Sentinel Personal
Local-first protection for your own computer and phone.
Android is available from the download page. Windows and macOS have unsigned pre-release downloads; signed, notarised production installers are still pending.
- Available
- 05
- Limited
- 02
- Not released
- 07
- Coming
- 02
- For
- One person, 1–3 devices
- Devices
- 1–3 devices
- Platforms
- Windows (unsigned pre-release) · macOS (unsigned pre-release) · Android (available)
- Works today
- 7 of 16 listed features
Is Sentinel Personal the right edition?
One person, their own devices
Your Windows or Mac computer and your Android phone, up to three devices. Personal protects the devices you own and nothing else.
People who want to see the reasoning
Every detection carries the rule that fired and its confidence. Signals we cannot collect are shown as unknown, never as passed.
People who want mistakes to be undoable
Personal never deletes, shreds or kills anything on its own. Suspicious files go into a quarantine you can restore from.
You only need your Android phone protected
→ Safeavio Sentinel MobileYou look after a whole household
→ Sentinel FamilyYou run servers
→ Safeavio ServerGuard
Most harm reaches a person through their own device.
A downloaded file, a lookalike link, a phone left without a screen lock, a password reused from someone else's breach. Many consumer security tools answer this by asking for blind trust: broad access, silent uploads and actions you cannot undo. Personal is built the other way round. Detection runs on the device, every automatic action stops at a warning, and nothing is reported to the cloud unless you turn reporting on.
- A burst of file changes in folders you care about, the pattern ransomware leaves
- Phishing and lookalike links
- A phone that is lost, stolen or set up insecurely
- Remote-access apps a scammer talked you into installing
- Passwords exposed in other people's breaches
What happens on your device
The desktop steps describe the app as built and tested in our repository. An unsigned desktop pre-release can be downloaded; the Android app is available today.
- 01
Choose what is watched
You approve the folders the desktop app may watch. It builds a file-integrity baseline (a hash of each file) with a quick scan. Nothing outside those folders is read.
- 02
Detect on the device
Changes run through deterministic rules on your computer. Twenty file changes within ten seconds in a watched folder raises a ransomware warning.
- 03
Stop at a warning
A safety gate caps every automatic action at Warn. Detections below the confidence threshold are only observed. You decide what happens next.
- 04
Quarantine, never delete
A quarantined file goes into an encrypted container with an integrity check. Restore refuses a tampered container or the wrong key instead of restoring something damaged.
- 05
Report only if you opt in
With cloud reporting on, redacted events (file name only, never the path or contents) go to your own timeline. Turning it off also stops events already waiting in the queue.
Every feature, with its state today
Grouped by where it runs. A feature is available only when it works in production or in the current download.
- Available
- 05
- Limited
- 02
- Not released
- 07
- Coming
- 02
On your phone
The Safeavio Sentinel Mobile Android app is part of Personal and is the piece you can install today.
- Posture score with the reason for every pointAvailable
Root, screen lock, encryption, unknown sources, developer mode and OS level, scored 0–100.
> Android app 4.50
- Remote-access app warningAvailable
12 known remote-control apps; critical when one holds Accessibility control.
> Android app 4.50
- Lock, alarm, locate and wipe your own phoneAvailable
From your web account to your enrolled phone. Tamper attempts are reported and lock the phone.
> Android app 4.50
- Scam, link, QR and password checksAvailable
On-device checks of text, links and payment QR codes you paste in.
> Android app 4.50
On your computer
Sentinel desktop for Windows and macOS: built and tested; an unsigned pre-release is available to download.
- Quick scan and approved-folder monitoringNot released
Scans and watches only the folders you approve.
> Sentinel desktop
- File-integrity baselineNot released
A hash per file, updated on scan and on change.
> Sentinel desktop
- Ransomware burst warningNot released
20 file changes in 10 seconds in a watched folder.
> Sentinel desktop
- Encrypted quarantine with verified restoreNot released
Authenticated encryption plus a header check; a tampered container is refused.
> Sentinel desktop
- Host health flagsNot released
CPU, memory and disk deviations flagged after a 10-sample baseline.
> Sentinel desktop
- Link checkNot released
Wired end to end, but today it only recognises test domains.
> Sentinel desktop
- Process and network detectionComing
Rules exist, but no operating-system sensor feeds them yet. Native Windows telemetry is the next build.
> Sentinel desktop
In your web account
- Password vaultAvailable
Stores only ciphertext encrypted in your browser, plus the key-derivation settings. Kept per user.
> Web portal
- Email breach lookupLimited
Wired to a breach-data service whose API key is not configured, so results are not dependable yet.
> Web portal
- Opt-in reporting to your own timelineNot released
The receiving side runs in production; the desktop app that sends is an unsigned pre-release.
> Sentinel desktop → portal
- MFA, passkeys and session reviewLimited
For your Safeavio Sentinel account itself; permissions and available sign-in methods apply.
> Web portal
Distribution
- Code-signed Windows and notarised macOS installersComing
Unsigned desktop pre-release downloads are labelled as such. Production signing and macOS notarisation are still pending.
Where it runs, as it is today
Android
Safeavio Sentinel Mobile, signed APK from safeavio.com (current version on the download page).
Windows
Desktop app built and tested; no signed installer yet. Windows is first in the platform order.
macOS
Desktop app built; notarisation and entitlements come before release.
iOS
No iOS app. iOS allows no general third-party monitoring.
What stays on your device, and what never happens
Never leaves your device
- File contents
- Full file paths (a file name only, and only when a feature needs it)
- Browsing history
- Keystrokes, clipboard and screen
- The link you paste into a check (only the verdict and hostname may be reported)
May leave, only with cloud reporting on
- Device name, operating system and version
- CPU, memory, disk and uptime
- Detection category, severity, rule and confidence
- A checked link's verdict and hostname
Consent is checked on the device before anything is queued and again by our server, which refuses telemetry from a device with reporting off. Unclassified data is treated as restricted.
Edition ceiling: Sentinel Personal may never
- Bypass Android permissions or your screen lock
- Report to the cloud without your explicit consent
A product boundary, not a setting. No flag, plan upgrade or API call can raise it.
How data moves
Each box is a step the data passes through, labelled with where it runs.
- on deviceFolder monitorapproved folders only
- on deviceDetection rulesdeterministic, with confidence
- on deviceSafety gateceiling: Warn
- on deviceLocal storedetections kept 90 days
- on deviceApp windowsandboxed, 11 typed calls
- on deviceRedactionpath → file name
- on deviceBounded queuedrops oldest when full
- on deviceConsent re-checkat send time
- networkTLSdevice token in a header
- our hubYour timelinedevice identity set by the server
Both paths work without the other. Local protection never depends on our cloud being reachable.
Requirements and limits
| Android | Android 6.0 or later (minimum API level 23 in the app source). No account needed on the phone. |
|---|---|
| Windows / macOS | Unsigned pre-release (0.1.0-alpha.1). No signed installer yet. |
| App window | Sandboxed renderer with context isolation and no Node, filesystem or network access. |
| Local retention | Detections, alerts and incidents 90 days; raw events 30 days; quarantine until you act. |
| Device credential | Desktop reporting credentials are separate from server administration. Android enrolment supports permission-based anti-theft commands; neither grants authority over servers. |
| Edition ceiling | Desktop: quarantine, restore and opted-in reporting. Android anti-theft commands need enrolment and the required permissions. |
How it differs from the editions next to it
Limits come from the edition ceiling in our product boundary. The full matrix compares all seven.
| Property | Personal (this page) | Mobile | Family | Premium |
|---|---|---|---|---|
| State today | Not released | Available | Limited | Coming |
| Devices | 1–3 | 1 Android phone | Eligible keys and plan limits apply | Same as Personal |
| Runs today on | Android. Windows and macOS an unsigned pre-release is available. | Android; current public APK on the download page | Android and web portal | Android source interfaces; results need a provider |
| Strongest action | Quarantine and restore, both reversible | Lock, alarm, locate or wipe your own enrolled phone | Consented family map, chat, SOS and status | Provider interfaces; no automated analysis without a provider |
| Who sets policy | You, on your own device | You, on your own phone | The account owner, for status only | You |
| Device credential | Phone enrolment token; separate desktop credentials | Device token: check-ins and command acks | Paired phone with per-device sharing choices | As Personal |
| Cloud reporting | Off by default; opt-in, revocable | None until you link the phone | Consented summaries, family chat and location | Only the media and identifiers you submit (designed) |
| May never | Bypass phone permissions or the screen lock | Read your messages or browsing in the background | Read another device's content without per-device consent | Capture system-wide audio |
Questions about Sentinel Personal
Q01Can I download the desktop app now?
No. It is built and tested in our repository, but there is no code-signed installer yet and we will not publish an unsigned one. The Android app is available today, and the download page can email you when the desktop app ships.
Q02Will Personal delete or kill anything on its own?
No. The safety gate caps every automatic action at a warning. You choose to quarantine a file, quarantine can be undone, and the desktop app cannot terminate processes, shred files or change the firewall.
Q03Does it need an internet connection?
Not for protection. Detection runs on the device. The connection is only used for opt-in reporting and, on Android, for the optional link to your web account.
Q04Can Safeavio, or anyone else, control my device?
No. The device token only authorises sending telemetry. Lock, alarm, locate and wipe on Android are actions you start for your own enrolled phone from your own account.
Q05What does the link check catch today?
On the desktop, only test domains: the check is wired end to end but has no reputation data yet. The Android 4.2 link check looks for lookalike domains and brand names in subdomains; it is built but not yet published.
Q06What happens to my data if I turn reporting off?
Collection for upload stops, events already queued are not sent, and our server refuses telemetry from the device while reporting is off.
Capabilities in this product
Each capability page lists the attack families it covers and how far our coverage register says it goes.
Known-malware scans, automatic protection and fake-app checks on the phone; ransomware warnings on servers.
Checks a link before you open it and warns about lookalike domains.
A risk score built from real device signals: root, screen lock, encryption, risky apps.
Password exposure checks, account sign-in safety and hacked-account help today; verified-address monitoring interfaces need a configured provider for results.
Start with the phone, add the computer when it ships.
The Android app is available now. The desktop app will appear on the download page once it has a signed installer.