Security
The keys to every device. Kept like it matters.
Here is exactly how Xavier protects your fleet, layer by layer.
Signed
Every Apple and Windows check-in, verified against its own certificate.
Held
Untrusted enrollments get nothing until you approve them.
Proxied
Packages come through Xavier. Your bucket stays private.
Sealed
Recovery keys and credentials, encrypted with AES-256-GCM.
Device trust
Every device proves who it is
Signed check-insEach Apple and Windows request is checked against the certificate that device enrolled with.
Hardware-attested identitySecure Enclave keys, attested by Apple, on supported devices.
Held until approvedAn untrusted enrollment receives nothing until an administrator says yes.
Sign in to enrollGoogle Workspace, Entra ID, Okta, or any OpenID Connect provider.
A pinned Android agentA substituted agent cannot become Device Owner.
Software delivery
Software arrives through Xavier
Munki and Chocolatey, proxiedDevices fetch packages from Xavier, never straight from your bucket.
Your bucket stays privateShort-lived signed links. Devices never hold your storage keys.
Checked before importDownloads are matched to a pinned SHA-256.
Device
Munki · Chocolatey
authenticated
Xavier
read-only
streamed
Your storage
never public
No direct access
Keys and secrets
Every key, sealed and accounted for
Encrypted by the applicationRecovery keys, escrowed passwords and credentials, AES-256-GCM.
Every reveal recordedAdministrators only, always logged.
Never without a keyBitLocker rotation stores the new key before removing the old one.
On the device
Least privilege, on every endpoint
A root helper only Xavier can call
Signature-checked, with a short, fixed list of jobs.
Blocked before launch
Matched by code signature, not file name.
Guard rails built in
System software and Xavier itself can never be blocked.
A filter that never reads
Decides by destination. Never inspects content.
No self-inflicted outages
A broken rule never locks your people out. Work carries on.
A tray app with nothing to exploit
No privileges, and a fixed set of requests.
Your data
Isolated by design
A database per customerNot a filter on a shared one.
Credentials bound to one tenantPresented anywhere else, they are refused.
Bring your own databaseKeep device data in your own MongoDB.
AI discovery without secretsOff by default. Keys become fingerprints on the device.
Your team
Access with a trail
Single sign-on for adminsOpenID Connect or SAML 2.0, with roles from your provider's groups.
Require single sign-onPasswords off for everyone but the account holder and the admins you choose.
Access ends when it shouldDeactivate someone or change their role and their sessions end at once.
A read-only auditor roleSees everything. Changes nothing.
AI that can look, not touchRead-only by construction, enforced by tests.
A year of activityEvery sign-in, command, script, key reveal and AI query, kept 365 days.
Questions from your security team?
We will walk them through any of it.