A method, comprising: configuring a private secure container and a shared secure container on a mobile device, wherein the private secure container and the shared secure container each is a logical interface into which data is read from and written to in an encrypted form, wherein the private secure container is private to a managed application of the mobile device, and wherein the shared secure container is shared with at least one other managed application of the mobile device; configuring, based on policy information, an interception layer on the mobile device such that calls from the managed application are intercepted and redirected to an appropriate secure container; intercepting, by the interception layer of the mobile device, a read or write operation from the managed application while the managed application is executing on the mobile device; determining, based on the policy information and a type of data to be read or written by the read or write operation, whether to redirect the read or write operation to the private secure container or the shared secure container; redirecting, based on the determining, the read or write operation to the private secure container or the shared secure container; monitoring one or more operating conditions of the mobile device; determining, based on the one or more operating conditions to perform a selective wipe of data associated with the managed application; deleting encrypted data from at least one of the private secure container or the shared secure container; and transmitting a selective wipe acknowledgement to an access gateway, wherein the acknowledgement includes a listing of which containers included data that was deleted during the selective wipe. configuring a private secure container and a shared secure container on a mobile device, wherein the private secure container and the shared secure container each is a logical interface into which data is read from and written to in an encrypted form, wherein the private secure container is private to a managed application of the mobile device, and wherein the shared secure container is shared with at least one other managed application of the mobile device; configuring, based on policy information, an interception layer on the mobile device such that calls from the managed application are intercepted and redirected to an appropriate secure container; intercepting, by the interception layer of the mobile device, a read or write operation from the managed application while the managed application is executing on the mobile device; determining, based on the policy information and a type of data to be read or written by the read or write operation, whether to redirect the read or write operation to the private secure container or the shared secure container; redirecting, based on the determining, the read or write operation to the private secure container or the shared secure container; monitoring one or more operating conditions of the mobile device; determining, based on the one or more operating conditions to perform a selective wipe of data associated with the managed application; deleting encrypted data from at least one of the private secure container or the shared secure container; and transmitting a selective wipe acknowledgement to an access gateway,