I hope somebody from Mendix can elaborate on this if my info in not correct. Authentication should be with the mobile pin sollution. As far as I know this also works offline. Furthermore as far as I know is the local SQLite database in its own encrypted container. That would make tampering not impossible but very very hard to do.
Again I hope that somebody from Mendix will correct me if I am wrong.
Regards,
Ronald