Otukan protects your released Android, iOS, Flutter and React Native apps without turning protection into a separate project for every release. It hardens your code, watches the running app for hooking, debugging, emulators and modified operating systems, confirms that the installed copy is the one you shipped, and gives your backend evidence that a request comes from your genuine app. Protection fits the build and release pipeline you already run, your signing keys stay with your team, and you decide how the app responds to each threat, one user flow at a time. Android and iOS each get controls built for that platform.
Protection scope
A released app can be attacked in five places: its code, its running process, its data, its network traffic and its API. Otukan puts a dedicated control on each, so a gap in one layer is covered by another.
| Layer | What attackers try | How Otukan protects it |
|---|---|---|
| Code | Decompile the app, lift logic, extract keys and endpoints | Code obfuscation and anti-tampering |
| Runtime | Hook functions, attach debuggers, run on emulators or modified operating systems | Mobile RASP, root detection, jailbreak detection |
| Data | Read sensitive data from storage, memory or logs | Secure storage with the platform keystore, memory handling, log hygiene |
| Network | Intercept or alter traffic between app and backend | Transport hardening and a certificate strategy your team can operate |
| API | Imitate the app with scripts, bots and replayed requests | App attestation and mobile API protection |
The layers work as one system. Obfuscation makes runtime checks hard to find and remove. Integrity checks notice when someone strips protection out and re-signs the app. Runtime checks catch attacks on the running process that static protection cannot see. Attestation carries the result to your server, where a modified client cannot argue with it. On top of the layers, fraud and malware signals and threat monitoring show your risk and security teams what is happening to your app in the field.
Android and iOS expose different signals and enforce different rules. Otukan uses controls designed for each platform and scopes every control per OS version with your team, so you know exactly what each release is protected against.
On the network layer, Otukan treats certificate pinning as a decision rather than a reflex. Android’s own guidance cautions against routine pinning, because a certificate change can cut off installed copies of the app. Where pinning is right for you, we plan certificate rotation and outage recovery with you before the release ships.
For combined static and runtime protection, see mobile app shielding.
Delivery model
Protection that slows releases gets switched off. Otukan is built to become a quiet, repeatable step in the way you already ship.
Build inputs
Otukan works with the artefacts you already produce: native Android and iOS builds, and apps built with Flutter and React Native. In cross-platform apps the logic lives in framework code, so Otukan protects that code as well as the native shell. We agree the scope for every artefact you ship, including native libraries and third-party SDKs. Platform specifics are on Android app security and iOS app security.
Signing responsibilities
Your signing keys stay with your team, and Otukan does not ask for them. Before the first protected release we agree, per platform, which certificate each channel delivers. This matters because store-managed signing, such as Play App Signing on Android, changes the certificate the installed app carries, and integrity checks must expect exactly what your users receive. On iOS, App Store builds are re-signed by Apple for distribution, and the checks are set up for that too.
Lifecycle
Protection settings change less often than code, so most releases reuse the same configuration. When an operating system update changes what a runtime check can see, Otukan updates its checks and you carry the change forward in your next release. Your response policy is yours to tune as threat signals come in. For pipeline detail, see mobile DevSecOps and integration.
By industry and app environment
Each industry page covers the fraud patterns and user flows that matter in that sector: banking, fintech and payments, crypto wallets, insurance, ecommerce, healthcare, government services, telecom, superapps, streaming and media, travel and mobility, mobile games and enterprise workforce apps.
Each environment page covers how protection fits that platform or framework: Android, iOS, Swift, Objective-C, Flutter, React Native, Unity, .NET MAUI and Ionic and Cordova. The full list is on supported environments.
How the platform works
Protection runs through your own pipeline: build and release integration, the protection lifecycle with gated handoffs and planned rollback, and release evidence for every protected build. Your team sets responses through security policy management and works with the signals through threat operations. Third-party code is covered by mobile SDK protection, and what Otukan collects is set out on data privacy.
Proof on your own app
You should see protection working on your own app before you commit. Otukan plans the evaluation with your team, on your devices and your user journeys, with pass criteria agreed up front. How to compare protection options on threats, integration, performance and lifecycle is covered on mobile app security evaluation.
- Compatibility. The protected build installs, updates and runs on the devices, OS versions and frameworks your users have, and your crash reporting stays readable.
- Performance. Start-up time, app size and your key journeys are measured with and without protection on the same devices, with the method and date recorded.
- Response policy. Each check is triggered in an authorised lab to confirm the response you chose, then the same journeys run on legitimate devices to confirm nothing fires for real users.
The result is evidence your security, mobile and risk teams can all sign off on. The mobile app security evaluation checklist lists the questions to cover. To turn published industry findings into a test of your own app, see the mobile security index analysis. Performance and compatibility are covered on app protection performance.
If your app is already published, start with a free App Exposure Check: a passive review of the public store release, with findings sent by email to the verified publisher.