I have a project I'm involved in which needs to distribute a mobile app to a specific audience. Due to regulatory restrictions in the target market, only this audience is allowed to access the data within the app yet it will be served from public app stores (multiple platforms are targeted).
I'm looking for thoughts on an authorisation method which is not dependent on a back end service such as a registration facility. All the data in the app is self-contained and once the app is downloaded there's no expectation (and in many cases, no facility) for internet connectivity.
One option would be a single "unlock" code that could be provided to target recipients of the app but there's a concern that if this was redistributed it would obviously circumvent the access control for anyone who obtained the code. Of course there's also the risk that any code contained within the app could be reverse engineered but then again, so could the data which we're trying to protect in the first place.
Ultimately I need to find a balance here between security and practicality. The data being protected is not commercially sensitive rather the access controls are due to regulatory obligations so the requirement to protect it is more about implementing "sufficient measures" rather than aiming for bulletproof.
Can anyone share some ideas on how the app may be served from a public app store and unlocked without the risk of a single secret such as a pass code being redistributed?