Encryption is one of those security terms that gets mentioned in compliance checklists and vendor documentation without much explanation of what it actually does, how it works on the specific devices your business operates, or what it means when something goes wrong.
For businesses managing kiosks, POS terminals, and tablets in customer-facing environments, device encryption is not an advanced security configuration. It is a baseline requirement. Understanding what it does, what it does not do, and how MDM platforms like Moki enforce it across a fleet is the foundation for making confident, informed decisions about your device security posture.
What Device Encryption Actually Does
Device encryption converts the data stored on a device into an unreadable format that can only be decoded with the correct cryptographic key. Without encryption, the data on a device’s storage is readable by anyone who gains physical access to the hardware. With encryption enabled, physical access to the device yields nothing readable without the key.
The practical implication is straightforward. If an encrypted device is stolen, lost, or physically accessed by an unauthorized person, the data on it is protected. Transaction logs, cached customer information, stored credentials, and application data cannot be extracted and read without the decryption key, which is tied to the device’s secure hardware or access credentials.
Encryption does not prevent a device from being used by someone who can unlock it through normal means. It is a data-at-rest protection, meaning it protects stored data from extraction rather than preventing active device use. This is why encryption works in combination with other controls like kiosk mode lockdown and remote wipe rather than as a standalone security measure.
How Encryption Works on iOS and Android
Both major mobile platforms handle encryption differently, and understanding the platform-specific implementation matters for fleet management decisions.
On iOS devices, encryption is enabled by default on all supervised devices and cannot be disabled. Apple’s hardware-level encryption is tied to the device’s Secure Enclave, a dedicated security processor that manages cryptographic keys independently of the main CPU. When a passcode is set on an iOS device, the data is encrypted in a way that cannot be accessed without the correct passcode or biometric authentication, even if the storage chip is physically removed from the device. For supervised iOS devices enrolled in Moki, encryption is enforced automatically as part of the supervision framework.
On Android devices, full-disk encryption has been a default requirement for certified Android devices since Android 6.0, and Android 10 and later use file-based encryption as the standard. Through Android Enterprise, MDM platforms can verify and enforce encryption status as a compliance requirement. Devices that report as unencrypted can be flagged, quarantined from corporate resources, or blocked from receiving configuration updates until the issue is resolved.
Moki’s MDM platform supports encryption enforcement and compliance monitoring for both platforms, giving administrators visibility into the encryption status of every device in the fleet from the dashboard.
Why Encryption Matters for Specific Device Types
The business case for encryption varies by device type based on what data those devices handle and the physical environments they operate in.
POS terminals are the most clearly regulated category. Payment devices that handle cardholder data are subject to PCI-DSS requirements, which include specific standards for data protection at rest. A POS terminal that processes card transactions and caches transaction data must have encryption enabled to meet PCI compliance requirements. Beyond regulatory compliance, a stolen or tampered POS terminal without encryption is a direct path to cardholder data exposure, with the associated liability, notification requirements, and card network penalties.
Patient-facing kiosks in healthcare handle protected health information subject to HIPAA’s Security Rule, which requires covered entities to implement encryption of ePHI at rest where reasonable and appropriate. A check-in kiosk that caches patient names, dates of birth, insurance information, or appointment details is storing ePHI on the device. Encryption is the primary technical safeguard protecting that data if the device is accessed by an unauthorized party.
Retail kiosks and self-service terminals may handle loyalty account data, email addresses, purchasing history, and in some cases partial payment information. While the regulatory requirements vary by jurisdiction and data type, the risk of unauthorized data extraction from unencrypted retail kiosks is real and the reputational cost of a breach is significant regardless of regulatory exposure.
Employee tablets in distribution and manufacturing environments may contain proprietary operational data, vendor credentials, and access to internal systems. Encryption protects this data if a device is lost or stolen in a high-turnover or high-physical-risk environment.
What MDM Adds to Encryption
Encryption at the device level is the foundation, but MDM adds the management layer that makes encryption operationally effective across a fleet.
Without MDM, encryption enforcement is inconsistent. Devices may ship with encryption enabled, but there is no centralized verification that every device in the fleet has it active, no alerting when a device reports as unencrypted, and no mechanism to enforce remediation when a compliance gap is found.
With Moki’s MDM platform, encryption management includes:
- Compliance monitoring: The dashboard reports the encryption status of every enrolled device, making it immediately visible if any device in the fleet is not encrypted
- Policy enforcement: Configuration profiles can require encryption as a condition of enrollment and flag devices that do not meet the requirement
- Remote wipe as a backstop: When a device is lost or stolen, Moki’s remote wipe capability allows the device to be wiped remotely, eliminating the data even if encryption were somehow circumvented
- Passcode enforcement: Encryption on both iOS and Android is most effective when combined with a strong passcode requirement, which MDM enforces through the device configuration profile
The combination of device-level encryption and MDM-enforced compliance monitoring means that encryption is not just enabled at deployment but verified and maintained continuously across the entire fleet lifetime.
Encryption and Physical Security Work Together
Encryption protects data when a device is physically accessed without authorization. It does not protect against attacks on a running, unlocked device. This is why encryption is part of a layered security approach rather than a standalone solution.
For customer-facing devices, kiosk mode lockdown prevents unauthorized access to the device’s operating system and data while the device is running. Encryption protects the data if the device is powered off and physically examined. Remote wipe provides a final line of defense if a device is confirmed lost or stolen and the other controls have been bypassed.
All three controls are configurable and monitorable through Moki’s platform, making it straightforward to verify that every layer of the security stack is in place across every device in the fleet.
Getting Encryption Right Across Your Fleet
The practical steps for ensuring encryption is correctly implemented and maintained across a managed device fleet are straightforward:
- Verify that all iOS devices are supervised through Apple Business Manager, which automatically enforces encryption and passcode requirements
- Confirm that all Android devices are enrolled through Android Enterprise, which enforces encryption compliance as part of the managed device framework
- Configure passcode requirements in device profiles for all device types, since encryption effectiveness is tied to passcode strength
- Review the encryption compliance status of every enrolled device in the Moki dashboard and resolve any devices reporting as non-compliant
- Include encryption status as a standard item in your periodic MDM fleet audit
Schedule a Moki demo to see how encryption compliance monitoring works in the platform, or start a free trial to begin verifying encryption status across your fleet today. Moki’s support resources cover platform-specific encryption configuration for iOS, Android, and BrightSign deployments.