App & Data Security
The mobile app provides enhanced "data in transit" security not available when viewing the host system through a mobile browser.
- Device detection security prevents users from logging in from rooted or otherwise compromised devices.
- Any content served from non-trusted domains must be served over HTTPS to be rendered on the mobile app.
- For custom tiles, only secure (HTTPS) content will display on the mobile app. For any "http" content outside of a trusted domain, the custom tile will be empty (blank) when it appears on the mobile app.
Stored Data
Passwords are not stored on the device. The app encrypts data-at-rest using industry standard encryption algorithms, 256-bit AES. Encrypted data is stored in the application area on the device. This data is deleted when the app cache is cleared or the app is deleted from the device.
The mobile app stores the following types of data.
Tenant data:
- The tenant ID
- OAuth information
User data:
- Configuration
- Authentication tokens
- Offline transaction when applicable (offline punch data)