Device-bound access control is a security rule that allows a chat, account feature, or sensitive action to be opened only on approved devices. Instead of trusting every signed-in session equally, the service ties access to a primary phone, hardware key, or other specific endpoint. This is different from encryption: the data may still be protected in transit, but only certain devices are allowed to decrypt or display it.
This matters because many real compromises happen after login, not by breaking cryptography. Stolen browser sessions, shared computers, linked companion phones, and unattended desktops can expose private messages even when end-to-end encryption is in place. By narrowing where content can appear, device-bound controls reduce the blast radius of a stolen session and support endpoint containment. Defenders use them alongside session reviews, reauthentication, and device management to limit exposure, though they do not stop physical access to an unlocked trusted device.