Skip to content
Statusthreat center ›
SAFEAVIOSENTINEL
Download

Install what is ready today.

Android and Linux are available. The Windows and macOS desktop apps are an unsigned pre-release. There is no iOS app. Each platform below has its requirements, what gets installed, how to verify it and how to remove it.

[UPDATE]Your connected product

Start with your phone. See more in the portal.

Phone checks, family sharing and organisation security have different permissions and limits.

Personal

Your connected phones, family sharing choices, alerts, reports and product keys.

Organisation

Your organisation’s devices, server health, monitoring, members, roles and audit records.

Enterprise XDR

Incidents, event timelines, threat hunting and supported server response. Results depend on the telemetry agents actually report.

Product update · 2026-10-15
The download page reads the published APK version from the service. New Android work listed as Not released is in the source and private build checks; it is not a promise about the public download. Real-phone checks are still required. See the Android feature list and limits.
[01]Which one do I need

Pick by what you want to protect

Safeavio Sentinel Mobile for Android

Available

Works on its own the moment it is installed: posture score with reasons, remote-access app warnings, an app inspector and a full-storage APK scan, all on the phone. Linking it to a console with a code adds lock, locate, alarm and wipe from the web.

Download APKVersion 4.71 (build 103) · 2026-10-18

SHA-256 e15d17b4607b48096e342132b10c7ea3db075061682dd0cd5d5334d3305a4f30

Install

  1. 01
    Open this page on the phone and tap Download APK.
    Download it only from safeavio.com. Copies on other sites are not ours and cannot be checked.
  2. 02
    Allow your browser to install apps, once.
    Android asks when you open the file. The switch is in Settings → Apps → Special app access → Install unknown apps (the wording varies by maker). You can turn it off again afterwards.
  3. 03
    Open the app and go through the short introduction.
    It is shown on first launch only and can be skipped. No account is needed: scanning, the score and the inspector work without one.
  4. 04
    Grant the permissions it explains, one at a time.
    Each sensitive permission is a separate Android prompt. You can refuse any of them; the feature that needs it stays off and the app says so.
  5. 05
    Optional: link the phone to a console.
    In the console open Devices → Add device and create a code. On the phone open Settings → Add this device and enter it. See enrol a phone.
Coming from version 4.1 or earlier?
Builds from 4.2 on are signed with a private release key, so a phone on 4.1 must uninstall the old app and install the new one once. After that, updates install over the top.
Google Play listing coming soon
Today the app is distributed from safeavio.com. A Google Play listing is submitted and waiting for Google's review; this page will show the Play button as soon as it is approved. Play Protect may warn about an app from outside Google Play.
Android
7.0 or later (minimum API level 24 in the app source)
Network
Not needed for on-device checks. Needed to link to a console and for remote actions.
Account
None on the phone. A console account only to link it.
Price
Free to download

What the Android app does today →

What it asks for, and whyfrom app source
Android permissions and what they are used for
PermissionUsed for
Device administratorRemote lock, wipe and alarm when linked; reporting if protection is switched off
Accessibility serviceChecking the active app and available Accessibility control powers; optional guided fixes and approved support sessions. Does not prove active screen sharing
All-files accessThe full-storage scan that finds and hashes APK files
See all installed appsThe app inspector and remote-access app detection
NotificationsAlerts and messages from your console
LocationOnly when you turn on sharing, or while a locate request from your console is waiting
Ignore battery optimisationStops some makers’ battery savers killing protection in the background
Screen captureRemote screen view, approved by you each time Android asks
Run at start-upRestarting protection after a reboot

Listed from the app's current source. Android shows each sensitive request on its own; refusing one turns off only the feature that needs it.

Verify what you installed

An APK is signed by its publisher, and Android will only update an app with one signed by the same key. You can read the signing certificate with Google's apksigner (Android SDK build tools):

Print the signing certificate
apksigner verify --print-certs blockmerkle-guard.apk
  • 4.1 and earlier were signed with a development key, not a private release key. That is why a later build cannot update them in place.
  • 4.2 and later are signed with a private release key. The certificate SHA-256 is: 28cfcf8e2e017b0321a4b7b8728fed8aab1f6b810742c1c6da793be1f18f03a4

A 4.2-or-later download whose certificate does not match that value is not ours.

Updates and uninstall

There is no store auto-update. To update, download the new APK from this page and install it over the old one; Android keeps your data when the signing key matches.

Moving from 4.1 or earlier needs an uninstall first, because the keys differ. The phone loses the app's local state and its link to the console, so re-enter a new code afterwards.

  1. 01
    If the phone is linked, ask your console admin to retire it first.
    Switching off device administrator on a linked phone is reported as tampering, and the phone locks itself.
  2. 02
    Turn off device administrator for the app.
    Settings → Security → Device admin apps (the path varies by maker). Android will not uninstall an active device administrator.
  3. 03
    Uninstall it like any other app.
    Settings → Apps → the app → Uninstall.
Troubleshooting
"App not installed" when installing
Usually an older copy signed with a different key is still on the phone. Uninstall it (see the steps beside this) and install again.
Protection stops after a while
Some makers stop background apps aggressively. Open the app and use the "Protected from battery kill" fix, which asks Android to exempt it from battery optimisation.
Remote screen view asks again after a restart
Android requires a fresh approval for screen capture after the app is force-stopped or the phone restarts. This is an Android security rule.
Locate returns no position
Locate attempts a fresh position and shows accuracy, age or failure. Permissions, connectivity and Android background limits can prevent an update.
The console never shows the phone
Check the phone is linked (Settings → Add this device), that it has a network connection, and that the code had not expired or been used already.
[02]Verification and signing

How a release proves it is ours

Two different signatures matter: the one that lets an operating system install a program, and the one our agents check before they accept an update. Here is where each stands.

Signing state per download
DownloadPlatform signatureUpdate signatureState
Android app 4.1 and earlierDevelopment keyNot applicable (no auto-update)Limited
Android app 4.2 and later (the current version is shown above)Private release keyNot applicable (no auto-update)Not released
Linux agentNot applicableEd25519, pinned root, expiry and anti-rollbackAvailable
macOS and Windows agentsNot applicableEd25519, same pinned rootLimited
Installer scripts (install.sh, install-mac.sh, install.ps1)Script over HTTPS, not signedNot applicableLimited
Windows agentNoneDoes not verify manifests or apply updatesLimited
Sentinel desktop (Windows, macOS) 0.1.0-alpha.1None: unsigned (SHA-256 shown on this page)Not implemented in the pre-releaseLimited
Agent update checks, in order
  1. 01
    Signature
    Ed25519 over the update manifest, against a public key built into the agent — never one fetched over the network.
  2. 02
    Freshness
    The manifest must not be expired, or issued more than five minutes in the future.
  3. 03
    No rollback
    The version must be strictly newer than the installed one.
  4. 04
    Payload
    SHA-256 and size of the downloaded file must match the manifest, compared in constant time.
  5. 05
    Target
    Product and platform must match this agent. Only then does it install.
Release root, and known deviations

Public key of release root v1, pinned in the agents since 1 October 2026:

43fL1umhCx5g0kJOD0XuoXi9WUzo3WjiLX44GSHzEQo=

  • The root key signs manifests directly and is held on our hub rather than offline. Our design calls for an offline root signing short-lived intermediates; this deviation was approved by the owner because deployed agents do not support intermediates yet.
  • Older agents may still receive MD5-checked updates on our internal channel until 15 October 2026. MD5 is never accepted on the production or external-beta channels.
  • Agents installed before 1 October 2026 pin no key and refuse every update; they need one manual upgrade.
  • Rollouts move through 5, 25, 50 and 100 % bands, and an operator can roll back with a recorded reason.
[UPDATE]Your connected product

Start with your phone. See more in the portal.

Phone checks, family sharing and organisation security have different permissions and limits.

Personal

Your connected phones, family sharing choices, alerts, reports and product keys.

Organisation

Your organisation’s devices, server health, monitoring, members, roles and audit records.

Enterprise XDR

Incidents, event timelines, threat hunting and supported server response. Results depend on the telemetry agents actually report.

Product update · 2026-10-15
The download page reads the published APK version from the service. New Android work listed as Not released is in the source and private build checks; it is not a promise about the public download. Real-phone checks are still required. See the Android feature list and limits.

Re-checked against our documentation on 2026-10-14.