Frequently Asked Questions
Everything you need to know about integrating Aegis Guardian, Sentinel telemetry, offline capabilities, and security architectures.
What is the difference between Standalone SDK and Sentinel Enterprise? ＋
Standalone SDK operates completely on-device without external server dependencies, providing immediate threat detection. Sentinel adds centralized risk intelligence, hardware key attestation (Play Integrity / App Attest), dynamic risk scoring, device blocklists, and server-side risk decisions.
Does Guardian send telemetry data when Sentinel is not configured? ＋
No. Basic checks continue to run locally and offline. Sentinel monitoring is enabled only when you explicitly configure its URL and Client ID in the SDK initialization.
What changes in Guardian 3.1.0 when Sentinel is unavailable or misconfigured? ＋
The Sentinel call returns a failure result with a stable category, such as networkUnavailable, invalidUrl, or invalidClientId. Ignoring that result does not close the app or call the local violation callback. Your backend should treat the missing verified assessment as unverified for sensitive actions. Guardian 3.1 is published on Maven Central (3.1.0), Swift Package Manager and CocoaPods (3.1.1), and pub.dev (3.1.1).
Does an unavailable security check mean the device is safe? ＋
No. Guardian 3.1.0 distinguishes clear, detected, unavailable, notConfigured, and unsupported. A required check passes only when its status is clear. Use the named check statuses for security policy; a false legacy boolean may also mean the probe could not run.
Does Aegis Guardian affect app startup time or battery performance? ＋
No. Guardian is designed to be extremely lightweight and executes its checks asynchronously on background worker threads. The scan routines take only milliseconds and add virtually zero measurable overhead to your app launch time or battery life.
Can Guardian run security checks when the device is offline? ＋
Yes. Core checks such as root and jailbreak indicators, emulator, debugger, hooking frameworks, proxy, and VPN run locally without a network connection. Frida detection, server-verified app identity, and blacklist decisions are Sentinel premium features and need a connection; offline, they report unavailable rather than clean.
Does Aegis Guardian or Sentinel collect Personally Identifiable Information (PII)? ＋
Local inspection sends nothing. When you enable Sentinel, each report includes a persistent device identifier, device brand, model and build fingerprint, OS and app version, security check results, and the IP address the server sees, plus any user or session ID your app passes. On Android the device identifier is a hash derived from the Widevine DRM ID or ANDROID_ID and may survive a reinstall; hashing makes it pseudonymous, not anonymous, so treat it as personal data under GDPR and UU PDP and disclose it in your privacy policy and store data forms. The SDK does not read contacts, SMS, location, photos, browsing history, or files.
What is the difference between Maven Central, CocoaPods, and pub.dev? ＋
Maven Central hosts the Android library (aegis-guardian). For iOS, Swift Package Manager (aegis-guardian-ios-binary) is the recommended install; CocoaPods (AegisGuardian) remains available as a legacy option because CocoaPods Trunk is becoming read-only. pub.dev hosts the Flutter plugin (aegis_guardian), which bridges to the native SDKs.
Does the SDK automatically block every transaction? ＋
The SDK returns device checks and an assessment decision. Your app can react immediately, but critical business logic and transactions should always be validated on your backend server before execution. Do not treat a mobile UI alone as authorization.
Does a clean scan result guarantee a 100% safe device? ＋
No client-side check can provide a 100% guarantee against advanced attackers. However, combining on-device checks with cryptographic hardware attestation and server-side validation exponentially raises the attack difficulty.
Can I put the Sentinel Client Secret in my mobile application? ＋
No. Mobile apps only use the public Client ID for telemetry. The Client Secret must remain confidential on your backend server to verify token assessments via the POST /api/v1/assess endpoint.
Is the Guardian Unique Device ID a permanent hardware identifier? ＋
No. It is an app-scoped convenience identifier, not a globally unique hardware ID, authentication credential, or proof of device identity. It may change after reinstall, data clearing, reset, or platform updates.