Data Loss Prevention (DLP)

How it works

Mobile DLP works at the boundary between managed and unmanaged. Both Apple and Google give the MDM a way to draw that line. On iOS, the "managed open-in" restriction stops documents from a managed app being opened in an unmanaged one, and the managed pasteboard (since iOS 15) blocks paste in the other direction. On Android, the work profile is a separate container: the admin decides whether clipboard, sharing and file access can cross into the personal side.

On top of those OS controls, app-level policies add finer rules. Microsoft Intune app protection policies and their equivalents can require a PIN to open an app, block "Save as" to local storage, disable screenshots and encrypt app data at rest with a key separate from the device's.

None of this inspects the content of the data. Classic DLP on email gateways scans for credit card numbers or keywords. Mobile DLP is mostly about containers and channels: which app can talk to which, and through what path.

Why it matters for a fleet

Most mobile data leaks aren't attacks. They're a salesperson forwarding a customer list to their personal Gmail to work from the train, or a screenshot of a pricing table posted in a WhatsApp group. Verizon's 2024 Data Breach Investigations Report attributes 68% of breaches to a non-malicious human element. DLP is the control that makes the easy mistake impossible rather than merely forbidden.

It also shapes what you can say to a regulator. GDPR article 32 asks for technical measures appropriate to the risk. "Work data can't be copied out of managed apps" is a measure you can demonstrate. "We told people not to" isn't.

The trade-off is friction. Block the clipboard entirely and users will photograph their screen with a second phone. Most teams allow paste into managed apps, block paste out, and permit screenshots except in a short list of apps.

How Appaloosa handles it

Appaloosa applies DLP restrictions through the same profiles that configure the device. On iOS and iPadOS you can enforce managed open-in, the managed pasteboard, and restrictions on AirDrop, iCloud backup of managed app data and screen recording. On Android work profiles, you control cross-profile clipboard, sharing and file access, and can disable screenshots inside the work container.

Because apps are distributed through Appaloosa's enterprise app store, every app you push is already a managed app, so the boundary is drawn at deployment time rather than patched afterwards. The restrictions live alongside the rest of your mobile device management settings and apply per device group, so a shop-floor tablet and a sales phone get rules that match how they're used.