Security that tells you what it actually does.
Scam and device protection for people. Monitoring and response for servers and organisations. Every page states what works today, what is built but not released, and what is still coming.
- 2/5
- Platforms live
- 7
- Editions
- 127
- Families tracked
Start with your phone. See more in the portal.
Phone checks, family sharing and organisation security have different permissions and limits.
Personal
Your connected phones, family sharing choices, alerts, reports and product keys.
Organisation
Your organisation’s devices, server health, monitoring, members, roles and audit records.
Enterprise XDR
Incidents, event timelines, threat hunting and supported server response. Results depend on the telemetry agents actually report.
Where you can run it, as it is today
Safeavio Sentinel Mobile app, signed APK.
ServerGuard agent, one-line install.
Desktop app: unsigned pre-release download. Server agent 3.14 runs on a Windows Server; less tested than Linux.
Desktop app: unsigned pre-release download. Server agent 3.16 runs on macOS; less tested than Linux.
No iOS app.
One family, seven editions
Consumer editions run locally and can only take reversible actions. Business editions administer servers and fleets. The two never share credentials or remote-control authority.
Local-first protection for your own computer and phone.
> One person, 1–3 devices
Android protection you can install today.
> Android phone owners
One summary for the whole household, without reading anyone's phone.
> Households with supported paired phones
Provider interfaces for chosen-media checks and email exposure monitoring.
> Individuals who want the advanced checks
One console for your servers, Android devices and alerts.
> Organisations with 5–250 devices
A shared timeline of security events across endpoints, servers and phones.
> Security teams and MSPs
Monitoring and protection for Linux servers, with signed agent updates.
> Anyone running servers
Ten capabilities, each with its own honest status
Checks a message, payment request or caller against known scam patterns, on the device.
14 of 20 features work today
Checks a link before you open it and warns about lookalike domains.
4 of 8 features work today
Decodes a QR code and checks where it really points before you pay or open it.
4 of 4 features work today
DNS filtering and your own blocked and allowed lists on the phone; page-level browser protection is not built.
4 of 6 features work today
Known-malware scans, automatic protection and fake-app checks on the phone; ransomware warnings on servers.
8 of 12 features work today
Password exposure checks, account sign-in safety and hacked-account help today; verified-address monitoring interfaces need a configured provider for results.
4 of 8 features work today
A file check and guidance only. No detection engine runs, so Sentinel never says whether media is real or fake.
3 of 6 features work today
Wi-Fi and connection awareness on phones; port-scan visibility and firewall control on servers.
6 of 11 features work today
A risk score built from real device signals: root, screen lock, encryption, risky apps.
8 of 15 features work today
Defence against prompt injection, agent hijacking and poisoned models. Not built yet.
0 of 3 features work today
We track 127 attack families. We detect 1 of them end to end today.
Our engineering register maps every attack family to the sensor that could see it, the rule that looks for it and the test that proves the rule fires. A family only counts as detected when all three exist. We publish the count because a security product that will not tell you its gaps is asking for blind trust.
- Detected
- 01
- rule, sensor and test
- Partial
- 25
- rule exists, gaps remain
- Observable
- 16
- seen, not yet detected
- No sensor yet
- 85
- not observable today
src: attack coverage register · 2026-10-02 · total 127
The strict register above dates from 2026-10-02. Against our wider list of 352 attack techniques (2026-10-13), 65 are built, 97 partial and 190 not built. Built means a rule, screen or control with automated tests; almost none is proven on a real device yet.
Open the threat centerWhat stays on your device
Scam, link and device checks run on the device. Protection keeps working without our cloud.
File contents, full paths, browsing history, keystrokes, clipboard and screen are never sent, by design.
Cloud reporting is off by default on consumer devices. Turning it off also stops events already queued.
Start with what works today.
The Android app and the Linux server agent are available now.