A mobile security team should evaluate an Otukan partner the same way it evaluates Otukan: by what gets protected, who is responsible for each part of the work and what evidence the project produces. Otukan works with technology partners, channel and integration partners, and device-maker partners. The product and its controls do not change with the route you buy through. What changes is who configures protection, who ships the release and who acts on the signals. This page shows where a partner sits in your mobile estate, how responsibility divides and what to check before you sign.
Where a partner sits in your mobile flow
A partner becomes part of your trust boundary the moment it touches your delivery chain. Three places matter.
- The build. An integration partner may configure your protection profile and run it inside your pipeline. The protected app still carries your signature, and the release decision stays with your team.
- The device. A device maker embeds Otukan Device Security in firmware it builds and signs, engineered for each device model and chipset. Your institution receives devices protected below the operating system.
- The operation. A service partner that monitors runtime threat signals or runs your managed fleet day to day sees only what you grant. You decide which signals it receives and where management data lives.
Map each partner role against these three points before the project starts. A clear map is what keeps a partner from turning into an unmanaged dependency.
How responsibilities divide
Protection on a mobile estate always splits across the app, the operating system and your backend. A partner-delivered project adds one more party, so the split needs to be explicit.
| Layer | Otukan | Partner | Your team |
|---|---|---|---|
| App | Builds the controls: obfuscation, anti-tampering, runtime self-protection, attestation | Configures the protection profile for your flows | Signs, releases and owns the app |
| Operating system | Engineers each control for Android and iOS separately | Advises on device and OS mix | Sets the device policy you accept |
| Backend | Delivers signals your server can act on | May connect signals to your monitoring | Decides the response and owns the data |
| Firmware | Engineers Device Security per model and chipset | The OEM or ODM builds and signs the firmware | Specifies the devices you commission |
Otukan engineers work alongside the partner throughout, so questions about how a control behaves reach the people who wrote it.
What to check before you sign
Ask for the same evidence you would ask Otukan for directly, and make sure the partner can produce it.
- Platform scope. Which Otukan controls apply to your Android and iOS apps, Flutter or React Native code, or device models. Otukan confirms this scope whoever delivers the project.
- Release evidence. How you can verify that each shipped build carries the protection profile you agreed.
- User impact. How the partner tests protected builds on your real device mix before release, and who decides when a response should warn rather than restrict.
- Custody. Written confirmation that signing keys, release rights and management data stay with you.
If you want to deliver Otukan to your own customers, use the partner contact form. For the products themselves, see mobile app security, mobile device security and mobile device management.