ARCHITECTURE / HOW IT WORKS
Android policy enforcement. Security telemetry. Forensic accountability.
A defence-in-depth architecture that treats the Android endpoint as a security boundary: managed provisioning, attack-surface reduction, network egress controls, behavioural correlation and human-led forensic escalation.
01 / DEVICE
No root access: preserving Android’s security model is part of the design.
Device-owner provisioning and policy enforcement.
Archangelus uses Android’s enterprise device-management model to apply device-owner policies where supported. QR-based provisioning is performed during initial setup; an already provisioned handset can require a factory reset before device-owner enrolment.
Application-level egress filtering evaluates outbound destinations associated with trackers or malicious activity. Managed-profile isolation, installation restrictions and security policy enforcement reduce the opportunities available to an attacker.
Available controls depend on the supported Android management APIs, OS version and device implementation; the effective enforcement surface is assessed per device.
02 / OVERNIGHT WATCH
Run the checks when they interfere least with daily use.
Scheduled telemetry collection and posture assessment.
During an unattended charging window, Archangelus evaluates accessible system logs, patch levels and relevant device events. The morning security brief aggregates observations into a defensible posture assessment instead of triggering alerts on every deviation.
Where supported and permitted, scheduled restarts can interrupt threats that live only in memory. They do not guarantee removal of persistent spyware.
- EventsCollect system events made available by the platform.
- PostureCheck security settings and update status.
- CorrelationCompare anomalies with the device’s baseline.
- RestartWhere supported and permitted by device policy.
- ReportA short account of completed checks.
03 / INTELLIGENCE
An app that constantly cries wolf will eventually be ignored.
Multi-signal correlation before escalation.
Rule-based detection and AI-assisted behavioural analysis correlate suspicious network destinations, integrity-related observations and deviations from a per-device baseline. Correlation is used for triage: an indicator of compromise is not, by itself, proof of compromise.
The adviser explains findings in plain language, helps identify phishing and can assess suspicious content submitted deliberately by the user. It does not automatically read private conversations.
04 / EXPERT REVIEW
AI assists the investigation. It does not sign forensic reports.
From threat indicators to human forensic assessment.
When multiple indicators warrant investigation, a forensic analyst reviews the event history and available evidence, assesses alternative explanations and issues a signed expert report. Automated risk scoring does not substitute for evidentiary judgement.
Where specialist acquisition or forensic procedures are required, the app does not replace established investigative tools and processes.
AI flags. The analyst examines. Evidence decides.
05 / TRUST
Code signing is a security control, not a marketing claim.
Cryptographically authorised rule distribution.
The architecture specifies signature verification for rules and updates before application on a device. Its signing authority is designed to remain offline and separate from the distribution infrastructure: a server compromise must not, on its own, be sufficient to authorise new policies.
This limits the ability of an attacker who compromises a distribution server to push arbitrary policies to devices.
06 / COMPATIBILITY
Operating systems impose different limits on security software.
Why Android comes first.
The functions described here rely on device-management and control capabilities in the Android ecosystem. Archangelus does not claim equivalent protection on iPhone.
An iOS deployment requires a separate threat-model review and a different assessment of the platform’s available security controls.