Cross-platform device management

Secure every device. From one console.

Xavier enrolls, configures, secures, and monitors Mac, iPhone, iPad, Apple TV, Android, and Windows devices, all from a single admin console built on each platform's native management protocol.

Get in Touch → Read the docs

Manages

macOS iOS iPadOS tvOS Android Windows
Xavier MDM - Dashboard
Xavier dashboard showing a fleet of Mac, Android, iPad, iPhone, and Windows devices

One console. Every platform.

Xavier speaks each platform's native management protocol, so you can enroll, configure, and secure your whole fleet from a single console.

Apple

macOS, iOS, iPadOS, tvOS

The full Apple MDM protocol: Automated Device Enrollment, supervision, Declarative Device Management, configuration profiles, and volume app licensing.

Android

Device Owner

A standalone Device Owner agent provisioned by QR code, with no Google account required and full policy control over the device. Or connect Managed Google Play and Samsung Knox zero-touch when you want them.

Windows

OMA-DM enrollment

Enroll over the native OMA-DM protocol, then push policy from a visual profile builder: password rules, BitLocker, Defender antivirus, firewall, and Windows Update rings, with inventory and remote commands from the same console.

Control

Decide what runs, and where data can go

Applications, websites, AI tools, and USB drives are four different questions with one answer: a rule you write once, scoped to the whole fleet or to a device group, that the device itself enforces.

Applications

Name an application your organization does not permit and it never opens. A Mac refuses the launch outright, so no window appears and there is nothing to clean up afterwards; an Android device suspends the package and tells the person holding the phone why. Rules match a Mac app by its code signature, so renaming a copy or moving it to Downloads does not get around one.

Websites and destinations

Name the destinations a Mac may not reach, and a filter on the device refuses the connection, browser tabs included. A rule covers a host and its subdomains, and can be narrowed to particular applications, so "nothing may reach this service except the tools we approved" is two rules rather than a list of every exception.

AI tools and providers

Block an AI tool once and both levers are pulled: the application stops launching and its website is blocked too, so it cannot simply be used in a browser tab instead. Deny an AI provider outright, or deny it to everything except the tools you deliberately approved. Anthropic, OpenAI, Google, Perplexity, Mistral, Cohere, Groq, and GitHub Copilot are recognised out of the box.

Removable storage

One rule decides what happens when somebody plugs a USB drive into a Mac or a Windows PC. Start in audit, where nothing is blocked and every drive that appears is recorded, so you can see what your fleet actually uses before you take anything away. Then switch to block, with an allowlist for the drives your teams legitimately need.

Xavier MDM - AI policy
Xavier AI policy page listing AI coding agents with a Block action, and reporting how many Macs can enforce app blocking and the network filter

A rule you cannot verify is not a control

Every one of these needs something in place on the device before it can do anything, so Xavier reports how many machines are actually enforcing rather than assuming a rule took effect everywhere. A Mac that is missing the piece is named, not averaged away.

All of it fails open on purpose. Nothing is enforced until you write a rule, and a policy that cannot be read is a policy that blocks nothing, because a machine that cannot start its own programs or mount its own disks is a far worse outcome than something briefly running that should not have.

Security by design

Security at every layer

From the certificate that proves a device's identity to the encrypted keys only you can recover, security is built into every step, not bolted on after.

Identity and enrollment

A built-in SCEP service issues and renews each device its own identity certificate through challenge-based enrollment, with one-time challenges that cannot be replayed.

Encryption and key escrow

Manage FileVault on Mac, with recovery keys escrowed and encrypted at rest using AES-256-GCM. Keys are decrypted only on an authenticated request.

Posture monitoring

Track FileVault, System Integrity Protection, firewall, Gatekeeper, Secure Boot, BitLocker, and Windows Defender health across the whole fleet, and catch drift before it becomes a problem.

Where data can go

Stop a Mac reaching destinations you have not allowed, and decide what happens when a USB drive is plugged into a Mac or a Windows PC. Both can start in audit, so you see what your fleet actually does before anything is taken away.

Dependency vulnerability scanning

Scan project dependencies for known vulnerabilities and outdated npm packages, track language runtimes against CVEs and end-of-life dates, and remediate straight from the console.

Response on demand

Lock, erase, clear a passcode, or place a device in Lost Mode on demand. Commands stream to the device and report their results back.

Access control and audit

Admin access is protected by JWT and httpOnly sessions with role-based permissions, and every command is recorded in a full audit trail with the user who sent it.

Device compliance report
Xavier device compliance report showing compliant and non-compliant devices with the policy violations each one has
Script library
Xavier script editor showing a bash script with an opt-in root execution setting
Xavier MDM - Homebrew packages
Xavier managing Homebrew packages on a Mac, with installed packages, available updates, and fleet-wide taps
Package management

Manage the software, not just the device

Xavier manages packages across Homebrew, npm, Python pip, and Ruby Gems on every Mac in your fleet. See exactly what is installed, push installs and updates, and keep software current from one console, because outdated packages are a security problem.

  • Cover Homebrew, npm, Python pip, and Ruby Gems
  • Install, update, and remove packages remotely
  • Spot available updates across the fleet at a glance
  • Keep a complete software inventory for every device
Munki Sources

Keep third-party Mac apps patched, automatically

Point Xavier at where an app publishes its releases and it watches for new versions, downloads them, verifies their integrity, and imports them into your Munki repository, so your fleet stays current without anyone repackaging a thing.

  • Track releases from GitHub, Sparkle appcasts, a direct download URL, or a web page
  • Verify every download against a pinned checksum before it reaches a device
  • New versions land in a testing catalog first, then promote to production when you are ready
  • Auto-promote trusted apps, or just get notified when an update appears
Xavier MDM - Munki packages
Xavier Munki package list with testing and production catalogs, a promote action, and notifications reporting new versions imported as testing drafts
AI assistant - connected to Xavier
Any Windows laptops with BitLocker off?
Two of your 14 Windows devices report BitLocker disabled: WIN-4F2KQ in Sales and WIN-9QLMB at the front desk. Both are marked non-compliant against the BitLocker rule.
Which devices haven't checked in for two weeks?
Three devices are past the two-week mark: a MacBook Air assigned to a departed contractor, an iPad in the conference room, and one Android tablet. Want the full inventory details for each?
AI-ready

Ask your fleet anything

Xavier exposes a Model Context Protocol server, so AI assistants like Claude Desktop, VoxyAI, and Cursor can query your fleet in natural language. The AI can see inventory, compliance, software, and activity. It can never change anything or read secrets.

  • Strictly read-only by construction, enforced by an automated test suite
  • Per-token access that you can revoke at any time, with rate limiting built in
  • Secrets like recovery keys and Wi-Fi passwords are redacted before the AI ever sees them
  • Every AI query lands in the audit log, attributed to its token

Everything you need to run a fleet

Zero-touch enrollment

Devices configure themselves out of the box: Automated Device Enrollment for Apple, QR provisioning and Samsung Knox for Android, and guided enrollment for Windows. Users power on and get to work already secured to policy.

Configuration profiles and DDM

Push Wi-Fi, VPN, restrictions, and FileVault on Apple with a visual profile builder, plus modern Declarative Device Management, and the same builder pushes password, BitLocker, Defender, and firewall policy to Windows.

App distribution

Deploy App Store and volume-purchased apps, publish through Managed Google Play, and push custom packages to Mac, Windows, and Android devices, all remotely.

Native macOS agent

A lightweight menu bar app reports inventory, security state, and installed packages in real time. It runs without root by default, with an optional root agent only when privileged tasks need it.

Remote commands

Lock, wipe, restart, install, and inventory on demand. Commands stream to devices and report back their results.

Compliance reporting

See which devices meet your policies at a glance. Compliance and activity reports surface drift before it becomes a problem.

Script library

Write scripts in bash, zsh, Python, Ruby, Perl, or Node in a built-in editor, run them on any Mac in the fleet, and keep the history of every run. Root execution is opt-in.

Smart device groups

Group devices by hand or by rule. Condition-based groups update their own membership and drive profile assignment, app deployment, Munki manifests, and signage.

Digital signage

Turn managed iPads, Apple TVs, Macs, and Android tablets into signage displays with the Megaphone app, pushing content and schedules to screens from the same console you use for everything else.

AI visibility and control

Discover the local models, coding agents, and AI connectors running on your Macs, decide which of them your organization allows, and enforce that decision. Collection is off until you switch it on, and prompts are never collected.

Removable storage control

One rule covers Macs and Windows PCs: record every drive that is plugged in, block the ones you have not approved, and keep an inventory of what your fleet actually uses.

Alerts where you work

A device falling out of compliance, a new app version waiting to be promoted, a certificate about to expire: choose which events are worth interrupting someone for, and route them to Slack, Teams, Google Chat, email, or your own webhook.

Multi-tenant ready

Run Xavier dedicated to one organization, or in shared mode where every tenant gets its own subdomain and isolated database, managed from an operator console.

How it works

From a device powering on for the first time to ongoing day-to-day management, Xavier handles the full lifecycle.

1

Enroll

A device enrolls through Automated Device Enrollment, a QR code, or a profile. Xavier issues its identity certificate and registers it.

2

Configure

Profiles, restrictions, and apps deploy automatically, so the device reaches the user already set up to policy.

3

Secure

Encryption turns on, keys are escrowed, and posture checks confirm the device meets your security baseline.

4

Monitor

Devices report inventory and security status on a schedule. You watch compliance, run commands, and push changes as needed.

Want to see Xavier in action?

Reach out for a walkthrough, or dive into the documentation.

Get in Touch → Browse the docs
العربية Català Čeština Dansk Deutsch Ελληνικά English Español Suomi Français עברית हिन्दी Hrvatski Magyar Bahasa Indonesia Italiano 日本語 한국어 Bahasa Melayu Norsk Bokmål Nederlands Polski Português (Brasil) Português (Portugal) Română Русский Slovenčina Svenska ไทย Türkçe Українська Tiếng Việt 简体中文 繁體中文