§ 07 — App support

Enklave

Unified endpoint management for every device you need to trust.

Enklave gives IT and security teams a tenant-isolated UEM/MDM control plane for enrollment, inventory, policies, app and patch rollouts, telemetry, incident response, audit approvals, and on-device AI model distribution across iOS, iPadOS, macOS, Android, Windows, and Linux.

View product page All app notes

01 — Problem

Endpoint control breaks down when every platform is governed somewhere else.

Modern organizations need to manage corporate, shared, BYOD, kiosk, and specialized devices across multiple operating systems. Without one governed control plane, teams lose visibility, patching becomes inconsistent, exceptions live in tickets, and incident response depends on manual coordination.

Separate tools for Apple, Android, Windows, Linux, inventory, patching, and incident response
No consistent device posture model across ownership types and lifecycle stages
Policy drift that is discovered late or only during audits
Risky app and patch rollouts without rings, maintenance windows, or rollback evidence
Manual device isolation, wipe, certificate revocation, and user notification workflows
Limited governance for on-device AI models and edge runtime capabilities

02 — Solution

Enklave turns device management into a governed security control plane.

Enklave combines UEM inventory, MDM protocol services, intent-based policy, app deployment, patch management, telemetry, audit approvals, incident playbooks, and an AI model registry into one multi-tenant platform. It is built for teams that need operational control and defensible evidence across heterogeneous endpoint fleets.

Manage iOS, iPadOS, macOS, Android, Windows, and Linux devices from a shared backend model.
Compile high-level policy intent into platform-specific payloads and track drift against expected state.
Stage applications, packages, patches, and remediation actions through controlled rollout rings.
Record posture, telemetry, approvals, audit events, and remediation history in tenant-isolated data stores.

03 — Benefits

Operational outcomes for IT, security, and compliance teams

The value of Enklave is not just device enrollment. It is the ability to prove what is managed, what policy applies, what changed, who approved it, and how the platform responded when risk appeared.

Control every major endpoint family

Use one operating model for Apple, Android, Windows, and Linux fleets instead of splitting governance across disconnected consoles.

Reduce policy drift

Define intent once, compile it per platform, assign it by group and ring, and monitor actual state against expected state.

Deploy apps and patches safely

Coordinate packages, versions, rollout rings, patch definitions, and maintenance windows before changes reach production devices.

Automate incident response

Trigger auditable playbooks for isolation, wipe, lock, certificate revocation, quarantine, script execution, notification, restore, or escalation.

Govern edge AI usage

Track NPU capability, runtime status, model artifacts, model assignments, and deployment status for on-device AI workloads.

Keep tenant data separated

Enforce tenant isolation with PostgreSQL row-level security and tenant context applied before data access.

04 — How it works

How Enklave works

01
Enroll and classify devices
Register devices with enrollment tokens, certificates, groups, platform metadata, ownership type, lifecycle state, software inventory, and posture signals.
02
Define policy, deployments, and response rules
Create policy intents, compiled versions, group assignments, package rollouts, patch windows, incident playbooks, exceptions, and AI model assignments.
03
Monitor, enforce, and prove control
Ingest telemetry, process posture events, detect drift, launch remediation actions, require approvals where needed, and retain immutable audit evidence.

05 — Features

Core Enklave capabilities

Device inventory and enrollment

Track enrolled devices, serials, platform details, ownership model, lifecycle state, hardware, software, network interfaces, posture, and last-seen status.

Groups, tokens, and certificates

Organize devices into groups, issue enrollment tokens, and manage certificate records used for trusted device communication.

Intent-based policy engine

Define policy as intent, maintain versions, compile platform-specific payloads, assign them to groups, and track rollout status.

Drift detection and exceptions

Capture expected versus actual device state, classify severity, and handle approved break-glass or temporary exceptions with expiry.

Application deployment

Manage apps, app versions, packages, checksums, package types, platform support, and staged rollouts.

Patch management

Coordinate patch definitions, severity, reboot requirements, maintenance windows, rollout rings, and completion state.

Incident playbooks

Operate incidents with evidence, status, severity, assigned ownership, remediation actions, approvals, and execution results.

Audit and approval workflows

Record actor, action, resource, before/after state, evidence, rollback plans, request IDs, and approval decisions in immutable audit tables.

Telemetry and posture pipeline

Ingest device events and posture history, process them through NATS JetStream, and maintain aggregations for reporting and operational views.

On-device AI model registry

Store model artifacts, assign them to devices or groups, and track deployment status for edge AI runtimes.

06 — Architecture

Architecture and security model

Enklave is implemented as a Go microservices platform on Kubernetes, with explicit separation between inventory, policy, deployment, patching, incident, audit, model, telemetry, MDM, agent, and frontend-facing service boundaries.

Edge routing through Envoy, internal load balancing, and ingress-nginx before traffic reaches Enklave services.
API gateway and dedicated Go services for inventory, policy, deployment, patching, incident response, audit, model registry, telemetry ingest, and telemetry processing.
MDM protocol services for Apple, Android, and Windows, plus an agent gateway for device-side communication.
PostgreSQL high availability with seven domain schemas and row-level security enforced by tenant context.
NATS JetStream event bus for posture and telemetry processing across services.
Ceph RGW compatible object storage for deployable artifacts such as packages and model files.
Keycloak OIDC/JWKS identity, Kubernetes-native deployment, Istio Ambient security controls, Infisical secrets, and internal certificate infrastructure.

07 — Use cases

Where Enklave fits

Enterprise device fleet management

Operate mixed fleets across employee, shared, privileged, kiosk, dedicated, and BYOD scenarios.

Security posture and compliance

Maintain posture levels, compliance status, risk state, software inventory, CVE references, and audit-ready control evidence.

App and patch rollout governance

Use packages, versions, rings, maintenance windows, status tracking, and rollback evidence for safer change delivery.

Endpoint incident response

Coordinate isolation, wipe, lock, quarantine, notification, certificate revocation, script execution, restore, and escalation from tracked incidents.

Regulated multi-tenant environments

Separate tenant data with row-level security while preserving central operational workflows.

AI-capable endpoint operations

Track NPU capability, runtime health, and model deployment state where edge AI workloads are part of the endpoint strategy.

08 — Integrations

Integrations and platform connections

Enklave is designed to sit inside an enterprise infrastructure stack, connecting identity, device protocols, event processing, storage, certificates, and Kubernetes operations.

Keycloak OIDC and JWKS

Keeps access tied to organization accounts, roles, and sign-in policy.