1. A mobile device comprising computer-readable storage and at least one processor configured to execute computer-executable code stored on the computer-readable storage, the mobile device comprising: a secure container component installed on the computer-readable storage of the mobile device, the installed secure container component implemented by computer executable code stored on the computer-readable storage of the mobile device to create a secure document container on the computer-readable storage, the secure document container comprising a file system for a first portion of the computer-readable storage, the secure document container being encrypted, the secure document container storing first enterprise data of an enterprise, the first enterprise data including at least one enterprise document; a second portion of the computer-readable storage of the mobile device, the second portion of the computer-readable storage storing private data of a user of the mobile device, the private data associated with activity of the user that is outside of a role of the user in the enterprise, the second portion of the computer-readable storage being unencrypted, the first portion of the computer-readable storage being logically separate from the second portion of the computer-readable storage, wherein the first enterprise data in the secure document container is logically separate from the private data in the second portion of the computer-readable storage; an access manager implemented by computer-executable code stored on the computer-readable storage of the mobile device that limits access to the file system for the first portion of the computer-readable storage based on one or more document-access policies that restrict availability of the first enterprise data stored in the secure document container, wherein a non-enterprise application not associated with the enterprise is prevented from accessing the first enterprise data stored in the secure document container; and a secure virtual machine implemented by computer-executable code stored on the computer-readable storage of the mobile device, wherein an enterprise application associated with the enterprise and running in the secure virtual machine is configured to access the first enterprise data stored in the secure document container, wherein the first enterprise data is only accessible by the enterprise application associated with the enterprise after the enterprise application receives correct user credentials from the user, and wherein the document-access policies prevent a second enterprise document from being saved in the secure document container, wherein the second enterprise document is available for viewing on the mobile device only when the mobile device is connected to a system of the enterprise.