A device must be trusted before it can transact.

Because the app can record cash collections and access borrower data, an unenrolled or untrusted device authenticating to it is a serious risk — it could post fraudulent collections or expose borrower information. Device trust closes that door: an unknown phone simply cannot transact.

Login is by phone number — there is no company or email picker. The phone number resolves the agent's institution, matching the identity pattern used across the Ustawi platform exactly; this is a confirmed, platform-wide convention.

A newly logging-in phone starts as pending enrolment, with collection and worklist actions disabled, until it is approved and marked trusted. Only then does it unlock transacting. If a phone is lost or stolen, an administrator can revoke the device instantly from the portal, and it can no longer authenticate or transact.

Device trust is not just a phone-side setting. In the web portal, pending-device approvals surface as a live badge in the Field Ops sidebar group, so an administrator sees and acts on enrolment requests. This portal-side behavior is shipped, real product behavior — managed in the Staff, Admin & Security app.