A mobile computing apparatus comprising a processor, wherein the processor is configured to: maintain a plurality of virtual execution environments; determine context meta-data for the plurality of virtual execution environments; collect current contextual information for the computing apparatus; and activate one or more of the plurality of virtual execution environments based on the collected current contextual information and the context meta-data, characterized in that the processor is configured to: determine the context meta-data for the plurality of virtual execution environments by determining a plurality of environment meta-data, wherein each environment meta- data in the plurality of environment meta-data is associated with a corresponding virtual execution environment in the plurality of virtual execution environments, wherein the environment meta-data comprises corporate IT security policies and a user's working location, wherein the processor is configured to automatically update the environment meta-data based on a corporate database; and prevent access to particular virtual execution environments used to run secure device applications by controlling the state of the individual virtual execution environments (104-1, 104-2, 104-3, 104-n), when the mobile computing apparatus is detected as being outside a predefined set of office locations based on the current contextual information and the context meta-data, wherein the current contextual information comprises the device's geographical location. maintain a plurality of virtual execution environments; determine context meta-data for the plurality of virtual execution environments; collect current contextual information for the computing apparatus; and activate one or more of the plurality of virtual execution environments based on the collected current contextual information and the context meta-data, characterized in that the processor is configured to: determine the context meta-data for the plurality of virtual execution environments by determining a plurality of environment meta-data, wherein each environment meta- data in the plurality of environment meta-data is associated with a corresponding virtual execution environment in the plurality of virtual execution environments, wherein the environment meta-data comprises corporate IT security policies and a user's working location, wherein the processor is configured to automatically update the environment meta-data based on a corporate database; and prevent access to particular virtual execution environments used to run secure device applications by controlling the state of the individual virtual execution environments (104-1, 104-2, 104-3, 104-n), when the mobile computing apparatus is detected as being outside a predefined set of office locations based on the current contextual information and the context meta-data, wherein the current contextual information comprises the device's geographical location. determine the context meta-data for the plurality of virtual execution environments by determining a plurality of environment meta-data, wherein each environment meta- data in the plurality of environment meta-data is associated with a corresponding virtual execution environment in the plurality of virtual execution environments, wherein the environment meta-data comprises corporate IT security policies and a user's working location, wherein the processor is configured to automatically update the environment meta-data based on a corporate database; and prevent access to particular virtual execution environments used to run secure device applications by controlling the state of the individual virtual execution environments (104-1, 104-2, 104-3, 104-n), when the mobile computing apparatus is detected as being outside a predefined set of office locations based on the current contextual information and the context meta-data, wherein the current contextual information comprises the device's geographical location.