Inspect the tag
Read the exact public source commit and short release notes before you download anything.
A Compliance Everywhere open-source project
Laptop security evidence
should be free.
Device Checker is a small open-source app for the four laptop settings your SOC 2 audit asks about: encryption, screen lock, automatic updates, and endpoint protection. It is free, runs on Windows, macOS and Linux, and its evidence lands in your controls on its own.
Current preview artifacts are transparently labelled unsigned. Production installers are published only after platform signing verification. Made with ♥ by Compliance Everywhere.
Example workspace
Work laptopsAll four settings are onCurrent evidence from every laptop
- ACAmelia ChenMacBook ProEncryption on ✓
- DMDiego MoralesWindows laptopScreen lock on ✓
- SRSofia RamirezMacBook AirUpdates on ✓
- NKNoah KimUbuntu laptopProtection on ✓
Sample workspace, illustrative data only
What it reads
The four settings that matter.
Each result is short enough for a person to understand and specific enough for an auditor to test. Anything the checker cannot read remains unknown. It never guesses a pass.
- 01Full-disk encryption is enabled.
- 02The screen locks automatically.
- 03Automatic operating-system updates are configured.
- 04The operating system's endpoint protection is active.
Security boundaries
Evidence from the device. Control stays with you.
- It cannot run arbitrary commands or change a setting.
- It has no permanent listener or inbound network port.
- It pairs once in your browser and stores no browser session.
- Every report is signed by a per-device key pair.
Open source, end to end
Inspect it before you install it.
Every release is built from a public tag in GitHub Actions. Before installing, compare its hash and verify its build provenance with the GitHub CLI.
Check the hash
Each release publishes SHA-256 checksums alongside the installer or package.
Verify provenance
GitHub confirms the downloaded artifact came from this repository's release workflow.
gh attestation verify ./DEVICE_CHECKER_FILE \
--repo cruzryan/hackzero-device-checkerProduction Windows and macOS installers also require valid platform signatures. An unsigned development artifact is labelled as such, never presented as signed. The source, architecture, data inventory and security policy are public; release artifacts include checksums and a software bill of materials.
Frequently asked
Questions.
01Is this an MDM?
No. It does not enforce settings, remotely control devices, install software, run commands, or inventory files. It only reads a small, documented set of security signals.
02What does it collect?
Only the operating-system version, checker version, collection time, and posture outcomes. It does not collect files, browsing history, screenshots, keystrokes, location, or passwords.
03What happens when a laptop is offline?
Nothing is marked failed just because a laptop is asleep or offline. Compliance Everywhere shows that the last report is no longer fresh; a failure is reserved for a setting the device actually reported as failing.
04How does device sign-in work?
The owner pairs once through the normal Compliance Everywhere sign-in page using OAuth authorization code plus PKCE. The application never stores a browser session, password, or long-lived personal API token.
05When can I install it?
The source is available now. Signed installers are published only after each platform's packaging and signing verification is complete.
Every laptop, checked.
Free with your SOC 2.
Device management is included in the subscription. Connect the checker, and the evidence lands in your controls on its own.