Open-source device integrity SDKs for mobile apps
Probe the device. Read the measurements. Decide on your server.
Remote attestation is useful but on its own can be fooled. Necessary switches on the measurements a device lets an app make — about the device, its network and your app — puts them in a report, and signs it. It helps your team read them, so you can verify each report on your own servers and run the checks your business needs.
1
Root and jailbreak traces, hooking tools such as Frida, debuggers, emulators, changes to your app's code, the network and more — measured on the device and signed with a key the SDK never exports. Personal measurements, such as the location, stay off unless your app switches them on.
2
Every measurement is described field by field: what it is, how the device measures it and what a complete answer holds. The integration guide shows your backend how to ask for a scan and check what comes back.
3
Your server checks each report — a fresh challenge, the signature, no replays — and weighs the measurements with your own business rules. The SDK never sends a score or a verdict, and no hosted service sits in between: the decision is yours.
The SDKs share one report format, so one backend can check reports from all of them.