A mobile security team should evaluate technology ownership by asking who wrote the code that runs inside its app and devices, who can change it and who answers for it. At Otukan the answer is the same for all three: we design, build and maintain our own protection technology across Application Security, Device Security and Device Management. Ownership covers the protection logic and its maintenance. It does not mean Otukan uses no third-party components, and it never means Otukan owns your app. You keep your code, your release and your signing keys.
Why ownership is a security question
Protection code runs at the most sensitive boundary you have: inside your app process on a device you do not control, or inside firmware below the operating system. Whoever owns that code decides three things that matter to you.
- How fast a control can adapt. Android and iOS change every year, and attack tools change faster. The owner of a detection can update it directly; a vendor that licenses its engine from a supplier waits on that supplier.
- How precisely a question gets answered. When a runtime check flags a user in your payment flow, you need to know why. The team that wrote the check can tell you.
- Who is accountable. Code shipped inside your app is code your auditors will ask about. A single accountable owner makes that conversation short.
How Otukan’s technology divides the work
Owning the technology also means being exact about where Otukan’s responsibility ends and yours or the platform’s begins.
| Layer | What Otukan owns | What stays with you or the platform |
|---|---|---|
| App | The obfuscation, integrity and runtime protection built into your release | Your source code, your app logic and the decision to ship |
| Operating system | Controls engineered separately for Android and for iOS, each on its own terms | The platform’s own security model, which Otukan works with rather than replaces |
| Backend | The signals and attestation results your server receives | Your API, your response rules and your users’ data |
| Firmware | Device Security engineered per device model and chipset | Firmware signing authority, held by the device maker |
Because each layer has one owner, a finding in your review can be traced to the party that can fix it.
How to evaluate a vendor’s ownership
Use these checks with any mobile security vendor, including us.
- Ask who wrote each control. Expect a direct answer for obfuscation, anti-tampering, runtime self-protection and attestation, not a reference to another supplier.
- Ask for a live explanation. An engineer should be able to walk your team through how a detection behaves on Android and on iOS separately, using a demonstration build rather than your own files.
- Ask about change. Find out how a control is updated when a new OS release or attack tool appears, and who decides.
- Ask about components. Request the component inventory relevant to your product. Honest ownership includes being clear about what is not your own.
- Check the user impact. Test the protected build on your real device mix and confirm the response you set for each flow is the one users experience.
For the product itself, see mobile app security and the supported environments. The company behind the products is introduced on about Otukan.