Tech team device security.
Admin rights stay.

XFA checks the laptop before GitHub, your cloud console, or any app behind your identity provider opens, contractors’ laptops too. Engineers fix what is off themselves. Built-in Passkey adds phishing-resistant MFA.

Start for free Talk to us

Free to start for your whole team: 4 device checks at every sign-in, and people are guided to fix issues themselves, automatically or by hand.

A developer at a desk with two monitors and a laptop

Sound familiar?

Every engineer has admin rights. I don’t know what they’ve switched off.
Contractors get GitHub on day one, on laptops I have never seen.
We tried an MDM once. It never left the pilot.
Someone has an API key in their shell profile. Probably more than one.

Two kinds of access every tech team hands out.

XFA checks both at sign-in.

Contractors in GitHub and your cloud console.

When GitHub and the console sign in through your identity provider, XFA checks the contractor’s laptop every time.

A contractor’s sign-in to GitHub

They sign in with the account you gave them, through your identity provider.
XFA checks the laptop in front of them.
If something is off, the XFA app says what to change. You can make GitHub wait until it is done.
When the contract ends, remove their account. The laptop has nothing left to sign in to.

BYOD and freelance

Developers who keep their admin rights.

Developers need admin rights for toolchains, containers, and debugging. The XFA app installs without them and leaves theirs alone. It checks the settings those rights make easy to switch off.

Checks that matter on a developer laptop

Operating system and automatic updatesThe system is up to date and updates install on their own.
Disk encryption and screen lockA lost laptop does not hand over the code on it.
Antimalware and firewallBoth switched on, also after a debug session.
Secrets in environment variablesAPI keys and tokens that any process on the laptop can read.
Autonomous AI agentsAI agents running on the laptop on their own.
Remote loginLets someone log in to the laptop from another computer.

The secrets and AI agent checks are in early access.

Checked before GitHub opens.

Set the rules for developer laptops once. After that, every sign-in to GitHub and your cloud console starts with a check of the laptop.

GitHub opens after the check.A contractor opens GitHub through your identity provider. XFA checks their laptop first. For each check you decide: a warning that lets them in, or a block until it is fixed.The XFA app names the setting that is off and why it matters. Open Sharing Settings takes them straight to the switch. Their admin rights stay as they are.Nothing changes without their OK.When a laptop falls behind on updates, XFA sends its owner a risk alert in Slack. A new contractor gets an invite by email. No one on your team writes a reminder.How XFA works

Engineers fix it themselves.

XFA warns the engineer early, in Slack.

github.com/corvid-labs/api

corvid-labs / apiCodeIssuesPull requestsActions

XFA

Security status

These device security checks are shared with Corvid Labs. It requires some of them. The rest are shared as information.

Needs attention2

Remote login is activeOpen Sharing Settings

Secrets found in environment2 secrets available to all (AI) processes

Device checks required by Corvid Labs

Mandatory for access to company resources.

Device encryption

No autonomous AI agents detected

Sharing

Screen Sharing

File Sharing

Remote Login

Remote Management

console.corvid.example

Cloud consoleproduction

OverviewComputeDatabasesStorageAccess

Slack9:30 AM

XFAAPP9:30 AM

⚠️ Device Security Alert

Your device MacBook Pro does not meet the security requirements of Corvid Labs.

Issue:
• Operating System should be updated (CVE detected)

View details and resolve

Email10:30 AM

You've been invited to share your devices' security status with Corvid Labs

Accept invite and verify my device

Stratus Add-ons builds plugins for Atlassian apps. Preparing for SOC 2, its CEO wanted the team’s own laptops secured without an MDM.

“I have tried a lot of MDM solutions over the past week, and none of them felt right. All of them seemed intrusive and too complex to roll out.”

Aljoša KlišanićCEO and Owner, Stratus Add-onsRead the Stratus Add-ons story

Their privacy stays theirs.

XFA checks security settings and nothing else. Nothing on the laptop changes unless its owner says yes.

Visit our Trust Center (opens in a new tab)

Your organization sees

Security check results
Device name, model, and operating system
When the device last checked in
The work email it’s linked to

XFA never collects

Private messages or emails
Personal files or content
Browsing history
Screen recordings or screenshots
Passwords or login credentials
Location data

ISO 27001 certified
GDPR compliant
Made in Belgium
Encrypted at rest and in transit

Questions CTOs ask first

Compare plans

Two developers sharing one laptop at a table

Does XFA check sign-ins to GitHub?

Yes, when GitHub signs in through your identity provider, such as Microsoft Entra ID or Okta. That needs single sign-on, which is part of GitHub Enterprise Cloud. Git over SSH and tokens skip the identity provider, so the check runs when the single sign-on session starts or renews.

Do developers lose their admin rights?

No. The XFA app installs without admin rights and takes no control of the laptop. It only checks settings, such as secrets in environment variables and remote login.

Do contractors need a company laptop?

No. A contractor’s own laptop is checked at sign-in, like everyone else’s. XFA does not collect their files, messages, or browsing.

BYOD and freelance

Can engineers skip the authenticator codes?

Yes. Built-in Passkey is phishing-resistant MFA. The XFA app answers it, so there is no code to type and no phone to find.

Does it work on Linux workstations?

Yes. The XFA app runs on macOS, Windows, and Linux, and on iOS and Android. It installs without admin rights. Which checks apply depends on the system.