Before installing a desktop app on a work machine, check six things: where the download comes from, whether it is signed, whether the checksum matches, what access it asks for, how it updates, and where its data goes. Any item you cannot answer is a reason to pause.
1. Source
Reach the download page by a bookmark or typed address. Search ads and links in messages are the usual route for fake installers. Confirm the page is served over HTTPS and belongs to the vendor.
2. Signing
A signed app ties the file to a publisher. Check what the vendor says. Safeguard's download page, for example, says the macOS builds of Desktop are signed and notarized and the Windows builds are not yet code-signed. A clear statement like that is useful, and an unsigned build is not a rejection reason on its own, but it raises the weight of the other checks. Microsoft notes SmartScreen warns when a file or signing certificate has no established reputation.
3. Checksum
Compare the SHA-256 hash of your download with the published value. A vendor that publishes checksums for each build, as Safeguard does, makes this easy. A vendor that publishes none makes it harder to trust the file. See how to verify.
4. Access it asks for
Note what the app needs: administrator rights, file system access, network access, background services, browser extensions. Prefer apps that need less. A per-user install with no administrator rights, as the Safeguard Windows installer is described, limits what a mistake can touch.
5. Update path
How does it receive fixes? Automatic updates are convenient but widen trust in the vendor's build system. Manual updates put the work on you. Whichever it is, know it, and record the version you approved.
6. Data handling
What leaves the machine? Ask whether source code, file names or only an inventory is transmitted, and where results are stored. Get the answer in writing if the data is sensitive. Statements on a marketing page cover that page, so ask for the policy that covers the product.
Rate the result
Give each item pass, partial or fail. Two or more fails means do not install. One fail needs a named person to accept the risk with a date to revisit. All passes still means keep the version number and review again at the next major release.
For administrators
Turn the checklist into a standard form and keep the completed forms. When an incident hits a tool in your fleet, you will know in minutes who has it and at which version. Without the forms, that is a day of searching.
Also decide who may install what. A small list of approved tools with approved versions is easier to defend than a rule that nobody may install anything.
Where Safeguard fits
You can apply this checklist to Safeguard Desktop using the download page facts above. The free scan at gold.safeguard.sh/scan needs no install and no login.
Quick check
Is an unsigned installer always unsafe?
No, but it raises the importance of the checksum, the source and your other checks.
What should I record after approving an app?
The version, the checksum, the date, the approver and a date to review again.
Sources
Last reviewed: 19 October 2026.
