Since the first day I started building SAFi, two questions have sat side by side on my mind: how do we make this available on every device, and how do we do it without weakening the security posture the architecture is built on?
Those two goals usually pull against each other. The common answer is to ship native apps for iOS and Android, a desktop client, and a web app. That means multiple codebases, multiple release cycles, and multiple attack surfaces to monitor.
Every additional codebase is another place where a dependency goes stale, a permission gets misconfigured, or a patch lands late. For a governance platform, where the whole promise is that declared values and real behavior stay aligned, that kind of drift is not acceptable.
So SAFi is adopting a Progressive Web App architecture for both mobile and desktop access.
One codebase. The JavaScript, HTML, and CSS in the public directory serve every surface, from a phone on a trailhead to a workstation in a compliance office.
When we ship a fix, every user has it on next load. There is no waiting on app store review, no fragmented version sprawl, and no separate mobile build quietly running last quarter’s dependencies.
The security case is just as strong as the maintenance case. A PWA runs over HTTPS by default, inherits the browser’s sandbox and permission model, and keeps authentication and session handling in one place instead of three. One codebase means one threat model, one audit trail, and one patch path. That is a posture we can actually reason about and defend.
It also keeps the experience coherent. The same interface, the same language, the same workflows, whether a user is on a laptop, a tablet, or a phone. Consistency is not a cosmetic concern in governance software. When people know exactly what they are looking at, they trust what it tells them.
For organizations that need something more, our APIs are open. If a business wants to build a native Android or iOS client, integrate SAFi into an existing internal app, or wire alignment checks directly into its own systems, the endpoints are there. We are not closing that door. We are simply refusing to make everyone else pay the maintenance and security cost of doors most of them will never use.
One codebase. One security posture. One SAFi, everywhere.
A note on limits, and a request
Progressive Web Apps are not uniformly supported across every ecosystem, and it would be dishonest to pretend otherwise. Apple is the clearest example. Safari on iOS supports web push only for apps installed to the Home Screen, and it has historically trailed Chrome and Edge on background sync, storage behavior, and install flow. What works cleanly on Android or on a desktop browser can behave differently, or not at all, on an iPhone. We are tracking those gaps as Apple closes them, and we will publish what we find rather than let users discover it on their own.
There is a second limit that matters more to us, and it is a deliberate design choice rather than a platform constraint. A standard PWA leans on service workers to cache assets, serve content offline, and intercept network requests. SAFi gives administrators the ability to turn caching off completely from the admin settings, and that control has to mean exactly what it says. A service worker sits in the request path and manages its own storage, so it can hold a copy of something an administrator has already instructed the system not to retain. When that happens on a governance platform, the result is a stale version of the truth served from a layer the administrator believed was disabled, and stale governance is misaligned governance.
That is why SAFi keeps its service worker footprint minimal and scoped to static assets only. No caching of policy definitions, no caching of decision output, no caching of audit or ledger data, no offline decision paths. The admin caching switch stays authoritative, and nothing in the client layer is allowed to quietly override it. The cost is that some conveniences other PWAs offer will not appear in SAFi. We think that is the right trade for software whose entire value is that it tells you the truth about your own systems.
This is where we need you. Install SAFi on your phone, your tablet, and your desktop. Run it on Safari, on Chrome, on Edge, on Firefox. Turn caching off in the admin settings and confirm that it stays off. Tell us what breaks, what feels slow, and what feels wrong. Open an issue on GitHub.
Testing across real devices in real conditions is the only way we find the edges, and feedback from people running SAFi in production is worth more to us than any internal testing cycle.
Governance software earns trust by being tested in the open. That is exactly how we intend to build it.