NBFC
No trusted device, no access: OpenIY MDM powers Zero Trust for a lending business
Financial Services — Non-Banking Financial Company (NBFC). OpenIY MDM (unified endpoint management), device posture & compliance enforcement, Zero Trust access, identity integration, and secure application proxy.
BUSINESS REQUIREMENT
What the client needed
Our client — a fast-growing non-banking financial company — runs a distributed workforce on a mixed fleet of iOS, Android, Windows, and Linux devices, all touching sensitive customer and lending data. In a regulated financial environment, that raises a question every audit eventually asks: can you prove that only compliant, healthy devices are reaching your internal applications? Before this engagement, the honest answer was no.
WHAT WE FOUND
Findings on the ground
- No proof of device health at access time: In a regulated financial environment, every audit eventually asks: can you prove that only compliant, healthy devices are reaching your internal applications? Before this engagement, the honest answer was no.
- Inconsistent enrollment across platforms: Device enrollment was inconsistent across iOS, Android, Windows, and Linux — with no unified view of encryption status or policy adherence.
- Applications blind to device posture: Internal applications had no way of knowing whether the device on the other end was managed, patched, and compliant — or a personal laptop on a coffee-shop network.
- Compliance as documents, not enforcement: Compliance existed as policy documents; nothing on the network actually enforced it.
WHAT WE DID
The engineering response
Mekosha Technologies designed and delivered a Zero Trust access layer built on OpenIY MDM — our unified endpoint management platform — deployed first in a fully provisioned staging environment, validated through formal UAT, and taken to production with disaster-recovery testing completed before rollout. By putting posture confirmation in the access path itself, the client moved from trusting the network to verifying the device, every time.
- Device posture confirmation at the point of access: Every request to an internal application is evaluated against the device's live compliance posture — reported by OpenIY MDM — before it is allowed through. Encryption enabled? OS version within policy? Device enrolled and attributable to a known user? The access proxy checks, decides, and logs — in real time. A non-compliant device doesn't get a warning banner; it doesn't get in.
- Deterministic enrollment across every platform: Zero-touch and self-service enrollment flows for iOS, Android, and Windows, bound to the client's Active Directory over secure LDAPS — so every device in the OpenIY MDM console is tied to a real identity, with model, OS version, and profile attributes populated automatically.
- Policy enforcement that holds up on the device: Unauthorized applications blocked and the attempts logged. Work and personal data separated, with cross-profile sharing restricted by policy. Unencrypted devices flagged and restricted until encryption is applied. A private managed app store for the organization's own applications.
- Audit-grade evidence, built in: Every posture decision is captured with timestamp, actor, device ID, and the reason for the decision — flowing into live dashboards and exportable reports. When the regulator or an auditor asks "show me," the answer is a report, not a reconstruction.
- Production readiness proven, not assumed: The rollout followed a milestone-gated path: staging validation, proxy and posture testing against compliant and non-compliant scenarios, formal business UAT sign-off, and a disaster-recovery runbook with defined RTO/RPO — exercised before cutover, not after an incident.
OUTCOMES
What changed
Access to internal applications is now conditional on live device posture
the single control that converts a compliance policy binder into enforced reality.
Every device, every platform, one OpenIY MDM console
iOS, Android, Windows, and Linux endpoints enrolled, identity-bound, and visible with real-time compliance state.
Data loss vectors closed at the device
Data loss vectors closed at the device: unauthorized apps blocked, work-to-personal data movement restricted, unencrypted storage flagged and quarantined.
A complete, exportable audit trail of who accessed what, from which device, and why the platform allowed or denied it
ready for regulatory and internal audit on demand.
DR-tested production rollout with runbooks, monitoring, and alerting handed over to the client's teams
resilience validated before day one, not discovered on a bad day.
RELATED STORIES
One management plane for every endpoint — OpenIY MDM security programme
OpenIY MDM as the management plane for a regulated NBFC — five platforms, provable policy enforcement, and the trust anchor for patch, identity, and Zero Trust access.
Read the case study →From paper logs to a connected factory
Four SMT lines on a unified Industrial IoT platform — live OEE, QR lot-to-board traceability, station interlocks, and SAP integration.
Read the case study →Bring us a line, a fleet, or an audit finding. We'll bring the architecture.
A discovery workshop with our solutions engineers — your assets on a whiteboard, no generic pitch deck.