Evaluate supported environments by setting your real user base against how each protection control behaves there, one control and one operating system at a time. Otukan states support that way for Android and iOS apps built natively or with Flutter or React Native, and agrees the environment scope with you before any response goes live. An environment covers more than an OS version: it includes the device class, whether Google services are present, how the device is managed and how the app was installed. This page explains how to define that scope, who is responsible for what in it, and how to test it. Version numbers are confirmed per app.
The flows and boundaries that depend on environment
A protected app draws a trust boundary between what runs on the device and what your backend decides. Environment decides how much the device side can tell you.
Sign-in and account recovery depend on knowing whether the app is genuine and the device is in a normal state. Payments and transfers depend on the same, plus whether another app can read or draw over the screen. Content and licence checks depend on whether the app came from the channel you expect. Each of those flows crosses the boundary with a signal, and the quality of that signal varies by environment:
- Current consumer phones. The richest signals: runtime checks plus the operating system’s own attestation service.
- Older OS versions still in use. Runtime checks apply; some newer OS protections are absent, which is itself worth reporting.
- Android devices without Google services. Play Integrity is unavailable; checks inside the app carry the load.
- Managed and dedicated devices. Enterprise policies change what “normal” looks like and must not read as tampering.
- Alternative distribution. Enterprise, test or third-party channels change which signing certificate is expected.
Who is responsible in each environment
Protection works when the app, the operating system and your backend each do the part they are good at.
| Responsibility | App (with Otukan) | OS and platform services | Your backend |
|---|---|---|---|
| Runtime state | Checks for hooking, debugging, emulation, root or jailbreak | Sandboxing, code signing enforcement | Receives the finding with the request |
| App genuineness | Integrity checks against the expected certificate | Install-time signature verification | Decides whether a request is trusted |
| Device attestation | Requests the platform’s attestation where available | Play Integrity on Android, App Attest on iOS | Verifies the attestation result on the server |
| Missing capability | Reports that a service is unavailable | Declares what the device supports | Treats absence as a signal, not a failure |
| Response | Applies the response set for the flow | Not involved | Adjusts policy without a new release where designed |
Android and iOS stay separate in every row. Root detection and jailbreak detection look for different evidence. Play Integrity requires Google Play services on the device, while App Attest is an iOS service that is not available on the iOS Simulator and is checked for support on each device before use. Otukan writes each control’s behaviour for each platform rather than assuming one from the other.
Evaluating an environment scope
Define the matrix
List the OS versions, device classes, managed configurations, frameworks and distribution channels your users actually have, from your own analytics. Otukan’s engineers then state, per control and per OS, how each one behaves in each cell, including the cells where a platform service is missing.
Collect evidence per cell
For each environment you support, keep a protected-build test result: install and update, sign-in, the sensitive flow and the signal your backend received. Record the OS version, device model, app version and protection profile version beside it.
Check user impact
A supported environment is one where legitimate users are not blocked. Test normal configurations that look unusual: developer options enabled, accessibility services in use, work profiles, supervised devices and older hardware. Keep new controls in observe mode until those tests pass, then choose the response per flow.
Revisit the scope
An environment scope ages. Each major OS release, a new device class in your analytics or a new distribution channel is a reason to add rows to the matrix and run the edge tests again. Otukan tests its protection against new platform releases and brings the results to your team, so the scope stays a living document rather than a one-off approval.
For performance and compatibility testing on protected builds, see mobile app protection performance. Platform notes are on Android app security and iOS app security. For the full product scope, return to mobile app security.