Organisations protect internal apps across employee devices by putting the protection inside the app. Otukan hardens each workforce app, encrypts the work data it stores, controls how that data leaves the app, and sends integrity evidence to your identity provider and internal services at sign-in. The same controls run on company-owned devices and on personal phones, with or without device management. Where you do manage devices, Otukan uses that context rather than replacing it. Each control has its own Android and iOS scope, and fleet administration remains a separate job with its own owner.
Workforce scenarios
The same app often runs on very different devices. Policy should follow the device ownership model, not assume one.
| Scenario | Who controls the device | What the app can rely on | Where Otukan focuses |
|---|---|---|---|
| Company-owned, fully managed | Your IT team | Device policy, approved app catalogue, managed configuration | App hardening, integrity evidence at sign-in, capture controls |
| Personal phone with a work area | The employee, with a managed work area | Android work profile or iOS User Enrollment separates work apps | Work data controls, encrypted storage, jailbreak and root signals |
| Personal phone, unmanaged | The employee or contractor alone | Nothing beyond the app itself | The whole in-app control set, attestation, strict export controls |
| Shared or frontline device | A team or shift | Kiosk or dedicated-device settings | Fast re-authentication, session protection, capture controls |
Unmanaged phones deserve the most attention. They are common among contractors and partners, and the work app is the only place your controls can live.
Shared frontline devices need their own treatment. Several people sign in to the same phone during a day, so Otukan protects the session rather than trusting the device owner: sign-in evidence is fresh for each user, sensitive screens are hidden from capture, and work data cached by one user is not left readable for the next.
Control fit
App data protection
Work data at rest is encrypted by the app with keys the platform protects, and Android and iOS each have their own implementation. For platform detail, see Android app data encryption and iOS app data encryption. In use, Otukan limits copy, share and open-in actions from protected screens and hides sensitive views during recording, mirroring and in the app switcher, with screenshots blocked on Android and reported on iOS. Work data controls are covered on work app data controls.
Identity and management interfaces
Otukan adds app and device integrity evidence to sign-in with your identity provider, so access decisions weigh app integrity alongside root, jailbreak and hooking signals from the phone. On managed devices, Otukan accepts policy through the managed app configuration channel that Android and iOS provide to device management tools. Internal services can then admit only protected, attested app instances. For managed configuration in detail, see managed app integration.
Ownership
App protection and fleet administration answer different questions. Keeping them apart avoids gaps and duplicated effort.
| Responsibility | App protection (Otukan Application Security) | Fleet administration (device management) | Identity |
|---|---|---|---|
| Is this the genuine, unmodified app? | Yes | No | Consumes the evidence |
| Is the phone rooted, jailbroken or hooked? | Detected from inside the app | Reported on managed devices | Consumes the evidence |
| Can work data leave the app? | Enforced in the app | Enforced on managed work areas | No |
| Which apps are installed and updated? | No | Yes | No |
| Who may sign in, and with which factors? | Supplies evidence | Supplies device state | Decides |
The same split applies when a signal fires. If the work app detects a hooked process on a personal phone, the app restricts its own sensitive features at once, your identity provider can refuse the next sign-in, and the security team receives the event. Nobody needs to touch the employee’s personal device, and no team waits on another to act.
Otukan also offers device management as a separate product for organisations that want fleet administration from the same company; it is described on mobile device management. Otukan app protection runs just as well alongside an existing device management tool, and the boundaries above hold either way.
Work apps delivered as progressive web apps through the stores are covered on progressive web app protection. For the wider application security picture, return to mobile app security. A workforce app published in the public stores can be reviewed first through a free App Exposure Check.