Risk Scoring

​

Score ranges

​

Risk factors

• Jailbreak detection — Actual jailbreak/root signals. The strongest single factor.
• Development builds — Debug, Xcode, and TestFlight installs are scored as a separate, lower-weight signal than jailbreak. A dev build alone doesn’t mark a device as compromised — it’s expected during integration.
• Device integrity — Does the attestation pass Apple’s checks?
• Suspicious activity history — Past suspicious events raise the score, with recency decay: each clean week forgives one past event, so a device that stays clean earns its trust back over time.
• Device age — New devices (fewer than 3 attestations) carry a temporary penalty that clears as attestation history builds.
• Anomaly detection — Rapid country changes, app version downgrades, VPN/proxy networks, device model changes, and unusual timing patterns.
• Trust streak — A device with 30 consecutive clean attestations gets a credit against its score, and a larger one at 90.

​

Using risk data

​

By category (all plans)

let result = try await grantiva.validateAttestation()

switch result.deviceIntelligence.riskCategory {
case .trusted:    proceedNormally()      // 0–20
case .suspicious: requestAdditionalAuth() // 21–75
case .blocked:    blockAccess()           // 76–100
}

​

By numeric score (Pro / Business / Enterprise)

let result = try await grantiva.validateAttestation()

guard let score = result.deviceIntelligence.riskScore else {
    // Free plan — no numeric score. Fall back to the category.
    return handle(category: result.deviceIntelligence.riskCategory)
}

switch score {
case 0...20:
    proceedNormally()
case 21...50:
    requestAdditionalAuth()
case 51...75:
    limitAccess()
default:
    blockAccess()
}

​

On your backend

{
  "sub": "SGVsbG8sIHdvcmxkIQ-keyId",
  "risk_score": 15,
  "device_integrity": "high",
  "jailbreak_detected": false,
  "attestation_count": 47
}

​

Webhooks

• device.high_risk — A device’s score exceeds your threshold
• device.new — First attestation from a new device
• device.attestation_failed — A device fails attestation
• attestation.anomaly — One or more anomalies are detected on an attestation

​

Risk alerts

​

Dashboard