How it works, and how to set it up.

Family and phone sharing

An adult signs in, creates the family and pairs a phone through the app. A child’s paired phone needs no account. Eligible paid keys are still required; downloading the APK does not make a paid key free.

Choose location and other sharing on each phone. Family views show only permitted information, with its age. Chat, map and SOS depend on connectivity and permissions; SOS is not an emergency-service connection. Family chat is stored on the service and is not end-to-end encrypted.

New source work adds shared daily screen-time totals, new-app counts and risk reasons, with revocation. These are summaries and bedtime reminders, not enforced time limits, app blocking or YouTube supervision. Real-phone checks remain required. Read every new check and its limits.

Three views of your connected devices

Personal brings together your phones, family sharing, alerts, reports and keys. Organisation adds fleet monitoring, servers, members, roles and audit records. Enterprise XDR brings incidents, timelines, hunting and supported server response together. Its findings depend on events your agents actually send; an empty dashboard is not proof of safety.

How the pieces fit

Everything reports to one hub: the service behind the web console at safeavio.com. Around it sit three kinds of reporter, each with its own credential, and none of them can act on behalf of another.

An organisation (a tenant) owns servers, devices, alerts and members, and is isolated from every other organisation. Reporters send events in one shared shape; the hub maps each to MITRE ATT&CK techniques and groups related ones into incidents. Thresholds on server metrics raise alerts to the channels you choose.

The consumer and business sides are separated by design: a phone or desktop token authorises reporting only, never an administrative action. Privileged actions on servers exist only in the business console, at an administrator's instruction, and are audited.

Availability labels

A label only moves up when there is a rule, a real input and a test behind it. These docs describe only what is available or limited unless they say otherwise.

Install the server agent (Linux)

Run this on the server you want to monitor. You need root, systemd and Python 3 with its venv module; the hub must be able to reach the server on TCP 9876.

curl -sSL https://safeavio.com/install.sh | sudo bash -s -- \
  --hub-url https://safeavio.com --name "My Server"

Prefer to read it first? Download it, read it, then run it:

curl -sSLo install.sh https://safeavio.com/install.sh
less install.sh
sudo bash install.sh --hub-url https://safeavio.com --name "My Server"

The installer creates a Python environment in /opt/serverguard-agent, writes its configuration and a generated API key to /etc/serverguard-agent, and starts the serverguard-agent systemd service on port 9876. Options: --hub-url, --hub-key, --port, --name, --uninstall.

sudo systemctl status serverguard-agent
sudo systemctl restart serverguard-agent
sudo journalctl -u serverguard-agent -f

# health check (no key needed)
curl http://localhost:9876/health

Connect a server to your console

1. Create an account, sign in, and open Servers → Add server. The server will belong to the organisation you are working in.
2. Pick the operating system; the wizard shows the install command for it. Run it on the server.
3. Copy the API key the installer prints. It is also in /etc/serverguard-agent/api_key.
4. Register the server: name, IP address, port 9876 and the key.
5. The wizard waits for the first heartbeat. Use Test connection if it does not arrive.
6. Allow port 9876 only from the hub (see network and keys).

Your plan sets how many servers you can add; a server over the limit is refused with a "plan limit reached" message.

Enrol an Android phone

The app works without enrolment. Enrol a phone when you want to see it in the console and lock, locate, sound or wipe it from there.

1. In the console open Devices → Add device (personal accounts) or Add device and enrollment codes (organisations) and create a code. Codes are single-use and expire.
2. On the phone, download the app and allow your browser to install it.
3. Open the app, go through the short introduction and grant the permissions it explains.
4. Open Settings → Add this device and enter the code.

The phone appears in the console with its posture score and the reasons behind it. No account is created on the phone. To remove it, retire the device in the console before uninstalling the app: switching off device administrator on a linked phone is treated as tampering and locks it.

Your first alert

1. Open Alerts → Channels and add where alerts should go: email (your SMTP server), Slack, Discord, Telegram or a webhook. Press Test to send a test message. Channel secrets are encrypted at rest.
2. Open Alerts → Rules. The essential preset creates the basic rules in one step, for example CPU above 90 % for two minutes, with a five-minute cooldown.
3. Or write your own: a metric, a comparison, a threshold, how long it must hold, a severity and a cooldown.
4. When a rule fires it appears in the alert history, where you can acknowledge or resolve it.

Metrics you can alert on: CPU, memory, disk and swap use; network in and out; load average; process count; container and service status; failed logins; file changes; uptime; security score. Creating rules and channels needs the alerts:configure permission (owner or admin).

One agent per platform

Each installer (install.sh, install-mac.sh, install.ps1) sets up a single-file agent that opens no port. It sends a heartbeat and polls for commands over HTTPS, so it works behind NAT, and it updates itself from signed manifests every five minutes. Served today: Linux 3.19, macOS 3.16, Windows 3.14.

On servers, ransomware detection (detect only), the data-leak scan (redacted findings) and secure delete (with the SSD/NVMe limit stated) run in the Linux 3.19 and macOS 3.16 agents; the Windows 3.14 agent has them built but not yet verified on a real Windows host. The network scanner and optimiser are Linux only. Web protection, anti-tracker, privacy guard and safe banking are desktop features: not applicable to a server agent. Each server’s Security tab → Capabilities shows the exact status per platform.

Configuration

Settings live in /etc/serverguard-agent/config.json. Restart the service after changing them.

Agent endpoints

The hub reads the agent over these routes. Every one except /health needs the X-API-Key header, compared in constant time.

Network and keys

• Keep port 9876 closed to the internet. The agent connects out to the hub over HTTPS (heartbeat and poll), so no inbound port is needed.
• Keep hub TLS verification on. Agents verify the hub's certificate by default. HUB_ALLOW_INSECURE_TLS=1 turns it off for lab installs only and logs a warning on every start; never set it in production.
• Treat the API key as a password. Anyone with it can call the agent and send heartbeats as that server.

sudo ufw allow from HUB_IP to any port 9876

To rotate the key: write a new random key to the agent's key file, restart the service, then update the key on the server in the console. Requests are refused until both sides match.

How updates work

The full Linux and macOS agents ask the hub for updates and accept only a manifest signed with Ed25519, checked against a public key built into the agent. They then check, in order: expiry, that the version is strictly newer, the payload's SHA-256 and size, and the product and platform. Any failed check refuses the update.

Releases move through 5, 25, 50 and 100 % rollout bands, and an operator can roll back with a recorded reason. Recorded deviations: the root key signs manifests directly and is held on the hub, not offline; legacy MD5-checked updates are accepted on the internal channel until 15 October 2026. Agents installed before 1 October 2026 pin no key and need one manual upgrade. Key fingerprints are on the download page.

The installer agents do not update themselves; re-run the installer. The Windows agent checks for updates but neither verifies nor applies them.

macOS and Windows agents

Both are less tested than the Linux agent; the Windows agent has not been verified in production. They are server-monitoring agents, not the Sentinel desktop app.

curl -sSL https://safeavio.com/install-mac.sh | bash

# uninstall
curl -sSL https://safeavio.com/install-mac.sh | bash -s -- --uninstall

irm https://safeavio.com/install.ps1 | iex

# uninstall
irm https://safeavio.com/install.ps1 -OutFile install.ps1
powershell -ExecutionPolicy Bypass -File .\install.ps1 -Uninstall

macOS installs to ~/.serverguard-agent with a launchd job; Windows installs to %ProgramData%\ServerGuard-Agent with a scheduled task running as SYSTEM and an inbound firewall rule for 9876.

Organisations and roles

Each organisation is a separate tenant. If you belong to several, switch between them from the header; removing someone from one does not affect the others. Owners and admins manage members; an organisation cannot lose its last owner.

Optionally, an organisation can require a second person to approve reboot, shutdown and firewall-disable commands. The request waits, a different person with servers:act approves it within an hour, and every step is audited.

API overview

Every authenticated request binds the caller's organisation; asking for another organisation's record by id returns not-found. Desktop telemetry accepts at most 500 events per request and answers 413 above that.

Event contract

Server agents, Android phones and the Sentinel desktop app all report into one stored shape, so the XDR timeline can show them side by side. Each producer keeps its richer model and maps into this on send; anything extra goes into metadata rather than being dropped.

The hub adds the ATT&CK mapping (metadata.attack) itself; a producer may not set it. It never raises a severity above what the producer reported.

Categories and ATT&CK

A sample, not the full list. Every category must have an ATT&CK mapping or the hub rejects it, so the timeline cannot fill with events that mean nothing. A category existing is not proof the event is collected today: the threat center says which attack families we actually detect.