Get started in minutes.

One price per person, with every device included. Every plan checks devices at sign-in, and people fix what is wrong themselves.

Free

15 min setup

Free for your whole team.

€ 0

per month for 1 user

Start for free

Every device checked at sign-in
People install XFA themselves at their first sign-in
Warns people when a check fails
4 device security checksOperating system version, disk encryption, screen lock, and antimalware protection. The person also sees the other 5 core checks and the 17 extended checks in their XFA app, as a preview.
One click fixes from the sign-in page, or a step by step guideWhen a check fails, the person clicks Fix on the sign-in page and the XFA app makes the change. A check without a Fix button comes with a step by step guide.
Discover which devices people sign in withXFA finds devices in the sign-in logs of the identity providers you connect, with no network scanning. XFA Free shows how many there are. From Pro, you see who each device belongs to and what is wrong with it.
Built-in Passkey, with no code to typePhishing-resistant MFA. The XFA app answers the second factor on a verified device, so there is no code to type.
Works on macOS, Windows, Linux, iOS, and Android
No blocking of insecure devicesPeople with a failed check are warned at sign-in and can still sign in. On Max and Enterprise, you choose which checks block a device until it is fixed. Your identity provider's own sign-in rules, like MFA, work as before.

Pro

Verify and warn

€ 4,90

per month for 1 user

Get started

Everything in Free, plus

9 core checksOperating system version, disk encryption, screen lock, and antimalware protection, as on XFA Free. Pro adds automatic updates, recent reboot, firewall status, browser version, and password manager.
Details on discovered devicesXFA finds devices in the sign-in logs of the identity providers you connect, with no network scanning. You see who the device belongs to, and what is wrong with it.
Unlimited identity providers, governance export, and Slack or Teams alerts
No blocking of insecure devicesPeople with a failed check are warned at sign-in and can still sign in. On Max and Enterprise, you choose which checks block a device until it is fixed. Your identity provider's own sign-in rules, like MFA, work as before.

Max

Best for most teams

Verify and block

€ 7,90

per month for 1 user

Get started

Everything in Pro, plus

26 core and extended checksThe 9 core checks, plus 17 extended checks: jailbroken or rooted devices, biometrics, Windows Recall, Find My Device, developer mode, DNS settings, Secure Boot, integrity protection, screen sharing, remote management, remote login, remote scripting, unattended remote access, secrets in environment, autonomous agents present, unguarded elevation, and unsafe AI mode.
Block insecure devices at sign-in
Stop people from skipping verificationPeople can no longer skip the check and sign in unverified.
Sign in without installing the appPeople can sign in without the XFA app, verified through a managed Chrome profile on a smaller set of checks.

Enterprise

For organizations with specific requirements

Custom pricing

A quote for your organization.

Talk to us

Everything in Max, plus

Enterprise checksBrowser settings, such as safe browsing and tracking protection, DNS over HTTPS, and HTTPS-only browsing, plus the antivirus or password manager you choose. Pro and Max run the browser checks as a preview.
Known vulnerabilities (CVE) on operating systems and browsers
Integrations with SentinelOne, Intune, and Aikido
Custom integrations and pre-installation through MDM
A dedicated support contact and 3 months of onboarding support

Unlimited devices per user
Sign-in verification on every plan
People keep control of their own devices

**Andreas Creten**Founder & CEO, madewithlove

Just want to check your own device?

Using XFA on your own? Install the app and it checks your device right away.

macOS
Windows
Linux
iOS
Android

Download XFA

ISO 27001 certified
GDPR compliant
Made in Belgium
Visit Trust Center

Compare plans

Every feature, side by side across XFA Free, Pro, Max, and Enterprise.

Features by plan: XFA Free, Pro, Max, and Enterprise
Feature	Free	Pro	Max	Enterprise
True on every plan
Compatible with all operating systemsmacOS, Windows, Linux, iOS, Android	Included	Included	Included	Included
Installs without admin permissionsPeople set it up themselves, with no IT ticket and no MDM	Included	Included	Included	Included
Respects people's privacyDoes not collect browsing history, files, or location	Included	Included	Included	Included
Verify and block at sign-in
Guided self-installation at sign-inThe app walks each person through installing it, with no admin rights needed	Included	Included	Included	Included
Verify device security on sign-inOn every application and identity provider you connect. Paid plans have no limit on how many	Included	Included	Included	Included
Identity providers you can connectThe same connections are used to check sign-ins and to find devices	1	Unlimited	Unlimited	Unlimited
Sign-in without installing the appNothing to install. XFA verifies through a managed Chrome profile, on a smaller set of checks	Not included	Not included	Included	Included
Warn users at sign-inSet per policy. The person sees what is wrong and can still sign in	Included	Included	Included	Included
Block insecure devices at sign-inMax and Enterprise only. Set per policy, and sign-in is refused until the device is fixed	Not included	Not included	Included	Included
Stop people from skipping verificationPeople can no longer skip the check and sign in unverified	Not included	Not included	Included	Included
One click fixes from the sign-in pageFix button where the check has one; step by step guide otherwise	Included	Included	Included	Included
Guides to resolve issuesStep by step, for a check without a Fix button	Included	Included	Included	Included
Built-in PasskeyThe XFA app verifies the sign-in on the device itself, with no code to type	Included	Included	Included	Included
Auto-approve a user’s first deviceA setting per application. People never see it in the app	Not included	Included	Included	Included
Always approve sign-in on another deviceA setting per application. People never see it in the app	Not included	Not included	Not included	Included
Device checks
Operating systemThe operating system and how it is kept current, such as its version, automatic updates, and developer mode.
Operating system version	Included	Included	Included	Included
Automatic updates	Preview	Included	Included	Included
Jailbroken or rooted devices	Preview	Preview	Included	Included
Biometrics	Preview	Preview	Included	Included
Windows Recall	Preview	Preview	Included	Included
Find My Device	Preview	Preview	Included	Included
Developer mode	Preview	Preview	Included	Included
Device settingsHow the device itself is protected, such as disk encryption, screen lock, the firewall, and remote access.
Disk encryption	Included	Included	Included	Included
Screen lock	Included	Included	Included	Included
Recent reboot	Preview	Included	Included	Included
DNS settings	Preview	Preview	Included	Included
Secure Boot	Preview	Preview	Included	Included
Integrity Protection	Preview	Preview	Included	Included
Firewall status	Preview	Included	Included	Included
Screen sharing	Preview	Preview	Included	Included
Remote management	Preview	Preview	Included	Included
Remote login	Preview	Preview	Included	Included
Remote scripting	Preview	Preview	Included	Included
Unattended remote access	Preview	Preview	Included	Included
Software checks
BrowsersThe browsers on the device: whether they are current, and their safety settings.
Browser version	Preview	Included	Included	Included
Safe browsing and tracking protectionChrome Safe Browsing and Enhanced Safe Browsing, Chrome Do Not Track, Firefox Enhanced Tracking Protection and Strict	Not included	Preview	Preview	Included
DNS over HTTPSChrome and Firefox	Not included	Preview	Preview	Included
HTTPS-only browsingFirefox	Not included	Preview	Preview	Included
AI checksAI and developer tools on the device, such as autonomous agents and secrets left in the environment.
Secrets in environment	Preview	Preview	Included	Included
Autonomous agents present	Preview	Preview	Included	Included
Unguarded elevation	Preview	Preview	Included	Included
Unsafe AI mode	Preview	Preview	Included	Included
Other toolsThe security tools on the device, such as a password manager and antimalware.
Password manager	Preview	Included	Included	Included
Antimalware protection	Included	Included	Included	Included
Require a named antivirus or password managerYou choose the product, and XFA checks that it is installed	Not included	Not included	Not included	Included
Aikido Safe Chain	Not included	Not included	Not included	Included
Aikido Endpoint	Not included	Not included	Not included	Included
Intune	Not included	Not included	Not included	Included
Other checksSentinelOne, which has no group of its own yet.
SentinelOne	Not included	Not included	Not included	Included
Understand your risk
Device risk
Discover devices from your sign-in logsFound in the sign-in logs of the identity providers you connect, with no network scanning. XFA Free shows how many devices it finds	Included	Included	Included	Included
Details on discovered devicesWho the device belongs to, and what is wrong with it	Not included	Included	Included	Included
Admin dashboard with a clear list of device issues	Included	Included	Included	Included
Admin security reports	Not included	Limited	Weekly	Weekly
Vulnerabilities
Known vulnerabilities (CVE) on operating systems and browsers	Not included	Not included	Not included	Included
Severity, category, and known ransomware use	Not included	Not included	Not included	Included
Filter by device or vulnerability, with the full listing per device	Not included	Not included	Not included	Included
Alerts and reminders
Automatic reminders to verify devicesInvites the owner of a discovered device to set up XFA, and reminds them until the device is verified	Not included	Monthly	Weekly	Weekly
Automatic device risk alertsTells the person what is wrong and how to fix it	Not included	Monthly	Monthly	Weekly
Alerts in the XFA appA system notification on the device itself	Not included	Included	Included	Included
Alerts over email	Not included	Included	Included	Included
Alerts over Slack or Microsoft TeamsSent as direct messages to the person	Not included	Included	Included	Included
Connections and integrations
Export your data to your governance toolSuch as Vanta, Drata, TrustCloud, or Thoropass	Not included	Included	Included	Included
Custom integrations for your organization	Not included	Not included	Not included	Included
Pre-installation through MDM	Not included	Not included	Not included	Included
Optional EU-hosted deployment	Not included	Not included	Not included	Add-on
Onboarding and support
Dedicated support contact	Not included	Not included	Not included	Included
3 months dedicated onboarding support	Not included	Not included	Not included	Included
On-site security training for your team	Not included	Not included	Not included	Add-on

The person sees a preview check in their XFA app and can try it out. You can't add it to your organization's security policy yet, so nobody is warned or blocked on it, and your admin dashboard does not show it.

What do these terms mean?

Core checks: The 9 checks on Pro, Max, and Enterprise: operating system version, automatic updates, disk encryption, screen lock, recent reboot, firewall status, browser version, password manager, and antimalware protection. XFA Free includes 4 of them for your organization, and the person still sees all 9 in their XFA app.
Extended checks: The 17 checks Max and Enterprise add, such as Secure Boot, screen sharing, remote access, and the developer and AI checks. XFA Free and Pro run them as a preview.
One click fixes: When a check fails, the person clicks Fix on the sign-in page and the XFA app makes the change. A check without a Fix button comes with a step by step guide. On every plan, XFA Free included.
Preview: The person sees a preview check in their XFA app and can try it out. You can't add it to your organization's security policy yet, so nobody is warned or blocked on it, and your admin dashboard does not show it.
Add-on: Available with Enterprise and priced separately.
Reminders: Messages that invite the owners of discovered devices to set up XFA, then remind them until their device is verified.
Device risk alerts: Messages that tell a person what is wrong with their device and how to fix it. They run on their own schedule, separate from reminders.
Built-in Passkey: Phishing-resistant MFA. The XFA app answers the second factor on a verified device, so there is no code to type.
Identity providers: The identity providers you connect drive both sign-in verification and device discovery. XFA Free connects 1; every paid plan connects as many identity providers and applications as you need.

Across the devices
your team uses.

Company-owned, personal, or contractor devices. Available checks vary by operating system and verification method.

Windows
macOS
Linux
iOS
Android

Pricing questions

What does XFA Free include?

XFA Free checks every device at sign-in, for as many people as you have. When something needs fixing, the person is warned and fixes it with the Fix button on the sign-in page, which opens the XFA app, or with a step by step guide. Your organization gets 4 checks: operating system version, disk encryption, screen lock, and antimalware protection. The person also sees the other 5 core checks and the 17 extended checks in their own app, as a preview. Free includes Built-in Passkey, connects 1 identity provider, and shows how many devices appear in your sign-in logs. Pro adds the other core checks, details on discovered devices, unlimited identity providers, the export to your governance tool, and alerts in Slack or Teams. Max adds the extended checks and blocking at sign-in.

Can we upgrade later?

Yes. Start on XFA Free and move to Pro or Max when you need more checks, or to block unsafe devices from signing in. Paid plans are priced per person, and every device is included.

Can we start without blocking sign-in?

Yes. Every plan checks the device at sign-in and warns people when something needs fixing. They can still sign in. Blocking, and stopping people from skipping the check, come with Max and Enterprise. You can start with warnings and turn on blocking when you are ready.

Does everyone need to install an app?

For the full set of checks, yes. People install the XFA app themselves at sign-in, without admin rights. With Max and Enterprise, people can also sign in without the app, verified through a managed Chrome profile on a smaller set of checks. Which checks run depends on the operating system.

Which identity providers can we connect?

Google Workspace, Microsoft Entra ID (Microsoft 365), Okta, OneLogin, Ping Identity, and Keycloak. You add XFA to yours as an MFA method or as an external identity provider, whichever it uses. You can also add the check to a single app over SAML or OpenID Connect (OAuth 2.0). XFA Free includes one identity provider. Pro, Max, and Enterprise have no limit on the identity providers or the applications you connect.

Explore integrations

Can we include personal and contractor devices?

Yes. XFA runs on the devices people already use, company owned or personal, on macOS, Windows, Linux, iOS, and Android. It needs no admin rights and takes no control of the device. You see check results and basic device details. XFA does not collect files, messages, or browsing history.

Read the privacy details