Signed, verified, and reversible by default
Shipping code over the air shouldn't mean trusting it blindly. Every Birdify bundle is cryptographically signed, verified on the device before it runs, and revertible in one command — and no native code is ever downloaded.
Verified on the device
Bundles are signed with your project key at publish time and delivered over TLS 1.3. Before applying an update, the SDK re-computes its SHA-256 checksum and checks the signature — anything that doesn't match is dropped, and the app keeps the last good bundle.
fetch bundle → patch #3 (4.2 MB) verify sha256 … ok 9f2c…a71b verify signature … ok key birdify:shop_app apply on next launch ✓
Fail-open rollback
A patch that fails to boot auto-reverts on device, and one command pulls it from the whole fleet. Broken updates never strand your users.
How rollback works ↗Access & delivery
Publishing is scoped per project and gated by API keys you control. Bundles are served from edge storage over encrypted transport — and you can self-host so they never leave your infrastructure.
Signed at publish time
Every release and patch is signed the moment it's cut. Verify any artifact yourself — the same check the SDK runs on device before it applies an update.
Read the full security model
The docs walk through signing, on-device verification, the rollback state machine, and how to run Birdify self-hosted — with the exact commands.
Security FAQs
Does Birdify ever ship native code to a device?
No. Birdify only pushes managed bundles — Dart for Flutter, the JS bundle for React Native, and a Server-Driven-UI description for native iOS. No compiled native binaries are ever downloaded or executed, which is exactly what keeps over-the-air updates within App Store and Play Store policy.
How does a device know a bundle is genuine?
Every release and patch is signed with your project's private key at publish time. Before a bundle is applied, the SDK verifies the signature and a SHA-256 checksum on the device. If either check fails — a tampered or truncated bundle — it is rejected and the app keeps running the last known-good version.
What happens if a patch is broken?
Patches are fail-open. A patch that throws on boot or fails its health check is automatically reverted on-device to the last good bundle, and you can pull it fleet-wide with `birdify rollback`. Users never get stuck on a broken build.
Can I keep bundles inside my own infrastructure?
Yes. Birdify is self-hostable — you can run the update server in your own environment so signed bundles are served from infrastructure you control and never leave your network.
Where is Birdify in terms of formal compliance?
Birdify is in private beta. We're building on the practices formal audits expect — signed artifacts, least-privilege access, encrypted transport — and third-party attestation (SOC 2) is on the roadmap rather than something we claim today. If you have specific compliance needs, reach out at security@birdify.dev.