XFA Desktop Application

The XFA Desktop Application checks a set of security settings on Windows, macOS, and Linux devices, and can act as a trusted device for multi-factor authentication (MFA). It sends device security information to XFA for evaluation against the policies of organizations you choose to connect to. It does not give any organization control of your computer.

How to Obtain the Application

The XFA Desktop Application is designed for use on Windows, macOS, and Linux devices. End-users can download the application here

Platform Support

The XFA Desktop App is available on macOS, Windows, and Linux.

macOS

Windows

Linux

Installing on Linux

On Linux, the XFA Desktop Application is installed through a single bootstrap command that detects your architecture and installs XFA to your user directory:

curl -fsSL https://distribution.xfa.tech/xfa-native-desktop-application/install.sh | sh

The bootstrap script works on most Linux distributions, on both x86_64 and ARM64 architectures. It installs XFA to ~/.local/bin and does not require root permissions or a specific package manager.

The XFA Desktop Application automatically appears in your menu bar shortly after installation. If the app is not running, you can launch it manually from the Applications folder on macOS, the Start menu on Windows, or your application launcher on Linux.

On NixOS

On NixOS, you add XFA to your system configuration instead of running the bootstrap command. It does not update itself: it moves to the latest release whenever you update your system. See How to install XFA for the steps.

Status icons

The XFA logo sits in your menu bar (macOS and Linux) or system tray (Windows), and changes to show how your device is doing:

The normal logo means your device passes all of its security checks.
The checking logo appears briefly while XFA runs its checks.
The warning logo means one or more checks need your attention.

Click the XFA icon to open the menu. If something needs attention, the menu lists it and links to instructions for fixing it yourself.

The menu shows a section for every organization you share your device security status with, headed Device security status · [organization name]. Under it you see whether your device meets that organization's policy, and which checks need attention.

When an organization invites you, the menu shows Invite from [organization name]. Choose Accept to start sharing your device security status with that organization, or Decline to dismiss the invitation.

To stop sharing with an organization, click Manage sharing next to its name and click the trash icon labeled Disconnect. Uninstall XFA explains the full flow.

Data collected

The XFA Desktop Application checks a fixed set of device settings, regardless of which checks your organization's policy uses. Your organization decides which checks count toward its policy and how long you have to fix an issue.

The app sends the collected device security information to XFA to evaluate those policies. This includes your user and computer names, device make and model, operating system and browser versions, and security settings such as disk encryption, screen lock, firewall and password manager status. AI checks can also report running AI process names and repository paths. The environment secrets check records matching variable names, never their values.

XFA runs without administrator rights and does not give your organization control of your device. It does not collect your documents, messages or browsing history.

Using the XFA App for MFA

When you sign in to an XFA-protected app from a new device, the desktop application can confirm that it's really you. The menu asks Is this you signing in? and shows the device name and how long ago the request was made. Click Approve to allow the sign-in, or Deny to refuse it. On Windows and Linux, the same choice appears as Yes, this is me and No, don't allow.

For the other ways to verify a sign-in, see Verification methods.

Best Practices for Users

Fix issues when the app first flags them, before your organization's deadline turns a warning into a block. Now and then, check which organizations receive your device security status, and stop sharing with any you no longer work with.