Mobile Protection

Orthalon does not currently ship an Android VPN application or an iOS Network Extension application. There is no qualified APK/AAB, App Store package, or signed enterprise iOS bundle to download.

Configuration profiles and MDM settings cannot inspect traffic by themselves. A protection runtime must be installed, signed, granted the appropriate operating-system permission, and validated against supported applications.

Android source status

The source repository contains a native Kotlin Android foundation with:

• a minimal Compose enrollment and status interface;
• a non-exportable ECDSA P-256 identity in Android Keystore with an attestation challenge;
• authenticated encrypted storage for non-secret enrollment metadata;
• strict Android Enterprise managed-configuration parsing; and
• a VpnService declaration, foreground notification, TUN configuration contract, and protection requirement for future upstream tunnel sockets.

This source does not provide a working VPN. Enrollment and always-on support are disabled, and the runtime refuses to establish a TUN because there is no production packet-forwarding edge. That refusal avoids silently removing connectivity. A build attempt has not completed successfully in the current qualification environment, so there is no verified APK, lint result, or Android test result.

Android release requirements

A production Android agent must complete the platform contracts for VpnService and managed configurations, including:

• implement VpnService and the required foreground-service behavior;
• obtain user consent or an approved device-owner deployment;
• consume Android Enterprise managed configuration and react to changes;
• support always-on and lockdown behavior where required;
• pass captive-portal, Wi-Fi/cellular transition, battery, DNS, IPv6, application update, upgrade, rollback, and uninstall tests;
• be signed and distributed through an approved enterprise channel.

An Android VPN observes encrypted HTTPS packets. It can enforce destination policy only after a forwarding plane exists; it cannot inspect prompts or files inside another application's encrypted traffic without a separate supported application-layer control. Orthalon does not claim TLS decryption or mobile prompt/file DLP.

iOS and iPadOS release requirements

A production Apple mobile agent must follow Apple's Network Extension and provider deployment requirements, including:

• include the appropriate Network Extension target and entitlement;
• use an Apple-issued signing and provisioning profile;
• define supervised-device or per-app deployment behavior;
• pass App Store or enterprise distribution review as applicable;
• pass network transition, battery, captive portal, application update, MDM removal, upgrade, rollback, and uninstall tests.

Until those applications and their release evidence exist, use the browser extension for supported web AI applications and the AI gateway for organization-managed applications that can use a custom model API endpoint.