K2 Mobile App Security FAQs

K2 uses the current best practices for mobile security. For more information about K2 Mobile App security, see the frequently asked questions in the sections below.

Question Answer
Is my sensitive form data stored / cached on the server or on my device? The data from offline forms is stored in the device’s database.
If app data is stored / cached, is it considered confidential? Yes, data stored on the device is confidential.
How is the data that is stored on the device protected? Are file encryption APIs used?
  • iOS: Yes, data is protected with the Complete protection level (Class A). NSFileProtectionComplete means that the file is encrypted when the device is locked or booting.
  • Android: Yes, but this is not like on iOS. Android does not secure files , however the app does manual file-based encryption using the encryption API’s provided in the java.security package.
What access is the app required to have on phone? To what settings or info will it have access?

The K2 Mobile app has its own app settings. If a branded app is supplied, the mobile app needs to be trusted by the device management. It requires access to the device's mobile/Wi-Fi connection. In addition, depending on controls added to the forms rendered in the mobile app, the following access may be required:

  • Camera
  • Location services
  • Photos/Documents
What data does the K2 app collect (other than the app data like information entered into forms or task list details) about its users? What is K2’s privacy policy regarding this collected data? K2 collects crash reports and anonymous usage data and there is an opt-out option. K2 does not collect personally identifiable information.
Are there kill switch APIs that can be used remotely to remove sensitive data from device if it is lost or stolen? The K2 Mobile app does not provide a kill switch to remove sensitive data. However, the app can be configured to sign out after a specified amount of time (e.g. 20 min). In addition, if MDM software is used to redistribute the app, it can be configured to remove information about the app.
Question Answer
Are authorization tokens used that are stored on device? If so, are they encrypted? Do they expire? Are they revocable from the server?
  • iOS: When a user logs into the K2 Mobile app, the login information is persisted in the device's Keychain using the most secure settings available. This is encrypted and is only readable when the device is unlocked. Device authentication is handled with a claims token through the K2 STS. Authentication is handled by the STS, which then returns a token that can be used by the device to act on the user's behalf. Tokens can be deleted, if necessary, using K2 Management.
  • Android: Yes and No, it depends on the authentication mechanism. This is exactly the same as iOS . For Forms it works the same as the browser, that is federated authentication with cookies. For web service calls, K2 only stores a token on OAuth connections and the validity of the token is determined by the token issuer (Microsoft). Revocation and other functions are the same as with other OAuth systems. The OAuth token is encrypted via Microsoft .NET APIs to perform the OAuth token storage and retrieval. The Android app does not include the Application Timeout setting.
Are passwords stored on the device? If so, are they encrypted? What level of encryption / hashing is taken to protect the stored password? If the phone is backed up, do the passwords remain encrypted?
  • iOS: The system generates its own password for the keychain and stores the key on the device in such a way that it is not accessible to any application. When you back up the device’s data, the keychain data is backed up but the secrets in the keychain remain encrypted in the backup. The keychain password is not included in the backup. Therefore, passwords and other secrets stored in the keychain on the device cannot be used by someone who gains access to a device backup. Encryption uses the device's Keychain, using the most secure settings available.
  • Android:
    • Are passwords stored on device? Yes, for non-OAuth authentication. Are they encrypted? Yes.
    • What level of encryption / hashing is taken to protect password stored? This is protected by a SHA-256 encryption algorithm.
    • If the phone is backed up do these remain encrypted? Yes.
Does authorization tie back to this password (the logged in user) or to the device? Authorization ties back to the logged in user; the server does not have a whitelist of devices which are allowed to connect to it. An MDM can be used to implement this whitelist functionality.
Once authorized, how is session management handled? By default, the session stays open and valid. However, the iOS app can be configured with a timeout setting.
Is there any other security context used for authorization? (e.g. IP Address) For the K2 Mobile app, in addition to the username / password needed to login, the K2 server DNS is required for access.
Question Answer
Is end-to-end secure transit used from the device to the web app (SSL/TLS)? SSL3.0, TLS1.0, TLS1.1 and TLS1.2 can be used for secure transit.
What is the strength of protection of data in transit (e.g. AES etc.) It depends on the strength of the certificate implemented on the server. The K2 app uses the strongest encryption that the server supports. For K2 Cloud, the certificate uses the sha256WithRSAEncryption algorithm.
Does K2 use certificates? If so, are they self signed or provided by a third party? Yes, if using SSL, these are self signed by you or purchased from a certificate authority (recommended).
Is SMS or MMS used to send sensitive data to endpoints? No.
Question Answer
Does K2 do regular checks or tests on the K2 Mobile app code for unintentional sensitive data transfer? Yes.
Are back-end services (Web Services / REST) for the K2 Mobile app tested regularly with fuzz testing and static code analysis? Yes.
Question Answer
Are there any third party code, libraries or integrations used in your mobile application? Yes, K2 uses the libraries provided by the various operating systems (iOS, Android) as well as some open source libraries. K2 does not have any 3rd-party integrations in the mobile app.
Are any third party integrations or APIs monitored for security patches and updated on a regular basis? This does not apply as only OS-level and open source libraries are used.
Is data validated when it is sent or received to non-trusted third party apps before processing within the K2 app? This does not apply as only OS-level and open source libraries are used.