FAQ

Questions and answers

• What does Otukan Application Security protect?

  It protects Android, iOS, Flutter and React Native apps after release. Otukan combines code obfuscation, anti-tampering, runtime self-protection, root and jailbreak detection, app attestation and mobile API protection, fraud and malware signals, and threat monitoring. Static protection makes the shipped app hard to read and change; runtime checks watch the live app and apply the response you set. Each control is scoped for Android and iOS separately.

• What is the difference between app shielding and RASP?

  App shielding is the wider term: protection added before release, such as obfuscation and integrity checks, together with checks that run inside the app. RASP names the runtime part: detecting debuggers, hooking frameworks, emulators and rooted or jailbroken devices while the app runs, then applying a response. Otukan delivers both as layers of one product, so the static layer also protects the runtime checks from being found and removed.

• Does Otukan treat Android and iOS the same way?

  No, and deliberately so. Android and iOS differ in how apps are built, signed, distributed and sandboxed, so Otukan gives every control its own Android scope and its own iOS scope. Root detection is an Android control and jailbreak detection an iOS one; Play Integrity and App Attest are separate platform services. Your team sees exactly what applies on each platform before a protected build ships.

• How does Otukan make attacks harder?

  Otukan raises the effort, skill and time an attack needs. Obfuscation and integrity checks make the app slower to understand and costlier to modify. Runtime checks detect hooking, debugging, emulators and modified operating systems while the app runs, and send a signal to your backend. That signal is what lets your server respond to an attacker who persists, which is where lasting protection comes from.

• Who decides what happens when Otukan detects a threat?

  You do. Otukan applies a response policy you set for each user flow: observe and record the signal, warn the user, restrict a sensitive function, or end the session. A login screen and a payment confirmation can react differently to the same signal. Runtime signals also go to your backend, so your server can step up authentication or decline a request under rules you control.

• Does Otukan fit our build and release process?

  Yes. Otukan fits your existing build and release pipeline, including your CI/CD system, so protection runs as a repeatable step in every release rather than a separate project. Your signing keys stay with your team, and signed releases go through Google Play and the App Store as before. We confirm the details for your platforms, framework and pipeline during a technical conversation.

• Do you need our signing keys or source code?

  No. Signing keys stay with your team, and signing remains under your control on both platforms. On Android, protection is designed to work with Play App Signing; on iOS, with App Store distribution signing. We never ask for binaries, source code, signing keys, credentials or production data through this website or the contact forms.

• How does Otukan protect our backend API?

  Otukan gives your backend evidence that a request comes from your genuine, unmodified app. App attestation works with the platform services, Play Integrity on Android and App Attest on iOS, and adds Otukan's own runtime signals. Your API gateway or backend can then tell your real app apart from scripts, emulators and modified clients, and decide how to treat each.

• What is the difference between Device Security and Device Management?

  Device Security is built into the device itself. Otukan embeds protection at firmware level for device makers and institutions, scoped per device model and chipset. Device Management is how an organisation enrols, configures, controls and retires the devices it runs. Otukan's MDM covers enrolment, kiosk and dedicated devices, policy, control over where management data lives and OEM-distributed management.

• Who is Otukan Device Security for?

  It is for OEMs and ODMs building devices, and for institutions that commission devices for their own use. Otukan works at firmware level on boot integrity, signing, update control and how data and policy are controlled on the device. Because the work depends on the hardware and on who owns each signing key, Otukan scopes it per device model, chipset and integration role.

• Can Otukan Device Management run kiosk and dedicated devices?

  Yes, on Android. Otukan runs dedicated Android devices in single-app or multi-app kiosk mode for kiosks, field terminals and shared devices, and maintenance staff leave kiosk mode only through a controlled, logged exit. Enrolment and policy cover the wider fleet on Android and on iPhone and iPad. You also decide where management data is hosted, which matters for institutions with data residency requirements.

• What is the App Exposure Check?

  It is Otukan's free, passive review of the version of your app that is already public on Google Play or the App Store. It looks only at what anyone can download, and each store release is reviewed separately. Findings go by email only to the verified publisher of the app. It is not a penetration test, a certification or a compliance attestation.

• What do you need from us for the App Exposure Check?

  The store link for your app, some context about your industry and build stack, and contact details for someone authorised to act for the publisher. We confirm that you act for the publisher listed in the store, from your business email domain or by a manual check, before any findings are sent. We never ask for binaries, source code, signing keys, credentials or production data, and nothing needs to be uploaded.

• How do we start working with Otukan?

  Use the contact form for your product area or write to info@otukan.co. For app protection, tell us the platform, the framework and your main requirement. For devices, tell us whether you are an OEM or an institution and which models are involved. For device management, tell us your fleet ownership model and OS mix. Technical demos are arranged through the same forms.