01 · The Problem
MNO subsidy economics depend on one assumption: the subsidized device stays with the subsidizing carrier through the contractual lock period, or the subsidy is recovered. In practice, the assumption breaks on multiple fronts. Factory reset clears software-level subsidy locks within minutes. SIM swap defeats phone-number-based enforcement. Recovery mode bypasses any DPC installed as profile owner rather than device owner. Subsidy clawback collection through legacy MDMs requires manual intervention per device and rarely succeeds at scale.
Carrier subsidy economics depend on retention of subsidized devices through the contract period; recovery failures translate to operating losses at scale. The math improves only if the device control is reset-resistant, the SIM lock survives operator transitions, and the integration with the carrier's billing and CRM systems supports automated recovery workflows rather than case-by-case manual enforcement.
02 · Lockia's Approach
Reset-resistant SIM control. Cipher Protocol enforces SIM lock state at a hardware-anchored layer rather than software-only. Factory reset, SIM swap, and recovery-mode attempts do not clear the carrier lock. The subsidy survives the device-state transitions that defeat conventional approaches.
Multi-operator transition handling. Subsidies frequently outlive the customer's relationship with the original carrier. Lockia's policy plane supports operator-to-operator handoff workflows where one carrier's subsidy lock persists across MVNO transitions, secondary-market resale, and cross-border roaming — without requiring the device to come offline.
Billing and CRM integration. Lock state is driven by your billing system, not by Lockia's. Lockia's webhook architecture accepts standard carrier-billing-platform event formats. Integration is API-driven on the operator's side. CRM-side workflow routes subsidy clawback escalations into the carrier's existing collections process.
For iOS, Lockia operates Cipher MDM in your deployment region — no third-party MDM SaaS in your data path. Your Apple Business Manager tenant federates with the Lockia-operated MDM. APNs is mandatory infrastructure for any iOS MDM; what is removed is the additional layer of third-party MDM SaaS between the carrier and Apple. For Android, Cipher DPC runs on any Android Enterprise–capable handset, including the entry-level smartphones that dominate prepaid subsidy programs.
03 · How It Works
For carriers running zero-touch provisioning at the OEM partner stage, no QR enrollment or end-user setup is required. The customer receives a sealed device that is already Cipher-enrolled and subsidy-locked — important for entry-level prepaid segments where customer self-service capacity is limited.
Pre-provisioning
Cipher Protocol activates at the OEM partner channel or carrier distribution warehouse, before the device reaches retail. No QR enrollment required at the point of sale.
Subsidy contract creation
Carrier billing system creates the subsidy contract. Webhook to Lockia backend establishes subsidy lock policy bound to subscriber identity.
Customer activation
Customer activates the device. Cipher Protocol authenticates against the assigned carrier identity and enforces subsidy lock state per contract terms.
Lifecycle sync
Payment status, plan changes, and operator transitions sync via webhook throughout the subsidy term. Lock state adjusts automatically without manual intervention.
Contract resolution
Contract complete: subsidy unlock command. Contract breached: progressive escalation through configurable enforcement levels.
04 · Compared To
Architectural facts, not marketing claims. Trustonic is a Google DLC certified integrator focused on Android. Knox Configure is Samsung-only, Samsung-operated. Google DLC is Google's certified-partner program. The comparison reflects what each vendor builds, not how each vendor positions.
| Lockia | Trustonic | Knox Configure | Google DLC | |
|---|---|---|---|---|
| Architecture | Sovereign UEM (AOSP DPC + Lockia-operated MDM, in your deployment region) | Google DLC certified integrator | Samsung Knox (Samsung-only) | Google partner program |
| OEM coverage | All Android Enterprise OEMs + iOS via ABM | Google DLC partner-certified devices | Samsung handsets only | Google-certified devices only |
| Reset resistance | Multi-layer AOSP + TEE (patent-pending) | TEE-anchored (Trustonic TEE) | Samsung Knox (TEE-anchored) | Google DPC (varies by partner) |
| SIM control | TEE-anchored SIM lock | TEE-anchored | Samsung Knox (TEE-anchored) | Software-level (varies) |
| Billing integration | Webhook + REST API compatible with standard carrier-billing-platform formats | Limited (Trustonic-managed) | Limited (Samsung-managed) | Per integrator |
| Customer data path | Lockia-operated, in your deployment region | Trustonic cloud + Google | Samsung cloud | Google + certified integrator cloud |
05 · Who this is for
Lockia's architecture is designed for MNO and MVNO subsidy-protection contexts: reset-resistant device control across the subsidy lifecycle, graduated enforcement workflows compatible with consumer-protection constraints, and cross-border subsidy enforcement for operators with multi-country footprints. We are currently in conversations with operators in LATAM and adjacent regions.
06 · One of Many
Carrier subsidy protection is one policy configuration of Lockia's enforcement layer. The same Cipher Protocol, the same Lockia-operated MDM, the same AOSP DPC. What differs is the integration partner (carrier billing and CRM rather than retail BNPL platforms) and the policy granularity (subsidy lifecycle states rather than installment payment states).
For an operator considering the platform: the architectural commitment is the same whether you start with subsidy protection or expand into device financing for postpaid contracts. One platform, multiple operational workflows. The expansion path does not require a second vendor procurement, a second integration cycle, or a second policy plane.