Built so that what an attacker takes is worth as little as possible
Every MDM can lock and wipe your devices, which makes the MDM itself the biggest target you own. Here is how BusiMDM is designed with that in mind, including where the limits are.
Two trust zones
BusiMDM is split in two. The part that decides what happens to your devices runs on your own network. The part in the cloud only delivers what that part has approved and signed. We call them the Authority and the Device Plane.
The Device Plane
Talks to your devices, checks the rules, keeps the records.
- Checks the signature, version and expiry of every change before acting
- Talks to devices through Apple, Microsoft and Google's built-in management
- Checks devices against your rules and tells Microsoft 365 the result
- Keeps inventory, dashboards and a tamper-evident audit trail
- Never holds a signing key or the means to read a recovery key
What lives where
The cloud part is designed so that even if it were completely compromised, the attacker would not get the keys that matter.
| Asset | Where it lives | Who can use it |
|---|---|---|
| Private signing keys | Your Authority | Administrators with the release role |
| Recovery-key decryption key | Your Authority | Administrators you give that permission, every reveal logged |
| Escrowed recovery keys | Device Plane, encrypted | Nobody. The Device Plane holds ciphertext only |
| Device identity certificates | Device Plane | Issued automatically to devices; cannot sign settings or commands |
| Temporary admin rights and offline codes | Your Authority | Support roles you define |
| Inventory, compliance and audit | Device Plane, one region | Your administrators, signed in with Microsoft |
Nothing reaches a device without your signature
App lists, settings, compliance rules and remote commands all travel as signed bundles from your Authority. The cloud checks every one before acting on it, and refuses anything that fails.
Signed
Every bundle is signed on your own network before it leaves. The cloud can't author one, only check and deliver it.
Versioned, no rollback
Every bundle carries a version. Anything older than what a device already has is refused, so nobody can quietly put back a weaker setting.
Expiring
Remote commands expire in 15 minutes. Settings carry an explicit validity window. Anything stale is ignored.
Device-bound
A command names one device and carries a one-time code. It can't be pointed at a different device or run twice.
Wipe is the most guarded verb in the product
The actions that could hurt your business are the ones with the most checks, and that is deliberate.
- Any action that targets many devices, or the whole estate, requires a second administrator to approve
- Roles separate authoring, approval, release and escrow reveal, and can be scoped to sites or groups
- Every command carries the issuing administrator's identity into the audit trail
- Enrolment codes are single-use and short-lived, so an old one can't add a rogue device
Two people for bulk
One administrator drafts, a second approves. Only then does the bundle get signed and released.
Append-only audit
Every change, approval and command is recorded with who did it and when, and can be sent to your security tooling.
One region, encrypted, locked down
One UK/EU region
The cloud part runs on AWS in a single UK or EU region. Your device data stays there.
Encrypted in transit and at rest
Encrypted connections to every device and between the two halves of BusiMDM, which also check each other's identity. Encrypted storage throughout.
Write-once bundle store
Signed bundles land in versioned, locked storage. Nothing can be quietly altered or deleted after release.
No inbound to your network
Your Authority connects outbound only. Nothing in the cloud ever opens a connection into your network, so there is no hole to punch in your firewall.
Infrastructure as code
Every piece of infrastructure is defined in code and reviewed before it is applied. A change that would open something to the internet is blocked automatically.
Signed builds
Every release is signed as it is built, and the cloud only runs what the build pipeline produced.
What the split does and does not guarantee
On Windows, the BusiMDM app store checks signatures on the PC itself, so even a compromised cloud could not install software or hand out admin rights there. For Apple, Android and Windows' own management channels, the device trusts whatever its management server tells it. That is how every MDM works, including this one. On those paths the split keeps the keys out of reach and every action attributable, and the hosting controls above do the rest.
We would rather you knew exactly where the lines are than bought a claim that doesn't survive scrutiny. Ask for the full threat model when you get in touch.
Found something?
Use the contact form and choose Security report. We acknowledge within two working days and will keep you informed until it's resolved. Please don't test against systems you don't own.
Send us your security questionnaire
We'll answer it in full, and share the threat model behind these pages.
Get in touch