A member signs in on a new phone. The app generates a device specific keypair in the phone’s hardware enclave; the private key never leaves it.
Enrollment must be approved by another authorized device, the same member’s other device or an admin’s. The approver’s tap triggers re encryption of the necessary wrapped keys to the new device key.
The layered hierarchy does the work: the device key unwraps the user key, the user key unwraps enterprise secrets and code chunks. Nothing about the seed changes.
When a member departs, an admin revokes their devices. Their wrapped key ciphertexts are purged; the member cryptographically exits every policy.
A member who loses every device re enrolls: a new keypair, an admin approval, and purge of the old ciphertexts. No seed rotation, no policy rebuild.
Every enrollment, approval, and revocation is an audit event with actor, device, and timestamp.
Per device keys generated in the mobile secure enclave; compromise of one device never exposes another.
A second authorized device co signs every enrollment, closing the silent device injection channel.
Enterprise, user, and device keys wrap in sequence, so membership changes are re encryption events, not crypto migrations.
Purging a device’s ciphertexts removes its access instantly and permanently; policies stay intact.
Losing every device means a fresh keypair and an approval, not an operational crisis.
The expensive failure mode in shared credential systems is offboarding. Here it is a revocation, not a rotation of every downstream account.
Peer approved enrollment means a stolen password alone cannot add an attacker’s device.
Purged ciphertexts are cryptographic removal: a revoked device holds keys that no longer unwrap anything.
Future device checks (MDM posture before approval) slot into the enrollment gate without changing the hierarchy.
Walk through the trust model, policy design, and rollout with our security and solutions team.