What is the difference between the Secure Enclave and StrongBox?

Last reviewed 20 October 2026

Both keep cryptographic keys in hardware the main operating system cannot read: the Secure Enclave is Apple’s isolated security subsystem in iPhones, iPads and Macs, and StrongBox is Android’s highest tier of key storage, a secure element with its own CPU and storage, available on some devices running Android 9 or later.

Apple: the Secure Enclave

Apple calls it “a dedicated secure subsystem” that “is isolated from the main processor” and “designed to keep sensitive user data secure even when the Application Processor kernel becomes compromised” (Apple Platform Security). Every recent iPhone has one, so an app can count on it.

Android: TEE and StrongBox

Android keeps keys in one of two places. Most devices use a trusted execution environment (TEE), an isolated mode of the main processor. Some add StrongBox, which Google describes as implementations “in embedded SEs or integrated Secure Enclaves (iSE), providing stronger isolation and tamper resistance compared to the TEE.” A StrongBox implementation must have “its own CPU,” “secure storage” and “a true random-number generator,” among other requirements (Android Keystore).

Why it matters for location

If the app that reports a location can change it, the result proves nothing to anyone else. When the result is signed by a key in secure hardware, a hooked or modified app cannot forge the signature, because it cannot reach the key. The signature protects the result once it is made. Detecting manipulated inputs is a separate job, which Octet does on the device with a statistical proof built from hundreds of inputs. Octet signs every YES and NO in the Secure Enclave on iOS and in the TEE or StrongBox on Android. See device-attested location.