Questions, answered plainly.

A family of security products: Sentinel for people and families (Android today, Windows and macOS as an unsigned pre-release download), Sentinel for small business and Enterprise XDR (a web console), and Safeavio ServerGuard for servers. They share threat intelligence and an event format; they never share credentials or remote-control authority.

ServerGuard administers servers with scoped, audited actions. Personal phone checks run locally; enrolment can enable supported lock, alarm, locate and wipe commands with the required permissions. Desktop consumer protection and server administration use separate credentials and authority.

No, and no product does. Our attack-coverage register lists 127 attack families and states for each one whether we detect it today. As of 2026-10-02, 1 family is fully detected with a tested rule, 25 partially, 16 are observable but not yet detected, and 85 we cannot observe yet. The threat center and each capability page show their part of that list.

Available: in the current product or published download. Limited: usable with the gaps stated. Not released: implemented in the source, with release and device checks still stated next to it. Coming: not implemented. A source test alone never proves protection on a real phone.

The Android app (the current version is on the download page), the Linux server agent, the less-tested macOS and Windows server agents, and the web console at safeavio.com with servers, monitoring, alerts, incidents, device management, family safety, per-device keys and organisations. The Windows and macOS desktop apps are an unsigned pre-release you can download from the download page.

Because we have not measured them in a way we can show you. We will publish measurements per device class with the method, rather than a claim. We never claim 100% protection, zero battery use or an unhackable product.

No. An adult sets up the family and pairs the phone. Paid-key requirements still apply. Sharing requires the relevant permission and consent; new summary tools are not full app blocking or time limits.

No. The download page reads the published APK metadata. New App Lock, reviewed number lists, Privacy Advisor and other source additions remain marked Not released until release checks are complete. Automated breach and deepfake results also need a configured provider.

Android 7.0 or later; the minimum API level in the app source is 24.

No. Since version 4.0 the app works on its own as soon as it is installed: the posture score, scan, app inspector and threat list run on the phone. An account is only needed if you want to link the phone to a console for lock, locate, alarm, wipe and fleet visibility.

A Google Play listing (com.safeavio) is submitted and waiting for Google's review. Until it is approved, download the signed APK from safeavio.com; you allow installs from your browser once. Do not install copies from other sites.

Versions from 4.2 add on-device scam, link, QR, phone-number and password-exposure checks and more private check-ins; versions up to 4.50 also add the known-virus list, quick and full scans, automatic protection, family safety, Money Shield and Wi-Fi safety. Version 4.1 was signed with a development key and every later version with a private release key; Android only updates an app in place when the keys match, so 4.1 phones must uninstall and reinstall once.

Money Shield is one place in the Protect tab for money-fraud help: UPI and QR checks, a check for apps that imitate banks, payment verification by calling back a saved number, recovery guides and phone-takeover warnings. It gives risk warnings only. It has no link to any bank, NPCI or telecom operator, so it cannot confirm a payee, cannot reverse a payment and never says "bank-confirmed". Each part is marked Live, Partial or Guidance only in the app.

The published app checks available network information and explains warning signs. New source work adds network-change and optional DNS/TLS baseline checks. Android permissions and background limits apply; differences do not prove interception. Sentinel cannot guarantee a Wi-Fi network is safe.

It warns about a keyboard installed from outside a store or one that also holds Accessibility, and about apps that copy the name of a bank or popular app under a different package. These are risk warnings from a partial local list: an app not on the list is never reported, and Sentinel cannot see what a keyboard does with the keys or call an app genuine.

Payment protection warns about available Accessibility control or overlay powers while a payment app is open. It does not prove active screen sharing and cannot confirm a payment is safe. Optional call context reads only whether a call is active. New signer observations are source work, with reviewed data and real-phone checks still needed.

Accessibility supports checking active apps and available control powers and optional guided fixes. It cannot prove another app is sharing the screen. Device administrator enables supported lock and wipe actions after enrolment and permission. You can refuse permissions; features that need them stay unavailable.

It checks installed apps against a list that includes AnyDesk, TeamViewer, Chrome Remote Desktop, Zoho Assist, AirDroid, Vysor, RustDesk, Splashtop, Microsoft Remote Desktop and Unified Remote. It marks one as critical if it currently holds accessibility control, and medium if it is merely installed.

No. Android does not let a device-administrator app remove or bypass your screen lock on current versions, so the console refuses an unlock request and says why instead of pretending.

Locate can request a fresh position and reports accuracy, age and the result of the attempt. Permissions, background limits, battery settings and connectivity can prevent an update. An old position must not be treated as the current location.

Any app that runs in the background uses some battery, and a linked phone checks in more often when its risk is high. We have not yet published measured figures per device class; we will publish measurements rather than a claim.

If the phone is linked, ask your console admin to retire it first — switching off device administrator on a linked phone is reported as tampering and locks the phone. Then turn off device administrator for the app in Settings → Security → Device admin apps, and uninstall it normally.

Linux with systemd is the main platform. There are also macOS and Windows agents; they are less tested, and the Windows agent has not been verified in production.

The Linux agent needs root access, systemd and Python 3 with its venv module. Install Python first on non-Debian systems if needed. Current agents send heartbeats and poll commands over outbound HTTPS; no inbound internet port is needed.

The agent and its own Python environment in /opt/serverguard-agent, its configuration and generated API key in /etc/serverguard-agent, and a systemd service called serverguard-agent that runs it as root on port 9876. The uninstall option removes all of it.

Current agents contact the hub over HTTPS for heartbeats and commands. Keep the local agent port closed to the internet. Legacy direct-push access is disabled; do not expose an unencrypted listener as a workaround.

The Linux, macOS and Windows agents accept only Ed25519-signed update manifests, checked against a key built into the agent, with expiry, no-rollback, SHA-256, size and platform checks. They poll every five minutes and install on their own. The Windows verification has been exercised on one Windows Server only.

Every request to the agent must carry it, and it is compared in constant time; an agent with no key refuses everything. Anyone holding it can call the agent, so keep it secret. To rotate it, write a new random key to the agent's key file, restart the service, then update the key on the server in the console.

Agents installed before 1 October 2026 have no pinned signing key and refuse every update. Upgrade them once by hand, by re-running the installer or replacing the full agent.

Yes, on Linux. The installer sets up the current single-file agent (3.19 on Linux): metrics, processes, services, Docker, logs, on-demand ClamAV, rkhunter and chkrootkit scans, firewall control, reboot, a command queue for servers behind NAT, security events and signed self-updates. The macOS (3.16) and Windows (3.14) agents cover less and are less tested.

No. On servers, ransomware detection (detect only), the data-leak scan (redacted findings) and secure delete (with the SSD/NVMe limit stated) run in the Linux 3.19 and macOS 3.16 agents; the Windows 3.14 agent has them built but not yet verified on a real Windows host. The network scanner and optimiser are Linux only. Web protection, anti-tracker, privacy guard and safe banking are desktop features: not applicable to a server agent. Each server’s Security tab → Capabilities shows the exact status per platform.

Windows and macOS desktop apps are available as unsigned pre-release downloads. Platform signing, macOS notarisation and wider device checks remain release work. An unsigned preview is not a signed production release.

No. The server agents are for machines you administer and report to the business console. The Sentinel desktop app is personal protection for your own computer — local scanning, link checks and an encrypted quarantine — and is available only as an unsigned pre-release.

No. It is not built. Our platform order is Windows first, with Android continuing as its own product; macOS and iOS follow once their platform requirements are met. You can use the web console from an iPhone browser.

A separate tenant: its servers, devices, alerts, incidents and members are isolated from every other organisation. You can belong to several and switch between them from the header; removing you from one does not affect the others.

Owner (everything, including billing), admin (everything except buying the plan), analyst (read, triage incidents, tune rules), operator (read, run device and server commands), viewer (read-only, including the audit trail) and member (a personal account's own devices and plan).

Yes, optionally, per organisation; it is off by default. With it on, destructive server commands (reboot, shutdown, firewall disable, isolation), revoking and reissuing an agent key, and signing out an owner or admin wait for a second administrator (Organisation → Approvals). Approvals expire after an hour and every step is audited.

Every query for organisation data carries the tenant, and a build check fails if any read is unscoped. Cross-tenant tests run in CI. The production database (PostgreSQL) also enforces row-level security on every organisation table, so a query that forgets the tenant returns nothing.

Yes. Administrative changes, policy and rule changes, enrolments, server commands with their outcomes, and account changes are recorded. Owners, admins, analysts, operators and viewers can read their organisation's rows.

Email, Slack, Discord, Telegram or a webhook. Channel secrets such as SMTP passwords and bot tokens are encrypted at rest. Each channel has a test button.

Server metrics including CPU, memory, disk and swap use, network in and out, load average, process count, container and service status, failed logins, file changes, uptime and security score, with a threshold, duration and cooldown. A preset creates the essential rules in one step.

An alert is one threshold or rule firing. An incident groups related security events from servers, phones and desktops into one case, with an append-only history; analysts can triage, annotate, resolve and reopen it.

Yes. Every event category maps to ATT&CK techniques, and the mapping is added by our server — a device cannot assert its own. A category in the mapping is not proof the event is collected; the coverage register says which ones are.

Local scans and pasted scam checks run on the device. Optional features can send information you choose to share: family messages and location, number reports, signer observations, verified email checks or selected provider submissions. Read each consent screen. Sentinel cannot read other apps’ private chats.

Yes. It is off by default on consumer devices. Turning it off also stops events already queued, and the server refuses telemetry from a device that has reporting off.

Location is permission-based. Family sharing and a requested locate can send a position when enabled. Wi-Fi information may also need location permission on Android. No permission or an unavailable fix means the location can be unknown.

Host metrics 7 days and anomaly records 30 days. Hub security events and the audit trail have pruning jobs that are switched off until the periods are approved, so they are not deleted yet. Desktop detections are kept 90 days on the device. The trust center lists each one as configured.

Yes. From Account in the console you can export your data as JSON and request account deletion; you can withdraw the request for 7 days, after which an operator removes the account. Anything else, email us with the subject "Privacy request".

On a single server we operate at a hosting provider. Region selection (data residency) is not available yet; the design gives each organisation a region — India, EU or global — but it is not built.

The public site uses no advertising or analytics trackers. The console stores sign-in and selected preferences in the browser. Typeface files are bundled with the website.

No. We hold no security certifications and no audit is under way. The trust center lists the engineering controls we run instead and does not present them as an audit.

There is no independent penetration-test report we can share.

Email [email protected] with the subject "Security", describe what you found and how to reproduce it, and give us reasonable time to fix it before disclosing it. A formal policy with response times and a safe-harbour statement is not published yet.

Your vault is encrypted in your browser with a key derived by PBKDF2-SHA256 (at least 310,000 iterations); our server stores only ciphertext. A breach check sends only the first five characters of the password's SHA-1 hash.

Among others: the update root key is held online on the hub as a documented deviation; legacy checksum-only agent updates are accepted on the internal channel until 15 October 2026; the Windows agent is less tested than Linux; and Windows and macOS desktop downloads remain unsigned pre-releases. Backups are encrypted and copied to a second server every night. The trust center keeps the full list.

In Indian rupees (INR) only, from your account or the cart: UPI, cards and net banking through Razorpay, and international cards through Stripe (charged in rupees), under BIDUA Industries Pvt Ltd's merchant account. We do not accept cryptocurrency. You can enter a promo code before you pay and see the price after the discount. Until a gateway is switched on, online payment is not open and the page says so; write to us to buy. A device key is valid for a year; a monthly console plan covers 30 days. Nothing renews automatically.

Yes. Every paid order gets a GST tax invoice (18%, split into CGST and SGST inside Uttar Pradesh and IGST elsewhere) with a PDF under Billing > Invoices, and a credit note if staff reverse it. Add your GSTIN to your billing details before you buy if you need it on the invoice. A promo code comes off before tax, and a fully discounted order has nothing to invoice. The receipt e-mail needs the mail service to be switched on.

Each phone, computer or server has its own key, valid for a year. One key works on one device at a time; it can be released from the first device or freed from your account and moved up to 5 times a year, and a leaked key can be replaced up to 3 times a year. Buying 5 or more devices of one type lowers the price per device, and the three bundles have their own prices. Everything is shown live on the pricing page.

Yes. Every account has a code and an invite link. When someone you invited buys, you earn a share of what they were billed after the promo, and so do the two people above you in the chain (three levels). A hold applies before a commission can be paid out, and payouts are requested in your account and paid by hand. Automatic bank payouts and tax deduction are not offered; any tax on a payout is the recipient's. The rules, rates and an example are on the referral page.

Open Account > Subscription, choose a plan, type the code in the coupon box and press Apply. The price after the coupon is shown before you pay. A coupon can have an end date, a plan and a limit on how many times it can be used, and one coupon applies to one payment.

The plans on the pricing page are read live from our server, including any free tier; we do not list one from memory. The Android app itself is free to download.

Adding a server beyond your plan's allowance is refused. The other plan figures — HTTP monitors, team members, check interval and history — are not yet enforced automatically.

Yes, within 7 days of your first payment for a plan, and for days lost to an outage of more than 24 hours that was our fault. A refund goes back to the card, UPI account or bank account you paid from, for the amount you paid. Email us with your account email and the payment reference; the refund policy has the details.

There is no separate Personal, Family or Premium plan. You buy a key for each phone, computer or server, or one of three bundles, and the key decides what unlocks on that device. Live prices in rupees, including taxes, are on the pricing page; the Android app itself is free to download and the free tier keeps its basic checks.

Safeavio Sentinel is developed and operated by BIDUA Industries Pvt Ltd, which started with Safeavio ServerGuard, a server monitoring and protection platform that has run at safeavio.com since April 2026. Ramaera Industries Ltd is its marketing partner.

We have no announced partners, and we do not show customer logos or testimonials. The partner pages describe what a partnership could include and what still needs building.

One address for everything today: [email protected]. The contact page pre-fills a subject for sales, support, billing, partnership, security and privacy so we can route it.