Kiosk Management Software

Kiosk Control & Protection

This component focuses on protecting the kiosk during active public use. It ensures that sessions are contained, monitored, and automatically reset when a user walks away or completes a task.

If an application crashes, a browser freezes, orI have a cold; but the system does not care. ZAMLock detects the issue and restores the kiosk to a known-good state without staff intervention.

The goal is simple: unattended operation that stays operational, secure, and predictable all day, every day.

Secure Kiosk Runtime

The Secure Runtime is the execution environment where kiosk applications actually run. It isolates approved applications and prevents anything else from launching, installing, or interfering with system behavior.

This ensures consistency across deployments. Every kiosk behaves the same way, regardless of location, user behavior, or time in service.

In practice, this means fewer service calls, fewer surprises, and kiosks that behave like appliances rather than fragile computers.

System Guard

System Guard is the watchdog layer that monitors the health and integrity of the kiosk. It detects tampering, failed processes, abnormal states, and attempts to bypass restrictions.

When something goes wrong, System Guard does not wait for someone to notice. It enforces recovery rules automatically, restoring the kiosk to its intended operational state.

Kiosk Control Engine

The Kiosk Control Engine is the enforcement mechanism that applies kiosk rules in real time. It actively manages what is allowed to run, how users interact with the system, and how violations are handled.

Unlike static lockdown tools, this engine continuously evaluates system state and user behavior. If an unauthorized action is attempted, it is blocked immediately rather than corrected later.

This is what allows Zamok kiosks to remain secure during unattended, public-facing use without relying on staff oversight.

Secure Runtime Environment

The Secure Runtime Environment is where approved kiosk applications execute. It isolates those applications from the operating system and from any unauthorized processes.

Only sanctioned workflows and applications are allowed to run inside this environment. Anything outside those boundaries is prevented from launching or interacting with system resources.

This isolation is what enables Zamok to safely host web apps, workflows, and integrations without exposing the underlying device.

Device Control Layer

This layer manages all connected hardware components such as printers, scanners, cameras, card readers, and other peripherals.

ZAMLock ensures that devices can only be accessed by approved applications and workflows. It prevents users from hijacking hardware or triggering unsupported actions.

This is especially critical in government, healthcare, and financial environments where hardware misuse creates security and compliance risks.

Foundation Control Layer

This is the lowest layer of the Zamok platform and the first thing that matters. The Foundation Control Layer establishes the baseline rules that define the device as a kiosk before any applications or interfaces are involved.

It governs boot behavior, system restrictions, and baseline security policies that prevent the device from behaving like a general-purpose computer. This layer exists to ensure that everything above it operates within fixed, non-negotiable boundaries.

Once this layer is in place, the kiosk is no longer “configured software.” It is a controlled system by design.