Data on the device

Required

• Keep tokens and keys in the Keychain or Keystore

  MOB-19

  Store session tokens, refresh tokens and keys only in the iOS Keychain or behind a key in the Android Keystore. Never in plain preferences, files or JavaScript storage.

• Ship no secrets in the app package

  MOB-20

  The app package holds no secret keys, passwords or private certificates. Anything the app needs that must stay secret lives behind your own server.

Recommended

• Check that requests come from your app

  MOB-21

  Send an attestation token from App Attest or Play Integrity with calls that cost money or unlock content. The server refuses calls without a valid token.

• Keep secrets out of device backups

  MOB-22

  Exclude tokens, keys and caches of personal data from cloud backups and device transfers. Keep what the person made, so a new phone restores it.

• Keep personal data out of device logs

  MOB-23

  Release builds write no tokens, passwords or personal data to the system log or to log files. Debug logging is compiled out of release builds.

• Encrypt local data that holds personal data

  MOB-24

  Keep personal data only in the app's private storage, with the platform's file protection on. Encrypt databases of health, money or messages with a key from the Keystore or Keychain.

• Wipe local data at sign-out

  MOB-25

  Signing out removes the person's tokens, local database, caches and files from the phone. The next person to sign in sees none of it.

• Queue offline changes and resolve conflicts on the server

  MOB-26

  Save changes made offline in a local queue and send them in order when the network returns. Each change carries an idempotency key and the version it was based on.