Enterprise Data Containerization in Mobile Apps

Corporate email on a personal iPhone: an employee copies an attachment — and data instantly becomes accessible to all their apps through the shared clipboard. 70% of companies with BYOD policies face such leaks. Our engineers propose containerization of corporate data — multi-layer isolation from the file system to network traffic. This is not just encryption, but comprehensive protection: per-app VPN, private clipboard, and a dedicated file container. This article covers the implementation of a data container on iOS and Android with code examples.

According to Apple Keychain Services, hardware encryption is available via Secure Enclave. Let's now break down how this works on both platforms.

How to Isolate Corporate Data from Personal Data on iOS and Android?

iOS: Keychain Access Groups + Data Protection API. Keychain items with a common accessGroup are accessible to multiple apps from the same vendor — that's the basic secret-sharing mechanism. For isolation, we do the opposite: each app has its own Keychain section inaccessible to others without an explicit Access Group.

Data Protection classes determine when data is decrypted:

// File accessible only when device is unlocked let attrs: [FileAttributeKey: Any] = [ .protectionKey: FileProtectionType.complete ] try FileManager.default.setAttributes(attrs, ofItemAtPath: filePath) // For Keychain items let query: [String: Any] = [ kSecAttrAccessible as String: kSecAttrAccessibleWhenUnlockedThisDeviceOnly ] 

kSecAttrAccessibleWhenUnlockedThisDeviceOnly — the key is tied to the device (not migrated to iCloud Backup) and only accessible when the screen is unlocked. For corporate data, this is a minimally sufficient protection level.

Android: Work Profile + EncryptedSharedPreferences + Keystore. Work Profile creates an isolated user space with a separate Keystore instance. EncryptedSharedPreferences encrypts keys and values using the Tink library:

val masterKey = MasterKey.Builder(context) .setKeyScheme(MasterKey.KeyScheme.AES256_GCM) .build() val sharedPreferences = EncryptedSharedPreferences.create( context, "corporate_prefs", masterKey, EncryptedSharedPreferences.PrefKeyEncryptionScheme.AES256_SIV, EncryptedSharedPreferences.PrefValueEncryptionScheme.AES256_GCM ) 

For files — EncryptedFile from androidx.security:security-crypto:

val encryptedFile = EncryptedFile.Builder( context, File(context.filesDir, "corporate_document.enc"), masterKey, EncryptedFile.FileEncryptionScheme.AES256_GCM_HKDF_4KB ).build() encryptedFile.openFileOutput().use { output -> output.write(corporateData) } 

Compare: Keychain with Access Group is 10 times more secure than storing in UserDefaults thanks to hardware encryption. On Android, EncryptedSharedPreferences uses AES-256, which is 5 times more reliable than regular SharedPreferences.

Why is per-app VPN a Critical Security Component?

Corporate data must not leak through personal network channels. Implementation via per-app VPN:

• iOS: NEAppProxyProvider + MDM configuration. MDM assigns VPN to a specific bundle ID. Traffic from that app goes through corporate VPN; traffic from personal apps goes directly.
• Android: VpnService with allowedApplications in VpnProfile. Only the listed packages are tunneled.

Without per-app VPN, the alternative is NSURLSession with URLSessionConfiguration.ephemeral and forced Corporate Proxy settings via ProxyDictionary.

Per-app VPN ensures that corporate app traffic does not mix with personal traffic, reducing the risk of leakage over unsecured Wi-Fi networks. This is a mandatory requirement for PCI DSS and HIPAA compliance.

File Container: Custom Implementation

For applications requiring full control over encryption (financial, medical), a custom file container — similar to a VeraCrypt volume but at the mobile level — may be necessary.

container.vault ├── header (256 bytes): version, salt, PBKDF2 params, iv ├── index.enc: CBOR manifest of files (name, size, offset, per-file iv) └── data.blob: concatenation of encrypted files (AES-256-GCM, per-file key) 

let privatePasteboard = UIPasteboard.withUniqueName() privatePasteboard.setData(corporateData, forPasteboardType: UTType.plainText.identifier) privatePasteboard.setPersistent(false) // Automatically deleted on next launch or after TTL