Skip to content
XFA
Sign inStart for free

Device checks on every device, at every sign-in.

XFA checks disk encryption, screen lock, updates, remote access and AI agents on macOS, Windows, Linux, iOS and Android. At every sign-in, and in the background.

Start for freeCompare plans

Three ways XFA checks a device.

Most checks need the XFA app. It installs in a minute and needs no admin rights. Without it, the browser still checks the basics.

    • macOS
    • Windows
    • Linux

    The desktop app.

    macOS, Windows and Linux. Runs 33 of the 36 checks, remote access and AI agents included. Checks again in the background between sign-ins.

    Download the XFA app
    • iOS
    • Android

    The mobile app.

    iOS and Android. Checks the operating system, passcode, biometrics, disk encryption, a recent restart, and whether the phone is jailbroken or rooted.

    Get the mobile app
    • Chrome
    • Firefox
    • Edge
    • Safari

    Without the app: browser checks.

    Any browser tells XFA the operating system and the browser version. With Chrome device trust, a managed Chrome profile adds 5 more, such as disk encryption, the firewall and antimalware.

    See signing in without the app

All 36 checks.

Filter by operating system, browser and plan. Open a check for what it reads, where it runs and whether it has a Fix button. Beta checks are marked.

Operating system

Device settings

Browsers

AI checks

Other tools

Applications

Not available: the check doesn't run on that operating system.

What one check looks at.

A check reads one thing on the device and reports pass or fail.

  • What it reads.

    A setting, or a search for one known app name.

  • What it reports.

    Pass or fail, in your dashboard and in their app.

  • What it ignores.

    Everything else, like personal files or browsing history.

You choose the days.

For each check, you decide what a failing device gets: a warning, a block, or both. You also decide how many days it has first.

See sign-in verification

Default policy

Device Checks

Operating System version

Set your compliance goal

Warn users

Block a device

Timeline

  1. The point an update becomes available.
  2. Users are warned 7 days after an update becomes available.
  3. Devices are blocked 14 days after an update becomes available.
  4. Devices must be compliant 30 days after an update becomes available.

  • Warn first.

    A warning names the problem and lets people keep working. By default it starts after 7 days.

  • Block later, if you want.

    On Max and Enterprise, a block stops sign-ins to the apps you connected until the device is fixed. By default it starts after 14 days.

  • A goal only admins see.

    Set a compliance goal per check, 30 days by default. Devices that miss it show up in your dashboard. People never see it.

They see it first, and fix it.

People see the same checks in their XFA app, with what to fix. Where there is a Fix button, one click does it once they say yes. Fix guides and the Fix button are on every plan.

Explore fix guides

What XFA does not collect.

You see whether each check passes, plus basic details such as the model and the operating system version. Files, messages and browsing history never leave the device.

  • App names stay on the device.

    XFA checks apps against your policy on the device itself. You see pass or fail, never the list of what someone installed.

  • No admin control.

    XFA needs no admin rights to run. It can't wipe or lock a device, push software to it, or control it remotely. A fix runs only after the person says yes. They stay in charge of their own device.

“If people want to have a device security solution in place but have concerns about privacy, XFA is great.”
Alex Ulyanov, Head of Security, Gateway.fmAlex UlyanovHead of Security, Gateway.fmRead the Gateway.fm story

Questions about the checks.

Compare plans
Someone in a small studio kitchen checking their own phone with a coffee beside them, while a colleague works on a laptop at the shared table behind.
What is a device check?

A device check, also called a device posture check, is one setting XFA reads on a laptop or phone, such as disk encryption or screen lock. Each check reports pass or fail. Your policy decides which checks count and what a failing device gets: a warning, a block, or both.

Do people need to install anything?

For the full set of checks, yes. People install the XFA app on their laptop or phone. It needs no admin rights, and the sign-in walks them through it. People can also sign in without the app, and the browser checks a smaller set.

Does XFA change settings on the device?

Only when the person says yes. On computers, some checks have a Fix button in the XFA app. Some ask for the computer's password. For the other checks, a step by step guide shows what to change.

Can we choose which checks matter?

Yes. You pick the checks in a policy and decide, per check, whether a failure leads to a warning, a block, or both, and after how many days.

What does XFA not collect?

Private messages or emails, personal files, browsing history, screen recordings or screenshots, passwords, and location data. You see check results and basic device details.

Next

Pick the checks that count.

Free runs four checks on every device. Add more with Pro and Max.

Start for freeCompare plans
A person in a mustard knit sweater, seen from behind, typing on a laptop at a wooden desk by the window, their phone, a mug and a notebook beside them.