Public services protect citizen-facing apps by building the protection into the app, because the state does not control the phones its citizens use. Otukan hardens the official app, binds each citizen’s identity to the app on their own phone, protects sign-in and signing steps, keeps records off captured screens, and tells your services when a request comes from a copy or a script. Responses are proportionate per journey, so information stays available while high-risk actions ask for more assurance. Every control has its own Android and iOS scope. Government-issued devices are a separate programme with its own controls.
Service access on citizen-owned devices
Protecting identity
Citizen identity is the most valuable thing a government app holds. Otukan ties the enrolled identity to the app instance on the citizen’s phone, so a stolen password or intercepted code is not enough to open the account on another device. Sign-in, recovery and the moment a citizen signs or confirms a request are protected against hooking and replay. When enrolment or recovery happens on a new phone, the service sees that and can ask for stronger verification.
Protecting sensitive records
Tax statements, benefit decisions, health letters and identity documents appear on screen and are often cached for offline use. Otukan hides marked screens during recording and mirroring on both platforms, blocks screenshots of them on Android and reports screenshots on iOS, and encrypts what the app keeps on the device with each platform’s own key storage. Platform detail is on Android app data encryption and iOS app data encryption, and capture controls are covered on screen capture protection.
| Journey | What attackers try | What Otukan provides | Service that decides |
|---|---|---|---|
| Enrolment and recovery | Registering a stolen identity on another phone | Device binding state, attestation, runtime integrity | Identity service |
| Viewing records | Capturing or scraping personal data | Screen protection, encrypted storage, hooking detection | Records service |
| Claims and appointments | Scripts and emulators filing or reserving at scale | Attestation results per request | Service API layer |
| Signing and consent | Altering what the citizen confirms | Authentication flow protection, runtime checks | Signing service |
Operational boundaries
Citizen apps and government-managed devices are different programmes. Otukan’s application protection covers the citizen app on any phone and gives your services evidence about each request. It does not administer those phones and never needs to.
Staff and field devices issued by a public body are a separate case. They can be enrolled, configured and locked down, and some programmes need protection that starts below the app, at firmware level. That work belongs to device security and device management, each with its own owner. For issued devices, see government mobile device security and government mobile device management.
Keeping the boundary clear helps procurement too: the citizen app, the staff device fleet and the identity platform are assessed on their own terms.
Evaluation
Accessibility
A protected government app must remain usable by everyone. On Android, screen readers use accessibility services, the same route some malware abuses, so Otukan distinguishes assistive tools from abusive behaviour. On iOS, VoiceOver and other assistive features are system-level, and capture protection is designed not to interfere with them. Every policy is tested with screen readers, magnifiers and switch access before it is enforced, and warnings use plain language with a clear next step.
Procurement evidence
For each control, Otukan supplies its platform scope, the test records behind it, the response policy, the owning team and a description of the signals the app sends. That record supports the public body’s own security assessment. For mapping controls to a common standard, see OWASP MASVS mobile app security.
Continuity
Public services run for years and cannot pause for a security change. Policy can change without a new app release, new signals start in observe mode, and each journey has a defined response when a check cannot complete, so a problem on one device stays with that device instead of taking the service down for everyone. Shielding is covered on mobile app shielding.
For every Otukan app control in one place, return to mobile app security. Public bodies with an app in the stores can ask for a free App Exposure Check of the published build.