Overview
Mobile apps present a distinct set of security challenges compared to browser-based Web Apps. A mobile device is personal, portable, and frequently used in unsecured environments. Users access sensitive data on untrusted networks, share devices with family members, and may install apps from untrusted sources that could intercept network traffic or read the device screen.
UnifyApps gives your security and compliance teams controls over the mobile data surface that don't apply to web deployments: Secure View Mode, configured in the builder under Settings → Mobile → Secure View Mode, and biometric login, set up with the Manage Biometrics action.
Note: Mobile Security settings apply to Mobile App types only. Web Apps running in a browser do not have access to device-level security capabilities like Secure View Mode or biometric login. For Web Apps, use the browser-level controls in the app's Settings tab → Security (Content Security Policy and Device Permissions) — see App Settings & Privacy.
Security Hardening Checklist
Tip: Before deploying a Mobile App with sensitive data, check that:
Secure View Mode is on: Settings → Mobile → Secure View Mode → Enable Protection. Test the privacy screen on iOS — Android blocks the capture without showing it.
Biometrics Login is enabled in the app's Privacy Settings, and you've built the enrolment flow with the Manage Biometrics action (Enroll, Revoke, Verify).
The app's access level is Private, with only the identity providers you need switched on.
If you need certificate pinning or root/jailbreak detection, you've contacted UnifyApps support — there are no builder settings for them.
Secure View Mode
Secure View Mode blocks screenshots and screen recordings of your app. When it's on, a privacy screen appears if users try to capture the screen or switch apps, so the app's content doesn't show in the capture or in the app-switcher preview.
Configuration
In the builder, open Settings → Mobile → Secure View Mode.
Turn on Enable Protection.
Optionally, set how the privacy screen looks using the options below.
Setting | Description | Default |
|---|---|---|
Image | The image shown on the privacy screen (SVG, PNG, JPG or WEBP, max. 800x400px). | A "screenshot not allowed" image |
Background Color | The background color of the privacy screen. | White |
Height | The height of your image on the privacy screen, in px. | 124 |
Width | The width of your image on the privacy screen, in px. | 342 |
The privacy screen and its options apply on iOS. On Android, screenshots and screen recordings are blocked without a custom privacy screen.
Secure View Mode applies to every page of the app. It can't be turned on or off for individual pages.
Limitations
Secure View Mode does not prevent an attacker from pointing a second camera at the device screen. It is a deterrent for casual sharing, not a guarantee of secrecy.
On some Android devices and OS versions, the effectiveness of screenshot blocking depends on the system's rendering implementation. Test on your target device fleet.
External screen mirroring (AirPlay, Miracast) is blocked by iOS when Secure View Mode is active. Inform users who may use screen sharing in legitimate contexts such as presentations.
Biometric Login
Biometric login lets users of your mobile app sign in with Face ID, Touch ID, or Android fingerprint or face recognition. Each user turns it on for their own device, through the Manage Biometrics action. Before you can use the action, enable Biometrics Login in the app's Settings tab → Security → Privacy Settings, where it's listed under Identity providers. Until you do, the action is disabled in the action picker. See App Settings & Privacy.
Configuration
Add the Manage Biometrics action to an interaction and choose its Method:
Method | What it does |
|---|---|
Enroll | Asks the user to authenticate with biometrics, then registers the device for biometric login. |
Revoke | Removes the device's biometric keys and turns biometric login off. The user must enroll again to use it. |
Verify | Asks the user for biometrics and signs them in. |
A typical setup: on a settings page, add an "Enable biometric login" toggle that runs Enroll when turned on and Revoke when turned off. On the login page, run Verify from a button.
Things to Know
Manage Biometrics only works inside the mobile app. In a web browser, including a desktop preview, the action fails.
A failed or cancelled biometric prompt, or a device without a sensor, makes the action fail. Handle the failure so users know what happened.
After a user enrolls, signing out keeps their identity on the device so they can sign back in with biometrics.
Certificate Pinning and Root/Jailbreak Detection
Certificate pinning and root/jailbreak detection aren't configured in the builder — there are no settings for them under Settings → Mobile. To find out whether they can be turned on for your app's mobile build, contact UnifyApps support.
Secure Storage
Secure storage ensures that sensitive data cached locally on the device — including authentication tokens, session credentials, and any personally identifiable information stored by offline-capable data sources — is encrypted using the platform's hardware-backed key store.
| Platform | Storage Mechanism |
| iOS | iOS Keychain — hardware-backed encrypted storage with access control policies. Data is inaccessible to other apps and survives app reinstallation but is cleared on device wipe. |
| Android | Android Keystore System — uses the device's hardware security module (when available) or software emulation to encrypt key material. Data is bound to the app's signing key. |
Secure storage is always on for authentication tokens and can't be turned off. Offline cached data is also encrypted, with a key kept in the device keystore. You can't change this per page or per data source — all local storage by the UnifyApps shell uses the secure store.
Note: Secure storage and app backup. By default, keys in the iOS Keychain and Android Keystore are marked as non-exportable and not included in cloud backup snapshots. This means authentication tokens do not carry over to a new device restore from backup — users must re-authenticate on a new or reset device. This is a deliberate security property, not a bug.