We develop mobile apps for legal consultations where every document and client action goes through an audit trail. A lawyer shares scans with third-party personal data, a client uploads a passport — all this must be protected from leaks and comply with Federal Law No. 152-FZ "On Personal Data". Without proper architecture, such an app becomes a source of regulatory trouble. Our team has solved this for 30+ projects using Flutter with native bridges for iOS and Android.
Technical Challenges We Solve
Document workflow is the main pain point. PDF files on a mobile device need to be safely opened, annotated, and sent back. WKWebView on iOS does not support annotations without third-party libraries — we use native PDFKit (iOS 11+), which processes signatures and marks 2x faster. In Flutter, this required writing a platform channel for bridging.
The second challenge is role-based access. The app serves: client, lawyer, admin, accountant — each sees their own data. Implementing this via Spatie Permissions on the backend and local guards in Flutter is standard, but the cost of error is higher here than in e-commerce.
Chat tied to a case is not just a messenger but correspondence with numbered messages and deletion prohibition. Stream Chat SDK allows making messages immutable via custom message actions, and PDF export for court takes 2-3 seconds. We also add client-side message encryption (AES-256) for extra protection.
How We Protect Client Personal Data
Storage: all files are encrypted on disk via AES-256, keys stored in Keychain (iOS) and KeyStore (Android). Transmission: HTTPS with Let's Encrypt certificates, end-to-end encryption for FCM. The audit trail logs every action: who, when, what data. Logs are written to a separate append-only table. We also implement automatic data deletion on user request (right to erasure).
How We Solve It: Architecture and Stack
Client side: Flutter 3.x (single codebase for iOS and Android), backend: Laravel 10 with REST API and PostgreSQL. For online consultations, we use Daily.co or Agora with session recording — the recording is encrypted and stored on S3, accessible only to participants. Electronic signature: for QES — integration with CryptoPro DSS, for simple — recording IP, time, and email. Notifications via FCM, billing via YooKassa with automatic invoice generation.
Why Flutter Is Optimal for Legal Apps
Flutter allows simultaneous updates on both platforms, critical for complying with App Store Review Guidelines amid frequent legislative changes. Native libraries (PDFKit, CoreData) are bridged via platform channels without performance loss. Example: loading a 10-page signed PDF takes less than 1 second. We also use code generation for data models to avoid serialization errors.
How to Implement a Secure Case-Bound Chat
We use Stream Chat with a custom backend: each message is signed by a server-generated token. The client cannot modify or delete after sending — ensuring integrity. For video consultations, recordings are saved to S3 with role-based access.
Process and Estimated Timelines
| Stage | Duration | Deliverable |
|---|---|---|
| Analysis and Specification | 1-2 weeks | Role, data flow, integration specs |
| Design (UX/UI) | 2-3 weeks | Figma mockups with client approval |
| Development | 6-12 weeks | Production code, CI/CD, test environment |
| Load Testing | 1 week | Performance report |
| Publishing (App Store + Google Play) | 1-2 weeks | Live app |
| Support (3 months) | — | Monitoring, fixes, updates |
For a single lawyer app (booking, chat, documents, payments) — 10 to 16 weeks. An aggregator with lawyer marketplace, CRM, and billing — from 24 weeks. Pricing is case-specific.
What's Included
- Technical specification and architecture diagram
- Source code with comments (GitHub/GitLab)
- Access to App Store Connect and Google Play Console
- Staff training (1-2 online sessions)
- 3 months of technical support
- Operations documentation
The base package also includes automated testing (unit + integration) and CI/CD setup. Each app undergoes a security audit: OWASP Mobile Top 10 check, static analysis (Dart Analyzer, SonarQube).
Notification configuration example
// Initialize FCM final fcm = FirebaseMessaging.instance; await fcm.requestPermission(); final token = await fcm.getToken(); // Send to backend await api.post('/devices', data: {'token': token}); Our Experience and Guarantees
We have been developing mobile apps for years and launched over 30 apps in the stores. We guarantee compliance with App Store Review Guidelines (Sections 4.2, 5.1) and requirements of 152-FZ. Each app undergoes a security audit during testing.
Contact us to discuss your project — we will tailor the architecture to your practice. Schedule a consultation, and we will show a demo prototype within 2 days.