Keep dedicated devices locked to the job, wherever they are.
Enroll tablets and phones into a kiosk-locked, single-purpose state, push policy and configuration remotely, and lock, wipe or locate a device the moment something goes wrong — all from a console AMBIC hosts on its own infrastructure, not a third-party MDM vendor's cloud.
The business problem
Businesses running dedicated devices — a counter tablet, a kiosk, a field device — need them to stay locked to one job, be recoverable if lost or stolen, and not require a factory-reset trip to the office every time one needs reconfiguring.
The old way
A device gets handed out configured once, with no remote way to update its policy, confirm it is still locked down, or respond quickly if it goes missing — reconfiguring it means physically retrieving it and starting over.
The Ambic system
A self-hosted mobile device management platform for enrolling, locking down and remotely managing a fleet of dedicated Android devices from one console.
The workflow
Workflow map based on the documented system design — no fabricated interface or deployment claim.
At a glance
- Status
- Production Pilot
- Users
- Fleet admins and staff issued a dedicated device
- Inputs
- Device enrollment, policy and geofence configuration
- Outputs
- A managed device fleet, plus location and compliance event history
- Human review
- Admin-configured policy and alert rules; sensitive actions are logged
- Deployment
- Self-hosted, deployed and maintained on AMBIC's own infrastructure.
What’s configurable
- App allowlist and kiosk branding
- Wi-Fi networks and certificates
- Geofences and alert rules
- Passcode and storage-encryption policy
What requires custom development
- iOS, Windows or macOS device management (a separate agent platform)
- Zero-touch or Managed Google Play enrollment (gated behind a Google partner program)
- Samsung Knox Mobile Enrollment (gated behind a Knox SDK licence)
How it works
Key modules
Expand each section for the full technical detail.
Enrollment
- Factory-reset QR provisioning for full device-owner control
- No-factory-reset sign-in enrollment for devices that can't be reset
- On-device permissions checklist so every required OS grant is walked through once, not discovered later as a support ticket
Kiosk & lockdown
- App allowlist restricting a device to only its configured job
- Hard, unescapable lock for factory-reset-enrolled devices
- Soft lock with an escape-detecting watchdog and on-screen lock overlay for devices enrolled without a factory reset
Remote actions
- Lock, wipe, reboot and ring commands
- Wi-Fi network and certificate push
- Lock-screen messaging and fleet-wide alerts
Location & geofencing
- Device location history
- Circular geofences with enter/exit detection
- Alerts on a geofence crossing, routed to a webhook or email
Monitoring & alerts
- Battery, storage-encryption and root/tamper status per device
- Webhook and email alert rules on device events
- Data-usage tracking per device
Operational benefits
- No physical retrieval trip needed for routine policy or configuration changes
- A lost or stolen device can be locked, wiped or located immediately, not after it's found
- Self-hosted — device and location data stay on AMBIC's own infrastructure, not a third-party MDM vendor's cloud
- One console covers both factory-reset and no-factory-reset device onboarding, so a device that can't be reset isn't left unmanaged
Security & quality controls
- The factory-reset enrollment path's kiosk lock is enforced by Android's device-owner APIs directly and has no built-in user escape route
- The no-factory-reset enrollment path's kiosk lock relies on Android's own screen-pinning, which any app — ours included — can be exited from via the OS's built-in Back-and-Recents gesture; this is a platform-level limitation, not something a watchdog can fully close, only detect and recover from quickly
- Device credentials are hashed, not stored in plain text, and every sensitive remote action is logged
- Data stays on infrastructure AMBIC controls — nothing routes through an external MDM vendor's servers
Android only today — no iOS, Windows or macOS device agent yet.
Who it’s for
- Retail counters running dedicated order or catalogue tablets
- Kiosk and self-service device deployments
- Field or delivery staff issued a single-purpose device
- Any business that needs a device locked to one job and recoverable if lost
Deployment approach
Self-hosted, deployed and maintained on AMBIC's own infrastructure.
FAQ
Does every device need a factory reset to be enrolled?
No. A device that can't be factory-reset can still be enrolled through a sign-in flow, though its kiosk lock is a softer, watchdog-backed lock rather than the fully hard lock a factory-reset enrollment gets — that trade-off is explained on enrollment, not hidden.
Can someone get out of kiosk mode?
On a factory-reset-enrolled device, no — the lock is enforced at the OS's device-owner level with no user escape route. On a device enrolled without a factory reset, Android's own screen-pinning can be exited through the OS's built-in unpin gesture; our watchdog detects that within about a second and relaunches the locked app, but it can't prevent the gesture itself — no app can, on Android, without full device-owner status.
Is our device or location data hosted by a third party?
No. The console and its data run on infrastructure AMBIC hosts and controls, not a third-party MDM vendor's cloud.
What happens if a device is lost or stolen?
An admin can lock, wipe or locate it from the console immediately, without needing to physically recover it first.