Your workspace, your database, your audit trail.
This page is about how the console protects your workspace and how it records what people did in it. Read the last section too: it says what Mobility is not.
A separate database per customer
Each workspace's data lives in its own database rather than mixed into a shared one with a customer column. When you sign in you see your own fleet and nobody else's, and the separation is structural rather than a filter in a query.
For enterprise and public-sector buyers this is usually the first question, so it is worth saying plainly.
Roles, scoped to device groups
Console logins are yours to create and manage. Roles carry granular permissions, and a role can be restricted to particular device groups, so a regional manager sees only their own sites.
That scope holds everywhere, including in reports: a restricted role's CSV export contains only their devices.
What you can enforce, and what gets written down.
On the device
Screen lock and password rules, factory reset protection, developer options, USB and file transfer, camera and screenshots, Bluetooth and Wi-Fi, network and VPN configuration, CA certificates and managed Wi-Fi networks. Around 70 controls, versioned, inherited down the group tree, each noting the Android version it needs.
On a support session
Whether support can take control at all is a setting. Consent prompts and on-screen session banners are configurable, idle and maximum session limits apply, and every session is recorded: who started it, which device, whether consent was given, how long it ran.
On the workspace
Retention is yours to set. By default the workspace keeps 90 days of device history and 12 months of bandwidth history. Every restart, unenrol, group move, zone crossing and kiosk sign-in is recorded, and all of it exports to CSV.
Mobility is not a security product.
It enforces device policy. It does not defend a device against malware, and we would rather tell you that here than have you find out during a procurement review.
Nothing in Mobility scans for malware or flags suspicious behaviour on a device.
You can block USB transfer and lock a device down. That is policy enforcement, not DLP.
A policy can configure VPN settings on the device. Mobility does not provide the VPN.