Enroll
The first honest launch binds device and SIM after ALLOW. Sandbox proof comes before Production enrollment.
App Security · AppDefender.dev
BindDefender
Zero-trust device and SIM binding for the enrolled handset.
Keeps the session on the device and SIM Super Admin enrolled. Detects SIM swap, cloned device, and sideloaded twins. Binding is evaluated at launch and again on ATS Full payment routes.
Device binding
SIM binding
Clone / sideload detect
Re-bind on ATS Full
One-device block
Isolated bind records per environment
What it does
BindDefender on the launch path
BindDefender keeps a Client session on the enrolled Android or iOS handset and SIM. That is the NPCI-shaped control banks already expect — applied at the launch gate, not only after a password.
Clone installs, sideloaded twins, and SIM swap fail the bind. Super Admin can block one device without taking down the Client app for everyone else. Binding is scored at launch and again when ApiDefender runs ATS Full.
BindDefender does not replace AppDefender. A rooted enrolled phone is still BLOCK. A clean phone with a swapped SIM fails bind. Isolated Sandbox and Production catalogs never share bind records.
What it scores
Signals this module is built for
- Handset identity on the enrolled install
- SIM binding for NPCI-shaped programs
- Clone and sideload detection
- SIM swap after enrollment
- Re-bind on ATS Full payment routes
- One-device Super Admin block
How it runs
Detect, decide, enforce
Recheck
Launch and ATS Full payment routes confirm the same handset. A twin install fails.
Scope the block
Super Admin blocks that Android or iOS device. Other Client users stay up.
Operators
Who owns the control
Super Admin
Enables bind policy per environment. Can block one handset without a Client-wide outage.
Client Admin
Sees bind FAILs for that Client. Cannot copy Production bind keys into Sandbox.
Other App Security modules
Read the product page, not a copy here
All modules