Device Trust

Every phone, checked. Every risk, explained.

Device Trust is a NounDesk feature that runs 10 security checks on every enrolled company Android phone and gives it one rating: Trusted, At risk, Not trusted or Not reported yet. It checks system integrity with Google Play Integrity, screen lock, encryption, how old the last security update is, Google Play Protect, unknown app sources, USB debugging, developer options, your company policy and when the phone last checked in. Each rating comes with a plain-English reason and the fix. It updates every time the phone checks in, and there is nothing to install.

Start freeAll features
The device list with a Trust rating and a plain-English reason for each phoneapp.noundesk.comDevice Trust2 of 4 trustedPixel 8a · Van 3All 10 checks passTrustedMoto G · PriyaSecurity update is 104 days oldAt riskGalaxy Tab A9 · CounterAll 10 checks passTrustedGalaxy A15 · Crew BNo PIN, pattern or password setNot trusted
Device Trust in NounDesk.

One rating for every phone

The devices list shows a Trust badge next to every phone. You can see in one column which phones are fine and which need you this week.

  • Trusted: every check passes.
  • At risk: something is worth fixing soon, like a security update that is getting old.
  • Not trusted: a serious problem. Fix it before the phone holds work data.
  • Not reported yet: a newly enrolled phone that hasn't sent its first security report.

Every problem comes with the fix

A red badge on its own doesn't help. Each rating says what is wrong in one sentence, and what to do about it, in words you would use with a new hire.

  • "No PIN, pattern or password. Anyone holding the device can open it."
  • No security jargon to look up, and no report to decode.
  • Phones in lost mode are marked Not trusted automatically, so a missing phone never shows as safe.

The full breakdown on the Security tab

Open any phone and go to its Security tab to see all 10 checks, each marked pass, warning or fail. That page is where you look when a customer or insurer asks how your phones are protected.

  • System integrity comes straight from Google Play Integrity, not from an app on the phone.
  • Security updates must be less than 90 days old to pass.
  • The company policy check tells you whether the phone meets the security settings you chose.

Always current, with nothing to run

You never start a scan. The checks run again every time a phone checks in, so the rating reflects the phone as it was the last time it reported.

  • Works on every phone you have already enrolled, with nothing to install.
  • A phone that hasn't checked in for a day doesn't pass the last check-in check, so stale data is flagged.
  • Company-owned Android phones and tablets only, for now.

Most small business owners can't say whether a work phone is actually safe. Is it locked? Encrypted? Months behind on updates? Finding out usually means picking up each phone. Device Trust answers all of it in one column.

The 10 checks on every phone

Every enrolled phone is checked against the same ten things each time it checks in.

  • System integrity

    Google Play Integrity confirms the phone isn't rooted or running modified software.

  • Screen lock

    A PIN, pattern or password is set.

  • Encryption

    Data stored on the phone is encrypted.

  • Security updates

    The latest security update is less than 90 days old.

  • Google Play Protect

    App scanning is on.

  • Unknown app sources

    Apps can only come from Google Play.

  • USB debugging

    Off, so a computer plugged into the phone can't read it.

  • Developer options

    Off.

  • Company policy

    The phone meets the settings in your security policy.

  • Last check-in

    The phone reported within the last day, so the results are current.

Security policies →

Where you see it

The rating shows up in two places, so you can scan the whole fleet or dig into one phone.

  • Devices list

    A Trust badge beside every phone.

  • Security tab

    All 10 checks with pass, warning or fail, and the fix for anything not passing.

What to do with an untrusted phone

Device Trust doesn't yet stop an untrusted phone from signing in to your apps, so the fix is still yours. The difference is that you now know which phone, what is wrong and what to do.

  • No screen lock

    Publish a policy that requires one.

  • Developer options or USB debugging on

    Ask the employee to turn them off.

  • Phone lost

    Lost mode locks it and marks it Not trusted until it comes back.

  • Fleet-wide picture

    The dashboard and reports show patch age and compliance on every phone.

Lost mode →Dashboard →Reports →See your fleet's trust score in 10 minutes →

Related features

Security policies

Android security policies in plain English: pick a template, set screen lock, updates, camera, Wi-Fi and encryption, and preview changes before publishing.

Dashboard & inventory

An Android device dashboard and inventory for small fleets: see which phones are online, offline or need attention, and filter by group, employee, policy.

Lost-device recovery

Lost company phone? Lock it in lost mode, show your number on screen, see where it last reported and erase it if needed. Location only in lost mode.

From the blog
ArticleHow to Keep Company Android Phones Updated and PatchedHow to check the Android security patch level on one phone or a whole fleet, and a 20-minute monthly routine that keeps every company phone updated.ArticleCorp MDM Spyware: Settings That Stop Fake Play InstallsHow the Corp MDM Android spyware used fake Google Play pages to steal SMS and forward calls, and the four phone settings that stop it on company devices.

Read the complete guide to Android MDM for small business →

User guide
Guide · DevicesDevice trustRead a device's Trust rating in NounDesk, see which of the 10 security checks failed and follow the plain-English fix for each one.Guide · DevicesDevice statusHow NounDesk describes a device: its lifecycle, whether it's online, whether it follows its policy, and whether it can be trusted.Guide · MonitoringFix compliance issuesEvery compliance issue NounDesk can show on a device, what it means, what to do, and which ones clear up on their own.

Browse the full user guide →

Device Trust: questions answered

What does Device Trust check?

Ten things on every phone: system integrity, screen lock, encryption, security update age (under 90 days), Google Play Protect, unknown app sources, USB debugging, developer options, whether the phone meets your company policy, and whether it has checked in within the last day.

How does it know a phone is rooted?

The system integrity check uses Google Play Integrity. Google confirms whether the phone is running the software its maker shipped, or has been rooted or modified.

Does it block an untrusted phone from signing in to company apps?

Not today. Device Trust tells you which phones have a problem and how to fix it. You then act on it, for example by changing the security policy, locking the phone or putting it in lost mode.

How often is the rating updated?

Every time the phone checks in. If a phone goes quiet for more than a day, the last check-in check says so, so you never read an old result as a current one.

Does it work on employees' personal phones?

No. Device Trust covers company-owned Android phones and tablets enrolled in NounDesk. Personal (BYOD) phones are not supported yet.

Do I need to install anything?

No. It works on every phone you have already enrolled, with no extra app and no setup.

Ten phones. Ten minutes. Protected.

Start a 14-day free trial, no card required. Or load a sample fleet in demo mode first.

Start freeSign up and try demo mode