Corporate device control
A device is a distinct security subject. One user may have multiple clients with different state and risk.
Bind sessions to devices
The backend records device ID, platform, state, and related sessions. Private credentials remain in Windows DPAPI or Android Keystore.
A new login may create or confirm a device and trigger a security notification without putting message plaintext in email.
Distinguish logout, revoke, and wipe
Logout ends one session. Revoke blocks new sessions and closes realtime. Wipe additionally tells an official client to erase corporate local storage.
Administrators should see status and a minimally retained activity time, not unnecessary location tracking.
Validate state before cache
At startup, an app validates device state, security epoch, purge epoch, and workspace state before opening its encrypted database.
A high-security policy may block offline unlock after a short lease expires. This trades availability for lost-device risk reduction.
This guide explains verifiable product principles and is not legal advice.