TENEBRAE SOC

About TENEBRAE SOC

TENEBRAE is a production-grade mobile security agent that protects your organization's devices from advanced threats.

WHY THIS APP USES THE VPN PERMISSION (VpnService)

TENEBRAE uses Android's VpnService API to provide DNS Protection: an on-device DNS filter that blocks phishing, malware and other malicious domains before your device connects to them. This is a local security filter, not a VPN service.

• No remote VPN server. TENEBRAE does not route your traffic to us or to any third party. Nothing leaves the device because of this feature.
• DNS queries only. The local interface routes DNS traffic and nothing else. Your web browsing, apps, messages, video and other network traffic do not pass through it.
• How filtering works. A DNS lookup for a domain on your organization's blocklist is answered locally as "not found", so the connection is never made. Every other lookup is passed to the resolver your network already uses, unchanged.
• Your browsing is not collected. DNS queries are not uploaded, not stored off the device, and are never used to build a browsing history. Only counts of blocked lookups are reported to your organization's security dashboard.
• You are in control. DNS Protection is off until you turn it on, lives under Settings > Network Protection > DNS Protection, and can be switched off at any time. Android shows a persistent notification and a status icon whenever it is active.

This permission is used solely for device security (threat and malicious-domain blocking). It is not used for anonymization, geo-unblocking, proxying, or routing traffic through another country.

KEY FEATURES:

REAL-TIME THREAT DETECTION
• Root/jailbreak detection with multiple detection vectors
• Sideloaded app identification and risk scoring
• Network threat monitoring (rogue WiFi and MITM detection, plus alerts when an unrecognized VPN is active on the device)
• Phishing and malicious-domain blocking at the DNS layer (see the VPN permission section above)
• Behavioral anomaly detection

DEVICE SECURITY POSTURE
• Continuous encryption status monitoring
• Screen lock and biometric authentication verification
• Security patch level compliance checking
• Developer mode and debug detection
• SELinux enforcement status (Android)

ENTERPRISE MANAGEMENT
• MDM integration for silent deployment
• All telemetry sent over TLS; cleartext traffic blocked at the platform level
• AES-256-GCM encryption of stored telemetry, using NIST-approved algorithms
• Background telemetry collection with minimal battery impact
• Automatic device enrollment with QR code or token

SOC ANALYST COMPANION
• Real-time alert notifications for security incidents
• MITRE ATT&CK Mobile framework threat mapping
• Threat investigation and triage on-the-go
• Device fleet overview and compliance dashboards
• Analyst notes and escalation workflows

PRIVACY & SECURITY
• All telemetry is transmitted over encrypted connections (TLS)
• No personal data collection beyond security signals
• No location, contacts, messages, photos, files or call data is collected
• No browsing history or DNS query history is collected
• Data stays within your organization's tenant
• Transparent data collection with full audit trail
• Built for GDPR and CCPA obligations, with in-app account deletion

TENEBRAE is designed for enterprise security teams who need deep visibility into their mobile device fleet. Deploy across your organization with your existing MDM using zero-touch enrollment, a QR code, or an enrollment token.

Requires an active TENEBRAE organization account. Visit tenebraesecurity.com to get started.