Bittium SafeMove

Opening the App: The Setup Reality

You install Bittium SafeMove on a company-owned device. The icon appears. You tap it. Nothing works yet. This is not a standalone app. The Play Store description makes that clear: the client requires a server component and a separate license. Without those, the app sits there, useless. Contact SafeMove sales at [email protected] to get started. That is the first barrier. The second barrier is the permissions screen. The app requests Device Administrator rights. It also asks for VpnService access. These are not optional. The organization's IT team pushes a configuration file through the management console. You import that file into the app UI. Only then does the app activate. This is not a consumer-friendly process. It is built for IT departments, not individual users. The app is a tool for enforcing security policies across a fleet of devices. The moment it activates, the device is locked down. Password policies apply. Minimum length, complexity requirements, remote reset capabilities all kick in. The device is no longer yours. It belongs to the organization's security framework.

This onboarding process is the first real test. If the configuration file is missing or corrupted, the app remains dormant. If the server is down, the VPN cannot establish a connection. The app does not give you a friendly error message. It simply fails to connect. IT staff need to troubleshoot the server side, not the client side. The app itself is stable, but the ecosystem around it is fragile. One misconfigured policy can lock a user out of their own device. The remote wipe feature is particularly harsh. If an employee leaves the company or loses their phone, IT can wipe the device clean. All data, gone. This is by design. The app is for data protection, not user convenience. Users who expect a simple VPN app will be frustrated. Users who understand enterprise security will appreciate the rigor.

VPN and Policy Enforcement: How Two Features Work Together

The always-on VPN and the device management policies are not separate features. They are intertwined. The VPN provides the secure tunnel. The policies enforce what happens inside that tunnel. When the VPN is active, the device routes all traffic through an IPsec-based encrypted channel. The organization's network sees the device as a trusted endpoint. But the policies also control what the device can do. The app can restrict which applications are installed. It can whitelist approved apps. It can block others. This means a user cannot simply download any app from the Play Store. The IT team decides. This is a common complaint in enterprise settings. Users feel restricted. But from a security standpoint, it is necessary. The app also enforces password policies. If a user sets a weak password, the app forces a change. If the user fails too many attempts, the device locks. The remote unlock feature allows IT to reset the password without physical access to the device. This is useful when an employee forgets their credentials. But it also means IT has full control. The combination of VPN and policy enforcement creates a closed ecosystem. The device is secure, but it is also heavily monitored. The analytics module tracks usage. IT can see which apps are used, how often, and when. This visibility is valuable for compliance and auditing. But it also raises privacy concerns. Users know their activity is being logged. The app does not hide this. The permission requests make it explicit.

What happens when the VPN drops? The app is designed to reconnect automatically. The zero-click connectivity means the user does not have to manually re-establish the tunnel. The app handles it in the background. But if the network is unstable, the VPN may struggle. The app does not show a detailed status. It just tries to reconnect. This can be frustrating for users in areas with poor coverage. The app is optimized for stable enterprise networks, not consumer-grade Wi-Fi. The IPsec standard ensures strong encryption, but it also adds overhead. The device may experience slightly higher latency. For most enterprise applications, this is acceptable. For real-time communication, it might be noticeable. The app's performance in poor connectivity is a known factor. Some users have reported that the app improves application behavior in intermittent connectivity. This is a benefit, not a drawback. The app reduces the number of steps to get connected. It removes the need to enter complex tokens. This is a significant improvement over traditional VPN clients. Users do not need to remember passwords or generate one-time codes. The device is always authenticated. This is the promise of the always-on VPN. It works, but it requires a stable backend.

Real-World Performance: Ads, Bugs, and Crashes

The app does not display ads. It is an enterprise tool, not a consumer product. There are no in-app purchases. The business model is licensing and support. The app itself is free to download, but the license costs money. Organizations pay for the server component and maintenance. The app's performance is generally stable. The changelog mentions only "Bug fixes." This is vague. It does not specify what was fixed. This lack of transparency is common in enterprise software. Developers do not always disclose details. Users have reported installation failures. These are often due to storage space, device compatibility, or network issues. The app requires Android 9.0 or higher. Older devices are not supported. The APK size is around 36-38 MB. This is moderate. The app does not consume excessive resources. It runs in the background, maintaining the VPN connection. Battery drain is not a confirmed issue. There are no widespread reports of crashes. The app appears to be well-tested. However, customer support is a recurring complaint. Multiple reviews on Amazon mention that the company does not respond to emails. There is no phone number listed on the site. Support is available only through email. This is a significant drawback for organizations that need immediate assistance. The lack of responsive support can lead to extended downtime. If the VPN fails, the organization cannot access its systems. This is a critical failure point.

Some users have reported that the product simply does not work. They had to return it after two weeks of no service. This suggests that the activation process may fail. The app requires the server component to be properly configured. If the organization's IT team does not set it up correctly, the app will not function. This is not a flaw in the app itself. It is a deployment issue. However, the end-user does not care about the distinction. They just want the app to work. The app's reliance on a server component is a double-edged sword. It provides centralized control, but it also creates a single point of failure. If the server goes down, all clients lose connectivity. The app does not have a fallback mode. It is entirely dependent on the server. This is by design. The app is not meant to be used in isolation. It is part of a larger ecosystem. The organization must invest in the infrastructure to support it. For small businesses, this may be cost-prohibitive. For large enterprises, it is a necessary expense.

The Permission Model: Device Administrator and VpnService

The app uses two critical permissions: Device Administrator and VpnService. The Device Administrator permission gives the app extensive control over the device. It can enforce password policies, lock the device, reset the password, and even factory reset the device. This is a powerful permission. It is typically reserved for enterprise apps. The VpnService permission allows the app to create a VPN tunnel. This tunnel routes all network traffic through the app. The combination of these permissions means the app has complete control over the device's security and network connectivity. The user cannot disable these permissions without uninstalling the app. The app is designed to be unremovable without IT intervention. This is a security feature. It prevents users from bypassing the organization's policies. However, it also means the user has no control over their device. This is acceptable in a corporate context, but it can be unsettling for users who are not familiar with enterprise mobility management. The app's permission model is transparent. It requests these permissions during installation. The user must grant them to proceed. This is a clear signal that the app is not a typical consumer app. It is a management tool.

The app does not collect personal data for advertising purposes. The data it collects is related to device management and security. This includes location information, app activity, and other data. The data is encrypted in transit. The app does not share data with third parties. This is stated in the Play Store's data safety section. The app's privacy policy is not explicitly linked, but the developer's contact information is provided. Organizations can request more details. The app's security certifications are notable. It has been approved for RESTRICTED level data in Finland and Difusión Limitada in Spain. It is also certified to NATO Restricted level. These certifications indicate that the app meets high security standards. The app is used by defense and government organizations. This is a testament to its reliability. However, these certifications also mean the app is subject to strict controls. It cannot be modified or customized by end-users. The organization must work within the framework provided by Bittium. This is a limitation, but it is also a strength. The app is predictable and secure.