
Google Workspace, Microsoft Entra ID (Microsoft 365), Okta, OneLogin, Ping Identity, and Keycloak. XFA checks the device where people already sign in.XFA checks the device where people already sign in.
“XFA is a great fit for us. We were looking for something that would cover the security checks required for compliance, but not something that would require our employees to install an MDM to fully track their laptops.”
Alina VoroninaBusiness Assistant, Filmustage
Company-owned, personal, or contractor devices. No MDM to roll out, and XFA takes no control of the device.
Windows
macOS
LinuxiOS
AndroidAvailable checks vary by operating system and verification method.
Device security goes wherever your people work.
Download on the App Store (opens in a new tab)Get it on Google Play (opens in a new tab)XFA checks that each browser is up to date. Where you allow it, checks also run in the browser at sign-in, without an install.
Chrome · Edge · Firefox · Safari · Brave · Arc · Vivaldi · Opera · Chromium
Safe sign-ins
Your people get on with their day.
XFA takes care of the device checks.
XFA takes no control of the device and needs no admin rights on it. People make the changes themselves. You see whether the device meets your rules, and nothing more.
Visit our Trust Center (opens in a new tab)
ISO 27001 certified
GDPR compliantOperating system updates, disk encryption, screen lock, and other supported security settings.
Every device check leaves a record. You see which devices meet your rules, and the same data goes to the compliance platform your auditor already works in.
See the integrations
Vanta
Drata
TrustCloud
Thoropass
Noru
Verify device security at sign-in, on 4 core checks. Upgrade when you need more checks, or to block unsafe devices from signing in.
Get set up in 15 min.
Start for freeA 30 minute call with our team. We answer your questions and walk you through XFA on your own setup.
Talk to us
Most XFA customers do. People fix their own devices with the XFA app, and an unsafe device doesn't get in when you choose to block. You set the rules once. No fleet to buy and no MDM to roll out.
Device discovery, device checks, risk alerts, and sign-in rules. XFA finds every device through your identity provider, checks it at sign-in, tells people what to fix, and applies the access policies you set. Your team still makes changes on their own devices. XFA never remotely manages or patches them.
Connect your identity provider and the apps you use, then decide what a secure device looks like. From the first sign-in, XFA checks each device and warns people about anything to fix, while they can still sign in. You can switch on blocking per policy when you are ready.
Compare plansFor the fullest set of checks, yes. People install the XFA app themselves at sign-in, without admin rights. People can also sign in without the app, verified through a managed Chrome profile on a smaller set of checks. Which checks run depends on the operating system.
Yes. XFA checks every device at sign-in, including personal and contractor laptops. If you already have device management on company laptops, XFA leaves it in place and covers the devices it does not reach.
See how XFA complements MDMNo. XFA warns first. People see what is wrong at sign-in and can still sign in while they fix it from the XFA app. You choose when and where to block sign-in until the device is fixed.
