Control what apps can learn, sense and send.

Unauthorized app collection and foreign data transfer

MeitY described unauthorized collection and transmission of mobile data to servers outside India as a national-security concern.

Vault applies default-deny app policy, masks or withholds device markers, dead-ends tested tracker DNS and admits application egress only through its controlled VPN boundary.

Stock mobile platforms and MDM offer permissions, vetting and VPN. GrapheneOS adds a network permission. Vault adds measured marker substitution and foreground-only tunnel admission under one operator policy.

E02–E05 · IMEI null; Wi-Fi identity masked; raw bypass and physical-underlay binding blocked; active flows observed through tun0.

A smartphone-security solution across service devices

iDEX DISC 9 called for protection of service-personnel data and detection of malicious calls and IPs across smart devices.

Vault combines COTS-oriented image integration, sovereign signing, policy-controlled applications, protected networking, local evidence collection and controlled signed updates.

BharOS also validates an indigenous COTS and private-app-store model. Knox is Samsung-specific; GrapheneOS officially supports a narrow device family. Vault is designed as an adaptation layer for supplied device trees.

E01, E07, E08 · Working Nothing Phone (1); release-signed immutable system; no GMS packages; 23/23 launcher apps completed the pass.

Protected data in transit over untrusted networks

NSA CSfC mobile guidance describes independently layered commercial components and nested tunnels for protected mobile access.

Vault governs downstream application UIDs and exposes tun0 to apps; the operator selects the encrypted WireGuard upstream. Lockdown remains enabled and physical-underlay selection is denied.

Enterprise always-on VPN protects transit but does not normally combine identity, sensor and key mediation. CSfC is an evaluated reference architecture; BharatDroid does not claim CSfC certification.

E02, E03, E07 · VPN exit visible to probes; raw TCP/UDP and physical-network binding failed; lock retained tun0 without usable underlay.

Honey-trapping and deceptive social applications

India's Ministry of Defence has recorded honey-trapping cases and issued advisories to service personnel.

A newly installed app remains an ordinary UID. It receives masked or null identifiers, controlled foreground egress and no useful background sensor feed; screen lock cuts the tested underlays.

Training, advisories, allowlists and MDM can prevent or remove risky apps. Vault adds containment even when a permitted or deceptive app is already present.

E02–E06 · Temporary Dialer/SMS role elevation did not reveal telephony identifiers; foreground grants were revoked on close; sensors delivered no data.

Location and pattern-of-life exposure

The U.S. Army reported that Strava heat maps could reveal bases and support targeting of individuals.

Location returned null; motion and all enumerated sensor classes delivered zero samples; Wi-Fi scans returned no results; SSID, BSSID and MAC were withheld or masked.

Standard permission prompts depend on user choice. GrapheneOS adds sensor and network toggles. Vault's tested policy makes no useful sensor delivery the default for ordinary probes and ties radio cut-off to lock state.

E04–E06 · 38 sensor classes enumerated, zero registered or delivering; location null; role app still saw masked Wi-Fi identity.

Targeted spyware and exploit-driven collection

Apple Lockdown Mode illustrates the need to reduce functionality for users exposed to sophisticated mercenary spyware.

Vault reduces post-compromise value by starving app-facing sensors, separating keys, denying physical-network selection and enforcing a Google-free, signed system boundary.

Apple Lockdown Mode and GrapheneOS provide substantial exploit-surface reduction. Vault does not claim exploit immunity; its distinct focus is sovereign policy mediation across identity, network, sensors and keys.

E01, E04–E07 · No useful sensor or media output; non-exportable key; cross-UID decrypt rejected; direct network bypass blocked.

Locked handset background activity

Conventional mobile platforms preserve connectivity for notifications and services, leaving privacy policy dependent on application behavior.

Lock transition disables tested Wi-Fi, Bluetooth and mobile-data settings while VPN lockdown remains active. Without an underlay, scheduled WireGuard retries fail locally rather than bypassing Vault.

Airplane mode is manual and coarse; MDM can enforce settings. Vault makes the screen-lock transition part of the OS privacy policy and measures the result on the prototype.

E02, E09 · Wi-Fi off by the sampled 648 ms point; Bluetooth/mobile data off; zero measured Wi-Fi or mobile IP-byte increase across 8h01m.

Key reuse, extraction and cross-app privilege

Government product assurance requires inspectable security claims and later independent evaluation under schemes such as STQC IC3S/Common Criteria.

Vault exposes a mediated keystore path, produces non-exportable keys and rejects cross-UID decryption. Hardware-attestation requests from the ordinary probe were refused.

Knox Vault offers mature dedicated hardware-backed assurance. Vault's differentiator is operator-owned brokering policy across adapted COTS builds; hardware assurance still depends on the selected device and certification.

E01, E04 · Standard Keystore2 hidden from ordinary app; Vault service visible; encoded key null; cross-UID decrypt rejected; Verified Boot and enforcement active.