Otukan’s application security controls process security signals: facts about the app and the environment it runs in, such as which check fired, which response was applied, the app and protection profile versions, the platform, OS version and device model, and the time. They do not process the content of user messages, photos, contacts or files. Signals are created at the points where checks run and travel with your app’s own requests to your backend, so they are stored, accessed and deleted under your rules. Android and iOS signal fields are defined separately, for native, Flutter and React Native apps.
Data inventory
Signal fields
Each signal answers one question: what did a check see, and what did the app do about it? The fields below make up a typical signal. Optional fields are chosen per platform when your protection profile is set up.
| Field | Purpose | Required or optional |
|---|---|---|
| Check and finding | Which control fired and what it observed, for example hooking or a modified app | Required |
| Response applied | Observe, warn, restrict or terminate, as set for the flow | Required |
| App version and protection profile version | Ties the finding to a specific release and configuration | Required |
| Platform and OS version | Android or iOS, and the OS release the device runs | Required |
| Device model | Separates device-specific behaviour from real attacks | Optional |
| Timestamp | Orders findings within a session | Required |
| Your session or request reference | Lets your backend join the signal to the request it accompanies | Optional, supplied by your app |
What stays out
Signals do not carry message content, photos, contacts, files, keystrokes or the data your users enter in forms. A check that looks for screen recording reports that recording is active, not what was on screen.
Collection points
Signals are created where checks run: at launch, at sign-in and before the sensitive actions you mark, such as a payment or a change of account details. A flow with no checks produces no signals.
Processing control
Transfer
Signals travel inside your app’s existing encrypted connections to your own servers, alongside the request they describe. Your backend reads them at the moment it makes a risk decision, which is also where they are most useful. Where you add Otukan threat monitoring, that route is agreed with you and drawn into the data-flow diagram your privacy team signs off, so no signal travels anywhere undocumented.
Storage
Once received, signals sit in whichever system you route them to: your API layer, your fraud engine or your security monitoring platform. Where you also use threat monitoring from Otukan, the storage location, access roles and retention for that processing are written into your agreement and reviewed with your privacy team first.
Store privacy declarations
Both stores ask you to declare what your app collects: the Data safety section on Google Play and the privacy details on the App Store. Otukan’s engineers give your team the field list for each platform, with the purpose of each field, so those declarations describe the security signals accurately.
Access
Access follows the roles you already use for request data. We suggest giving fraud and security analysts read access to signal records, with engineering access limited to aggregated views where possible. Otukan does not need access to your production systems or user records to deliver protection.
Lifecycle
Retention
Retention follows your own policy for the systems that hold signals. A practical pattern is to keep detailed records only as long as investigations and policy tuning need them, and to keep aggregated counts longer to track trends across releases.
Deletion
Because signals carry your own session references, not a separate Otukan user identity, the records linked to a user can be found and deleted with your existing tooling, including when a user asks.
Changes over time
The fields a signal carries are defined in the versioned protection profile. When a field is added or removed, the profile version changes, and your privacy reviewer can see exactly what changed in which release.
For how Otukan handles enquiries and product data more broadly, see Otukan security and trust. Regulated teams should also read healthcare mobile app security. Return to mobile app security for the wider product.