Protect your app without writing a single line of code
AppTego applies runtime application self-protection (RASP) directly to your compiled .apk, .aab, or .ipa binaries. Upload your app, choose your security controls, and download a hardened build — no SDK changes needed.
Tenant
Security
App
Build
Create your account
Head to portal.AppTego.com to get started. Registration is a three-step process:
Create a tenant
After logging in, you'll be prompted to select or create a tenant. A tenant is your isolated workspace — it holds your configurations, applications, team members, and audit history.
Click "Create new Tenant" and enter a name (5–30 characters). Every new tenant starts on the Free plan — you can upgrade later from Settings.
Three environments
Each tenant provides three isolated configuration environments that let you test changes safely before going live:
Configurations promote one direction: Development → Staging → Production. Start by editing your Development configuration, then promote once you're satisfied.
Configure your security controls
From the dashboard sidebar, you'll find the security configuration split into sections. Start with the version selector at the top — choose Development for initial testing.
Preventative Controls
These are binary on/off switches that harden your app at build time. Toggle them from the Preventative Controls page. Popular options include:
- Disable Screenshot — blocks screen capture while your app is active
- Disable Screen Recording — prevents screen recording of app content
- Storage Encryption — encrypts locally stored app data at rest
- Disable USB Debugging — blocks ADB connections (Android)
- Set Debuggable to False — prevents debug-mode exploitation
Detection & Response
Detection rules monitor for threats at runtime. When enabled, each rule requires a response action:
- Log — silently log the event for analytics
- Message — display a custom warning to the user
- Redirect — send the user to a URL
- Terminate — immediately close the app
Platform support at a glance
Upload your application
Navigate to Application Builds in the sidebar, select your target environment from the dropdown, then click "Upload Android" or "Upload iOS".
Supported file formats
Build limits per plan
| Plan | Builds / Week | Concurrent Builds | Code Signing |
|---|---|---|---|
| Free | 2 | 1 | — |
| Team | 10 | 2 | ✓ |
| Enterprise | Unlimited | 5 | ✓ |
Code signing (Team & Enterprise)
On paid plans, you can upload signing keys so AppTego re-signs your protected build automatically. Head to the Signing Keys section on the Application Builds page to add a keystore (Android) or provisioning profile (iOS). You can set a default key per platform or choose one at upload time.
Download your protected build
Once processing completes, the build will appear in the Current and Previous Builds table with a success status. Click the download icon to get your protected binary.
The output file has the same format as your input (.apk, .aab, or .ipa) with all your configured security controls baked in. Install it on a device or distribute it through your normal release process.
Next steps
Invite your team
From User Management (Team plan and above), add team members by email. Each user can be assigned granular permissions:
| Permission | What it controls |
|---|---|
| modify_configuration | Update security configs (detection, prevention, connection, obfuscation), push live config |
| update_certificates | Manage signing certificates and keys |
| build_applications | Upload apps, trigger builds, delete applications |
| manage_custom_messages | Create and update custom detection response messages |
| user_and_api_management | Add/remove users, manage permissions, create API tokens |
| modify_tenant_settings | Rename/delete tenant, manage subscription |
Automate with CI/CD
Use the Automation API to upload, process, and download builds directly from your CI/CD pipeline. Authenticate with a Bearer <key_id>:<key_secret> token generated from the portal's API Tokens section.
Design custom messages
When a detection rule triggers, you can show a branded message instead of a generic alert. Head to Message Design (Team+) to customise the title, body text, buttons, and redirect URLs — with full localisation support.
Monitor with analytics
On the Enterprise plan, the Dashboard gives you visibility into detection events, active devices, and threat distribution. The Device Logs and Audit Logs pages provide full event history with filtering and pagination.