Questions
The questions engineers actually ask.
Do we have to change our code?
No. There is no SDK to integrate and no source changes. You upload the package you already build, pick a profile, and get back a hardened artifact with the layers compiled in.
Which platforms do you support?
The protection product targets Android, across four ABIs. Our software team builds for both Android and iOS, but the runtime protection engine is Android.
What does the telemetry collect?
Detection events: what was detected, when, and what kind of environment it happened in. Events are signed and append-only so the record holds up after the fact. No raw personal data is stored.
Who holds our signing keys?
Keystores are envelope-encrypted per tenant and never leave the vault. Outputs come back signed and verified.
Do you test other people's applications?
Only with written authorization from whoever owns the system, and only within an agreed scope. Our own validation work is restricted to applications we own, infrastructure we own, and lab devices we are authorized to use. No third-party targets, ever, on any engagement.
Why does a security company also build websites?
Because we are a software company first, and the protection is something we build rather than something we resell. The client work is real revenue and we would rather say so than pretend otherwise.