FAQ

XFA is Zero Trust device access without an MDM. It verifies that any device used for work, including personal, contractor, and BYOD devices, meets your organization's security policy at sign-in, without installing an intrusive management agent or seeing personal files or activity. XFA is EU-built, ISO 27001 certified, and GDPR-committed.

XFA is also a security technology company based in Belgium, founded to do device security better and to enable modern work. Its software is developed to high quality and privacy standards and is regularly audited by independent external parties.

XFA verifies device security at sign-in without taking control of the device: no remote management, no remote wipe, no visibility into personal files or activity. It covers BYOD, contractor, and personal devices that an MDM often cannot, and its checks align with ISO 27001, SOC 2, and NIS2 requirements.

XFA does not monitor employees. It does not track which websites you visit, log which applications you use, or monitor when or how long you're logged in. It checks device security settings, like encryption or screen lock status, to verify the device meets your organization's policy before allowing access. To link each device to the right person, XFA shares a few identifying details with your organization: the username and full name on the device, the computer name, the model, and the serial number.

XFA shares the results of device security checks, such as whether your OS and browser are up to date, disk encryption is on, or a password manager is installed. It also shares the username and full name on the device, the computer name, the model, and the serial number, so your organization can tell devices apart. The exact checks and how long you have to fix an issue are set by your organization's policy, not by XFA.

XFA's agent is a lightweight app for desktop (Windows, macOS, Linux) and mobile (iOS, Android) that runs device checks locally without admin rights. Agentless verification skips the install but is narrower: it runs a limited set of checks through a managed-browser device-trust connector, supported on Chrome (macOS, Windows) and Microsoft Edge (Windows).

XFA works with major identity providers, including Okta, Microsoft Entra ID, Google Workspace, OneLogin, Keycloak, and PingIdentity, to verify devices during sign-in. It can add device checks as an extra factor for SAML 2.0, OpenID Connect (OAuth 2.0), and custom applications, so you can protect the apps your team already uses.

XFA enforces device security checks at sign-in, giving you continuous, auditable evidence that devices meet policy, a common requirement across ISO 27001, SOC 2, and NIS2. Connectors export this device data to compliance tools like Vanta, Drata, Thoropass, TrustCloud, and Noru for audit evidence, and XFA itself is ISO 27001 certified.

XFA Free is free for any number of users, and every organization starts on it. Pro, Max and Enterprise add more, and you upgrade from the dashboard whenever you are ready. For the plans, their prices and what each one includes, see https://xfa.tech/pricing.

Yes. Organization admins upgrade, downgrade, switch between monthly and yearly billing, or move to Free from the dashboard, under Settings > Subscription. An upgrade applies immediately; from Free without a valid saved payment method, you pay the first month or year at checkout. A downgrade or a move to Free is scheduled for your next renewal date, and you can withdraw it until then. Enterprise and custom terms go through sales. See Change your plan.