com.samsung.knox.securefolder Copy

Secure Folder, made by Samsung and built on the Knox platform. It gives the user a private, encrypted area of the device for apps, photos and files that is unlocked separately with a PIN, pattern, password or biometric. Rather than being a simple folder, it is implemented as an additional Android user profile alongside the primary user, which is why a device with both a work profile and Secure Folder reports several profiles at once. In our sample it is Samsung-signed and appears only on Samsung devices, across API levels 28 to 37. Version note: Secure Folder was implemented as a work-profile type profile from its introduction, and reporting in 2025 showed that some system components, including the photo picker and permission controller, therefore treated it as an ordinary work profile and could reveal which apps and photos it held. Samsung addressed this in One UI 8 by reclassifying Secure Folder as a private profile, the profile type Android 15 introduced for Private Space, though the reporting notes that the protection only applies when the user fully hides Secure Folder rather than merely closing it. Behaviour therefore differs between One UI 8 and earlier releases, and our sample records the package holding ACCESS_HIDDEN_PROFILES_FULL, which is consistent with the newer private-profile handling. For Android Enterprise, EMM and kiosk fleets the important point is that Samsung documents Secure Folder as incompatible with Android Enterprise deployments and not accessible on company-owned devices, so it is not a substitute for a work profile and is not managed through your EMM. It is a personal-use feature, so leaving it in place on a corporate device offers no management benefit, but disabling or removing it on a device where somebody has already used it puts their data out of reach, so treat any change with care and warn users first.

• Secure Folder isn't available on a device | Knox Platform for Enterprise | Samsung Knox Documentation →
• What is Private Space in Android 15, and how can organisations manage it? →
• Samsung fixes the Secure Folder flaw that let anyone see what apps you're hiding - Android Authority →
• Package provenance for com.samsung.knox.securefolder - Android System App Database →

• Signed by the device maker's own signing key (Samsung), so it is an OEM preinstall, and that single certificate is consistent across all 22 device profiles. It also signs the Android framework, so it is a platform-level key on its device(s). Inferred from the certificate appearing only on Samsung devices (580 packages, 11729 observations).
• Its largest observed manifest declares 91 permissions: 8 runtime (user-granted), 30 signature or system-level, 13 install-time and 40 vendor or uncatalogued.
• Reported as an updated system app in 5 of 36 observations - a newer build was installed over the one in the system image. Multiple observations can come from the same device profile.