1. A method comprising: receiving, by a mobile device, a managed application from an application server during a first communication, the managed application being constructed to operate in accordance with a set of one or more policy files defined independently of the managed application; receiving, by the mobile device, the set of one or more policy files from the application server during a second communication different from the first communication, the set of one or more policy files being stored on the mobile device separately from the managed application; receiving, by the mobile device, a custom secure sockets layer (SSL) library that is different from an SSL library of an operating system of the mobile device; installing, by the mobile device, the custom SSL library on the mobile device; determining a geographic location of the system; running the managed application on the mobile device in accordance with policies defined in the set of one or more policy files that is stored on the mobile device separately from the managed application; and determining, based on the policies defined in the set of one or more policy files that is stored on the mobile device separately from the managed application, that the geographic location of the system is within an unauthorized geographical zone, wherein the policies defined in the set of one or more policy files, when applied to the managed application while the geographic location of the system is within the unauthorized geographical zone, cause the managed application to restrict a data-sharing feature otherwise made available on the mobile device while the geographic location of the system is not within the unauthorized geographical zone, and wherein the policies defined in the set of one or more policy files cause the managed application to create a secure application tunnel using the custom SSL library on the mobile device in place of the SSL library of the operating system of the mobile device.