Otukan puts enterprise controls inside the work app, so they follow it onto company-owned phones, personal devices and contractors’ devices alike. Data rules, integrity checks, device health signals and per-app VPN access travel with each protected work app, without enrolling the whole phone. Evaluate it by asking whether your controls follow the app or stay with the device. It works alongside device management where you have it, and covers Android, iOS, Flutter and React Native apps with each control scoped per platform. Otukan governs the work app and the data in it; the rest of a personal phone stays the employee’s own.
Where enterprise data is exposed
Work now happens on phones the organisation does not fully control. A field engineer opens job sheets on a personal Android phone. A contractor approves purchase orders on an iPhone that no one in IT has seen. A partner’s staff use your internal app for a few months and move on. Each case puts corporate data and internal access on a device outside your management.
The affected flows
Three flows carry the risk. Sign-in hands a corporate identity to an app on an unknown device. Access opens a path from that device into internal systems. Data handling puts documents, customer records and credentials on the screen, where they can be copied, shared or captured.
Where the line falls
The boundary sits between the device owner and your organisation. On a company phone, device management moves that line in your favour. On a personal phone it cannot, and asking staff to hand over their whole device rarely works. The work app is the one part of the phone you can govern everywhere.
| Flow | Risk on an unmanaged device | Otukan control |
|---|---|---|
| Sign-in | A valid identity used from a compromised or tampered app | Mobile SSO integration, integrity checks |
| Access | A risky device tunnelling into internal systems | Enterprise access and per-app VPN, mobile threat defence |
| Data handling | Corporate data copied, shared or captured into personal apps | Work app data controls |
| Web-based tools | Browser-delivered work apps with no app-level controls | Progressive web app protection |
How responsibility is split
The work app
Otukan runs inside each protected work app. It checks that the app is genuine and unmodified, reads the device risks that matter to it, applies your data rules on each screen and decides whether the per-app tunnel may open. Every check responds per your policy: observe, warn, restrict or terminate.
Platform work separation
Both platforms separate work from personal use in their own ways. Android offers a work profile, created by device management on company-owned or personal phones, and managed configurations for apps. iOS offers managed apps, managed app configuration and a user enrolment mode for personal devices. Otukan reads policy through these mechanisms where they are present, and applies its own controls where they are not.
Identity and access services
Your identity provider, access gateway and internal services make the final decisions. Otukan passes app and device evidence to them with each sign-in and connection, so an identity from a tampered app or a jailbroken phone can be stepped up or refused on your side. For company-owned fleets, see device management.
How to evaluate enterprise application protection
Apps and platforms in scope
List the work apps and their frameworks, then ask for each control per platform. Data controls behave differently on Android and iOS; per-app tunnelling has different platform plumbing on each. Otukan documents every control per platform, and your pilot should include both company-owned and personal devices.
Scenarios to rehearse
Run the scenarios staff will meet. Copy a customer record from the protected app and try to paste it into a personal messenger. Try to capture a sensitive screen, and confirm it is blocked on Android and masked during recording on iOS. Open the app on a jailbroken test phone and confirm the tunnel stays closed. Sign in from a repackaged copy and confirm your identity provider sees the failure. Check that each event appears in the records your security team uses.
Staff experience
Staff adopt what does not get in their way. Measure start-up time and sign-in friction with the protected build on the devices people actually carry. Test that work-to-work sharing still flows, so rules stop leaks rather than work. Write down plainly what the app checks on a personal phone and what it never touches, and share it before rollout; clear boundaries win agreement from staff and their representatives. Integration steps are covered on how Otukan integrates.