Your mobile program,
ATO-capable on day one.

Platform-limitation controls (5)

• C1 Screenshot prevention (Web): a CUI-marker overlay, CSP frame-ancestors 'none', and a visibilitychange audit event compensate for the browser's lack of a FLAG_SECURE equivalent.
• C2 Clipboard clearing (iOS): the pasteboard is cleared on sign-out and background transition via public API; content the platform puts out of reach (a suspended app, other apps' writes) is covered by a user notice and the documented residual risk.
• C3 Copy/cut suppression (iOS): a UIViewRepresentable wrapper attempts best-effort menu suppression on CUI text fields, backed by a CUI banner and a client-side audit event on detectable copy attempts.
• C4 Code obfuscation (iOS): release-build symbol stripping (STRIP_INSTALLED_PRODUCT, DEPLOYMENT_POSTPROCESSING) compensates for the absence of an R8/ProGuard equivalent on Swift; adopters with elevated threat models layer commercial obfuscation.
• C5 Certificate pinning (Web): HSTS preload, Expect-CT reporting, optional mTLS on the BFF-to-API leg, and SRI on third-party CDN assets compensate for the browser CA-store model that makes client-side cert pinning infeasible.

Crypto and FIPS scope (4)

• C11 Browser crypto FIPS scope: all FIPS-scope cryptography is handled server-side in the BFF and API tier; the browser performs only non-security-critical operations (file deduplication hashing) that are never authoritative identity or integrity signals.
• C12 ChaCha20-Poly1305 cipher: the API tier disables ChaCha20-Poly1305 at TLS termination via API Gateway and ALB cipher-suite policy, so FIPS-boundary connections negotiate AES-256-GCM only.
• C13 Argon2id pre-standardization: Argon2id is deployed under explicit compensating-control acceptance pending NIST SP 800-132 Rev 1 finalization; legacy PBKDF2 entries retire within 12 months of adoption.
• C14 OpenSSL FIPS 140-2 sunset: the API tier is tracked against CMVP status monthly with a remediation plan to migrate to an OpenSSL version carrying an active FIPS 140-3 validation before the 2026-09-21 sunset date.

Supply chain and policy (4)

• C6 Crash/RUM SDK exclusion: a built-in minimal crash handler with a Vallark-owned ingest endpoint compensates for the intentional exclusion of closed-source third-party crash and RUM SDKs from the supply chain.
• C8 CVSS exceptions: each Critical or High CVE that cannot be patched within SLO receives a row in the CVSS exceptions sub-table with a mandatory expiration date; CI fails when an expiration passes without resolution.
• C9 Android secure-defaults overrides: each allowBackup=true or exported=true override receives a per-component entry in the Android secure-defaults overrides sub-table with an explicit STIG justification and scope limitation.
• C10 Provisioned-concurrency (low-DAU): for programs below 100 DAU, an SLO downgrade accepting cold-start tail latency on attestation and auth endpoints compensates for provisioned-concurrency cost being infeasible.

Accessibility and operational (3)

• C7 Assistive-technology audio (Section 508): a configurable CUI warning modal on first AT-detected use and environment-tunable policy text compensate for the legal prohibition on disabling screen-reader output for assistive-technology users.
• C15 Attestation log-only (Phase 1): during the first 2-4 weeks per adopter, attestation runs in log-only mode; every attempt and verdict is captured in the immutable audit stream and reviewed weekly before escalating to Phase 2 (soft enforcement) and Phase 3 (hard enforcement).
• C16 Break-glass self-approval at N=1: every self-granted break-glass event emits a self_grant_declaration meta-event; post-facto ISSO review occurs within tier-specified windows; a frequency cap of four self-grants per month at the two highest break-glass tiers triggers the move to a three-person approval triad before break-glass becomes routine.