Signed delivery
ECDSA-P256-SHA256 signed, versioned scanner modules reach each device with staged rollout and revocation.
Signed scanners for Android and iOS, and an assessment that links every finding to what the device actually reported.

ECDSA-P256-SHA256 signed, versioned scanner modules reach each device with staged rollout and revocation.
DNS queries and VPN flow metadata are traced to domains and endpoints. Never payloads.
Assessment Model v2 scores each dimension separately. Unknown evidence remains unknown.

Each finding opens to its evidence and what the device actually reported, so a review starts from the source, not a summary.

Every enrolled phone in one list, with groups, scanner assignments and the time each one last reported.

Every privileged action is recorded, from sign-ins and approvals to sensitive reads, with who acted and when.