Device security
Clear rules for every company device, automatic checks against them, and a record of what was done about each gap.
At a glance
What it is
Compliance rules for Android, Apple and Windows devices: passcodes, encryption, OS updates, app lists, remote lock and wipe, audit logs and reports.
How to start
Tell us what you need in your own words. You talk to the developers who would build it and get a written, line-item estimate.
Get a project estimateSetting a passcode rule once does not make a fleet secure. Devices fall behind on updates, users switch off protections where they can, and new apps appear. A compliance system checks every device regularly, compares it with the rules for its role and follows a graded response: tell the user, give them time, restrict access, and only then lock or wipe.
The response has to match the device. On a company-owned phone, a full reset can be fair. On a personal phone enrolled for work, only the work profile or the work data can be removed, and the company should never see or touch the rest. We build that distinction into the rules, the console and the notices employees read.
What is included
Platform: Admin dashboard
Platform: Admin dashboard
Platform: Admin dashboard
Platform: Work app or notification
How it works
The same loop runs every day for every device; the last step depends on who owns it.
Passcode, encryption, OS version, patch age and app rules are agreed for each group of devices.
Android, Apple and Windows devices report settings, versions and apps through their management channel.
Each report is compared with the rules, and any gap is recorded with the rule it breaks.
The user gets a plain message and a grace period, such as three days to install an update.
If the gap remains, email and business apps pause on that device until it is fixed.
For serious or lasting gaps, company devices can be locked or reset; personal devices lose only the work profile or work data.
Every check, message and action is stored for audits and monthly reviews.
Then it starts again at step 1: Rules set per role
Comparison
Capabilities depend on the platform and on who owns the device. We never offer an action the platform does not support.
| Company Android (fully managed or dedicated) | Personal Android (work profile) | Supervised iPhone or iPad | Personal iPhone (User Enrollment) | Company-owned Mac | Windows PC | |
|---|---|---|---|---|---|---|
| Remote lock | Yes; it only protects the device if a screen lock is set | The work profile if it has its own lock, otherwise the screen; nothing is deleted | Yes, plus Lost Mode with a message | Yes, the screen only | Yes, with a six-digit PIN | Usually not offered for Windows PCs; access is blocked through sign-in instead |
| Remote wipe | Full factory reset | Work profile and its data only | Full erase; Return to Service (iOS and iPadOS 17 or later) re-enrols it | Work data only, by ending management | Full erase | Full reset through the MDM or your UEM |
| Location | Where the management mode and app allow it, for a stated purpose and with notice to staff | Not collected by the company | Through MDM only in Lost Mode, and the user is told afterwards | Not available to the company | Not through the MDM protocol | Depends on the UEM and on location settings |
| Minimum OS version | Checked; available system updates install in a set window (Android 8.0 or later) | Required for work access | Enforced by deadline through declarative management (iOS and iPadOS 17 or later) | Required for work access | Enforced by deadline through declarative management (macOS 14 or later) | Enforced through update policies |
Privacy & security
The console stores only what the rules need: settings, versions and company app lists, never personal content.
On work profiles and User Enrollment, the company cannot see personal apps, messages, photos or location, and the console does not try.
Where company devices use location, it is for a lawful, stated purpose such as recovering a lost device, with notice to staff, in line with the Digital Personal Data Protection Act, 2023. No covert tracking.
Wipes and resets can require a second approver, and every admin action is logged.
Platforms
Company and personal Android devices, iPhone and iPad, Mac and Windows PCs, all reported in one console.
Android phones, tablets and rugged handhelds with Google Play services, managed through Android Enterprise: company-owned devices as fully managed, dedicated (kiosk) or work-profile devices, and personal phones through a work profile only.
Organisation-owned or shared iPhone and iPad devices enrolled in MDM through Apple Business or Apple School Manager, supervised for Single App Mode and stricter restrictions.
Mac computers enrolled in MDM for configuration profiles, app and package installs, disk encryption settings and software update rules, set up at first power-on when the purchase is linked to Apple Business.
Windows laptops and desktops managed through the MDM support built into Windows or an existing UEM, when PCs need to sit in the same console and reports as phones and tablets.
Back-office panels for operations, support and finance teams: orders, users, content, reports and permissions.
Technology
Each rule is applied through the platform's own management API; our backend evaluates reports, runs the graded response and keeps the audit trail.
Device management
A Google cloud API for device-management products: your console sets the rules, and a Google app on each Android device applies them.
Used for
Device management
Built-in Android APIs that let one trusted app control a company device: kiosk lock, silent app updates and restrictions, even without Google Play.
Used for
Device management
The management channel built into iPhone, iPad and Mac: an MDM server sends settings, apps and commands, and devices apply them remotely.
Used for
Backend
Runs the server side of apps: fast, scalable back ends that power your app, website and integrations.
Used for
Backend
A structured way to build back ends on Node.js, so large business systems stay organised, testable and easy to hand over.
Used for
Data
A reliable database for the records your business runs on: orders, payments, bookings and stock, kept accurate and easy to report on.
Used for
Data
Keeps frequently used data in fast memory, so apps stay quick on busy days and live features like order tracking feel instant.
Used for
Web
Builds interactive screens in the browser, such as dashboards, admin panels and portals, that respond instantly as your team works.
Used for
Cloud & DevOps
Cloud hosting for your app, website and data, with data centres in India and room to grow when traffic rises.
Used for
Cloud & DevOps
Packages your software so it runs the same way on every laptop and server, which makes releases predictable and moving hosts easier.
Used for
Plain-English glossary
Product preview
Illustrative screens; devices, people and figures are samples.
Sample screens: names, prices and figures are examples, not client data.
Work
Device management & kiosk solutions
An illustrative kiosk product for retail chains: locked Android tablets for catalogues and price checks, a staff launcher, and a console to enrol, update and monitor every device.
Runs on
Built with
Device management & kiosk solutions
An illustrative console for school tablets: iPad devices through Apple School Manager and MDM, Android™ tablets through Android Enterprise, with class-based rules teachers can follow.
Runs on
Built with
Cost drivers
Each platform, and each of company-owned and personal, needs its own rule mapping, test devices and notices.
Simple pass-or-fail rules are quick; graded responses with grace periods, exceptions and approvals take more design.
Pausing access through your identity provider depends on its conditional-access features and APIs.
Reading compliance from an existing EMM or UEM is a smaller job than evaluating it ourselves from device reports.
Custom reports, retention periods and exports for auditors add backend and storage work.
Estimates are written from your scope, with the effort and assumptions behind each line item.
How pricing worksProcess
With your security and HR teams, we list device risks, decide rules per role and agree what happens at each stage.
You getRule book per role
Each rule is mapped to Android, Apple and Windows controls, and the gaps are written down.
You getPlatform matrix
Rules run in report-only mode for two weeks, so nobody is blocked by a rule that is set wrongly.
You getDry-run report
Notices first, then access restrictions, then locks and resets, one group at a time.
You getRollout plan
Monthly reviews of exceptions and trends keep the rules realistic as platforms and threats change.
You getMonthly compliance review
Solutions
One console for company Android, iPhone, iPad, Mac and Windows devices: enrolment, apps, access and offboarding, on platform APIs or your existing UEM.
MDM for company iPhone, iPad and Mac devices: automatic enrolment, supervision, apps, OS updates and remote lock, as a custom build or an integration.
Android MDM consoles, backends and device agents built on the Android Management API or a custom device-owner app, for EMM products and specialised fleets.
Company-owned Android phones and tablets set up as fully managed devices, with custom device-owner apps where standard EMM agents fall short.
Services
The disciplines a project like this draws on.
Software shaped around how your business runs, from approvals and inventory to billing and reports, replacing spreadsheets and disconnected tools.
Back-office dashboards built around your team's daily tasks: order queues, approvals, catalogue management, payouts, reports and audit logs.
Secure, documented REST and GraphQL APIs, plus integrations that connect your apps to payment, logistics, GST, messaging and business systems.
Multi-tenant SaaS products with subscription billing, team roles, onboarding and usage analytics, from first MVP to paying customers.
Industries
Industries where this kind of product fits well.
FAQ
It depends on the rule and the device. Most gaps start with a message to the user explaining what to fix, with a grace period. If the gap remains, access to email and business apps is paused through your identity provider. Only serious or lasting gaps lead to a lock, and a reset only on company-owned devices, usually with a second approver. Each step is logged, so there is always a record of what was done and why.
Only the work part. On a personal Android phone with a work profile, the company can remove the work profile, which deletes work apps and data. On a personal iPhone enrolled through User Enrollment, ending management removes work apps, accounts and data. Photos, messages and personal apps stay untouched, and the company cannot erase the whole phone. For roles that handle sensitive data, company-owned devices are the safer choice.
Each platform reports its OS version, and Android also reports its security patch date. The rules set a minimum version or a maximum patch age, and devices that fall behind get a grace period. Updates can also be pushed: Android system updates in a maintenance window on company-owned devices, Apple updates by deadline through declarative device management, and Windows updates through your update policies. Devices that no longer get updates from their maker show up in reports as due for replacement.
On Android, apps can ask Google's Play Integrity API whether the device and app pass integrity checks, and on company-owned devices managed policies can block risky settings such as developer options. On iPhone and iPad, the MDM protocol does not report a jailbreak flag; tools that show one rely on checks inside an app, which can be evaded. We treat these signals as one input among several, not as proof, and combine them with OS version, supervision and app rules.
No covert tracking, ever. Location is used only where the management mode supports it, for a lawful, stated purpose such as recovering a lost company device or dispatching field staff, and with notice to the people affected, in line with the Digital Personal Data Protection Act, 2023. Personal devices enrolled for work are never located. Through MDM, supervised iPhone and iPad devices share location only in Lost Mode, and the user is told afterwards.
Typically: a device inventory with owners, the rules in force and when they changed, compliance status over time, exceptions with their approvals, and a log of admin actions such as locks and resets. We build these as scheduled reports and exports, with retention periods you set. If you follow a standard such as ISO/IEC 27001, we map the reports to the controls your auditor checks; certification itself stays between you and your auditor.
Related
Next step
Tell us which devices you run, who owns them and what worries you most. We will propose the rules, the graded response and a line-item estimate.
