Trustaige · Device trust
Most “device trust” answers a weak question: does the user own a managed device somewhere? Trustaige answers the right one. Is the device making this sign-in, right now, the one we enrolled? A device-bound certificate is presented at sign-in. Sessions without it never get issued.
The wrong question
A user who enrolled their laptop on Monday can sign in from a stranger's desktop on Tuesday — and most device-trust checks pass. The user has *a* managed device, after all. The actual machine making the request was never inspected.
The right question
Trustaige binds every sign-in to a specific device through a cryptographic handshake. The device presents a certificate your tenant signed; the server verifies it against your tenant's trust anchor; only then does the session get issued. Possession is proven, not assumed.
How the bond is made
On enrolment, the device generates a private key in tamper- resistant hardware and exchanges it for a certificate signed by your Trustaige tenant. The key never leaves the hardware. The certificate is presented on every sign-in. If the certificate is invalid, missing, or revoked, the sign-in stops — before any session token is issued, before any application is reached.
For your security team this means a phished passkey alone is not enough to gain access. The attacker would also need to be running on a device your tenant signed a certificate for. They aren't, and they can't easily become.
Three platforms, one console
Trustaige manages the three operating systems most enterprise workforces ship to their teams. Each platform's management surface is the native one Microsoft, Google, or Apple sanction — no third-party MDM bolted on, no agent installs where the platform doesn't need one.
Windows
Windows ships with a management protocol baked into the OS. Trustaige enrols devices over that protocol — no extra agent to deploy, nothing to maintain on top of what Windows already runs.
agentless enrolment
Android
Hand the user a QR code; they scan it; the device enrols. Trustaige uses the same enterprise enrolment surface Google sanctions for managed Android devices, with work-profile separation between the user's personal apps and your tenant's policies.
qr enrolment
macOS
Apple's MDM surface is unforgiving on macOS, so we ship a desktop app instead. Trustaige Envoy lives in the menu bar, presents the device certificate at sign-in, and reports posture back to your tenant — without invasive root-level hooks or kernel extensions.
envoy agent
What happens after enrolment
Disk encryption, OS version, screen-lock setting, presence on the domain — the agent reports the device's state to your tenant continuously. If the device drifts out of policy, the certificate is revoked and access is removed without waiting for the next sign-in.
A device that falls out of compliance can't reach sensitive applications. The gating happens at the identity layer, not inside each application — so you don't need every app to learn about your device posture independently.
When a device walks off — lost, stolen, terminated contractor — one administrative action revokes the device's certificate and wipes the managed surfaces. Access disappears in seconds; the lost laptop becomes a brick.
Start a conversation
We'll walk through a working deployment, map it to your stack, and tell you honestly where Trustaige fits — and where it doesn't.