Manageability
Policies, kiosk mode, approved apps, Wi-Fi, and remote updates.
Project 01 · Enterprise Mobility
Nexronik MDM:
devices and field operations under unified management.
A corporate Android system combining terminal management, a secure work screen, routes, requests, merchandising, and 1C data exchange.
- Format
- Corporate platform
- Environment
- Android · Web · Backend
- Challenge
- MDM + field automation
- Nexronik role
- Architecture and development
01 / Context
More than MDM.
A complete operating system.
A corporate tablet must remain both a managed device and a convenient work tool for a field employee.
A regular launcher addresses only the interface, while standard MDM addresses only policies. This project required one environment that could securely restrict devices, deliver updates, assign roles, and support daily work without a stable internet connection.
Field operations
Routes, customers, catalogue, requests, merchandising, and an offline queue.
Unified data
A dedicated server model, admin panel, reports, and controlled data exchange with 1C.
02 / Architecture
Three independent layers.
One secure environment.
System privileges are separated from the user interface, and workflows from external-system integration. Core and Launcher are versioned separately and updated through agreed contracts.
01Kotlin
CORE
Device Policy Controller
The native Android Device Owner handles system policies and trusted app installation.
- Persistent HOME and kiosk mode
- Lock-task allowlist
- Wi-Fi and geolocation
- Verified OTA installation
02Flutter
APP
Work Launcher
The device home screen and task workspaces for different field-team roles.
- Routes and customers
- Requests and personal plan
- Checklists and photos
- Offline operation
03PHP + MySQL
BACK
Server and management
An admin panel, API, and dedicated operational state independent of 1C availability.
- Devices and policies
- Roles, teams, and routes
- Orders and telemetry
- Reports and action audit
Android CoreSystem policies
Flutter LauncherWorkflows
PHP BackendManagement and API
1CControlled data exchange
03 / Capabilities
From device policy
to a completed visit.
MDM functions and business workflows operate as one system while remaining separated at the responsibility and data levels.
Corporate kiosk
A persistent work screen, removal protection for critical components, and launch of approved apps only.
Secure updates
Silent APK installation after validating the package name, version, and signing certificate.
Routes and requests
Visit plan, customer card, catalogue, stock, order, and personal sales plan.
Merchandising
Checklists, product issues, before-and-after photos, skipped visits with reasons, and visit history.
Offline operation
Cached work data and supported actions remain available offline and are sent through a managed queue after connectivity is restored.
Telemetry
Geolocation, battery, connectivity, and device status with unreliable-coordinate filtering.
Roles and teams
The server assigns the workspace, and employee data is isolated when a device is reassigned.
Independent data exchange
The primary service continues operating when 1C is unavailable, while synchronisation runs separately under control.
04 / Work Roles
One terminal.
Different workflows.
The workspace is assigned by the server-side position. Users do not switch roles manually and see only their own work context.
Sales representative
- Daily route and customer cards
- Catalogue, prices, stock, and outstanding balances
- New requests and order history
- Personal plan and work metrics
Merchandiser
- Weekly route and proximity checks
- Display checklists and product issues
- Before-and-after photos and reasons for skipped visits
- Visit history and offline submission
05 / Security
Security built
into the architecture.
System privileges are not mixed with the interface, trust between components is signature-verified, and critical actions are protected by strict contracts.
Privilege separation
Device Owner is isolated in a dedicated Core app, while Launcher receives only a protected IPC contract.
Update verification
Before installation, the package, versionCode, and certificate are verified, and the server binds the update to a specific device.
Secure recovery
Policies are restored after reboots and updates, while temporary maintenance mode closes automatically.
Work data isolation
Offline queues are tied to the assigned employee and are not transferred to a new device user.
06 / Validation
Results verified
through controlled test runs.
The published figures cover four core test suites and a perimeter/pre-auth run in an isolated environment. They are not business metrics, an SLA, or formal certification.
tests passed
49 Backend
107 Flutter
54 Core unit
16 Launcher native
unauthorised requests in a controlled environment
transport errors and 5xx responses in the same run
at concurrency 8–32 in the perimeter/pre-auth run
The controlled run was recorded on 4 August 2026 after a security review and remediation of critical server defects. It does not model mixed authenticated business-workflow load.
07 / Stack
Chosen for the task,
not for fashion.
- Mobile UIFlutter · Dart
- Device controlKotlin · Android DPC
- BackendPHP 8.2 · MySQL 8
- IntegrationREST API · 1C
- InfrastructureLinux · Nginx · Apache
- QualityUnit · Contract · Load
Have a similar challenge?
We will design a system
that supports both load and growth.
CRM, mobile app, API, server platform, or complex integration: we will build the solution around your process.