Integrate without changing your transport

Requirements

Install

npm install react-native-device-risk-signals
npx pod-install

Use the repository package manager and existing Bundler workflow when applicable. Autolinking registers the native module.

Configure purpose and consent

Start with the smallest set that serves a documented purpose. Consent is subtractive: it can remove probes from collection, not silently enable additional ones.

import { consentFor, DeviceIntel } from "react-native-device-risk-signals";

const deviceIntel = new DeviceIntel({
  sessionId: session.id,
  consent: consentFor([
    "device_identity",
    "application",
    "os_integrity",
    "device_security_posture",
    "runtime",
  ]),
  probes: {
    network: { enabled: false },
    geolocation: { enabled: false },
    transaction_safety: { enabled: false },
  },
});

Collect at a meaningful event

Attach a server-generated session or action identifier. Avoid stable identifiers created solely for fingerprinting.

const event = await deviceIntel.collect({
  sessionId: checkoutSessionId,
});

await api.post("/mobile-risk-observations", {
  accountActionId,
  observations: event,
});

The example endpoint is owned by the host application. It is not part of this package.

Collect protected-action context separately

transaction_safety is disabled by default. If your physical-device calibration and privacy review support it, collect immediately before a protected action rather than during every app launch.

const protectedActionEvent = await deviceIntel.collect({
  probes: {
    transaction_safety: { enabled: true, timeoutMs: 900 },
  },
});

Accessibility or screen-sharing state can be legitimate. Use it as review context, not an automatic accusation.

Backend contract

1. Authenticate the mobile request using your normal session controls.
2. Validate event schema, SDK version, collection timestamp, and action binding.
3. Preserve probe outcome semantics. Missing, skipped, timeout, and error are distinct.
4. Compute derived features and policy on a trusted backend.
5. Apply retention, access controls, monitoring, and deletion requirements.