Device fleets are usually managed with Intune, Jamf or Hexnode, and in most cases that is the right call. We built a self-hosted MDM not because the ready-made ones are bad, but because for our profile they all run into the same limitation.
The limitation that forced a custom build
A classic MDM is the vendor’s cloud. The agent on the device talks to someone else’s SaaS continuously, and the inventory goes there too: which devices exist, who holds them, with what software and in what state. For a company whose business is information security, that means the map of its own fleet lives with a third-party supplier.
Four requirements followed, and the system was built around them:
- Self-hosted MDM only. The server and all data stay inside the customer’s perimeter. Devices do not call home to anyone’s cloud.
- Open code. You can see what the agent actually does on the device. This is not an ideological point: an MDM agent runs with maximum privilege, and trusting it blindly is a risk of its own.
- No vendor telemetry and no per-seat subscription. There is no outbound telemetry and no licensing by device count.
- Part of one Zero Trust perimeter rather than a separate island: it integrates with the SIEM, the VPN, hardware keys and shared access policies.
Functionally the self-hosted MDM holds no surprises: centralised management of Android, iOS, Windows and macOS, security policies and restrictions, app installation and removal, update control, device state monitoring, roles and groups, activity reports. Nothing exotic, because here exotic would be a defect.
Why we deliberately do not build DLP
We have no dedicated content DLP, and that is a decision rather than a gap in the roadmap.
Part of what DLP is bought for is covered without it: control of removable media and ports, disk encryption, action auditing through the SIEM, and control of user actions. That delivers visibility and deterrence, which is the usual reason for the purchase in the first place.
Automatic analysis of the content of employees’ work is a different matter, and we avoid it on purpose. Such a system by construction gains access to everything people write and open, which makes it the single most valuable target in the infrastructure: compromise it and an attacker gets not one document but the whole stream. For a company of our profile, that risk outweighs the benefit.
If classic content DLP is genuinely needed, it is a separate class of system with mature products on the market. Cloning them makes no sense, and saying so plainly is more honest than pretending the requirement is covered.
Employee monitoring: where the line runs
The self-hosted MDM can observe user actions, and it is used where a business genuinely has that need. But this is a case where technical availability of a feature is not the same as the right to switch it on.
- Employees must know that monitoring happens and in what scope. Covert monitoring is not stricter, it is legally risky and corrosive to trust inside a team.
- The volume collected should follow the task, not the technical ceiling. Collecting everything just in case means building yourself a store that then has to be defended.
- Requirements for this kind of observation differ sharply between jurisdictions, which makes it a question for a lawyer rather than an administrator.
What happens on implementation
We are not a box shop: this MDM was built for our own workload and our clients’ workloads, not as a product on a shelf. So on implementation the customer receives a separate fork, with all sources on their side and fully theirs, with no supplier lock-in. Both paths stay open after that: develop it in-house, or leave support and development with us.
The approach to perimeter separation referred to here is covered in more detail in the piece on Zero Trust in practice.
Frequently Asked Questions
How does a self-hosted MDM differ from Intune or Jamf? It is self-hosted with open code, no telemetry and no per-seat fee, and it is built into one perimeter with the SIEM, VPN and hardware keys.
Why no content DLP? A deliberate refusal: such a system sees the entire stream of employees’ work and becomes the primary target itself.
Does supplier dependency remain? No. The customer gets a separate fork with all sources on their side.
Can employee actions be monitored? Technically yes, but scope follows the task, employees must know, and the rules depend on jurisdiction.
Need a Consultation?
If you are choosing between a ready-made MDM and a custom one, book a free 15-minute call. We will go through your requirements and say plainly when an off-the-shelf product is enough.
