Mobile App for Legal Consultations: Audit & 152-FZ

We develop mobile apps for legal consultations where every document and client action goes through an audit trail. A lawyer shares scans with third-party personal data, a client uploads a passport — all this must be protected from leaks and comply with Federal Law No. 152-FZ "On Personal Data". Without proper architecture, such an app becomes a source of regulatory trouble. Our team has solved this for 30+ projects using Flutter with native bridges for iOS and Android.

Technical Challenges We Solve

Document workflow is the main pain point. PDF files on a mobile device need to be safely opened, annotated, and sent back. WKWebView on iOS does not support annotations without third-party libraries — we use native PDFKit (iOS 11+), which processes signatures and marks 2x faster. In Flutter, this required writing a platform channel for bridging.

The second challenge is role-based access. The app serves: client, lawyer, admin, accountant — each sees their own data. Implementing this via Spatie Permissions on the backend and local guards in Flutter is standard, but the cost of error is higher here than in e-commerce.

Chat tied to a case is not just a messenger but correspondence with numbered messages and deletion prohibition. Stream Chat SDK allows making messages immutable via custom message actions, and PDF export for court takes 2-3 seconds. We also add client-side message encryption (AES-256) for extra protection.

How We Protect Client Personal Data

Storage: all files are encrypted on disk via AES-256, keys stored in Keychain (iOS) and KeyStore (Android). Transmission: HTTPS with Let's Encrypt certificates, end-to-end encryption for FCM. The audit trail logs every action: who, when, what data. Logs are written to a separate append-only table. We also implement automatic data deletion on user request (right to erasure).

How We Solve It: Architecture and Stack

Client side: Flutter 3.x (single codebase for iOS and Android), backend: Laravel 10 with REST API and PostgreSQL. For online consultations, we use Daily.co or Agora with session recording — the recording is encrypted and stored on S3, accessible only to participants. Electronic signature: for QES — integration with CryptoPro DSS, for simple — recording IP, time, and email. Notifications via FCM, billing via YooKassa with automatic invoice generation.

Why Flutter Is Optimal for Legal Apps

Flutter allows simultaneous updates on both platforms, critical for complying with App Store Review Guidelines amid frequent legislative changes. Native libraries (PDFKit, CoreData) are bridged via platform channels without performance loss. Example: loading a 10-page signed PDF takes less than 1 second. We also use code generation for data models to avoid serialization errors.

How to Implement a Secure Case-Bound Chat

We use Stream Chat with a custom backend: each message is signed by a server-generated token. The client cannot modify or delete after sending — ensuring integrity. For video consultations, recordings are saved to S3 with role-based access.

Process and Estimated Timelines

For a single lawyer app (booking, chat, documents, payments) — 10 to 16 weeks. An aggregator with lawyer marketplace, CRM, and billing — from 24 weeks. Pricing is case-specific.

What's Included

• Technical specification and architecture diagram
• Source code with comments (GitHub/GitLab)
• Access to App Store Connect and Google Play Console
• Staff training (1-2 online sessions)
• 3 months of technical support
• Operations documentation

The base package also includes automated testing (unit + integration) and CI/CD setup. Each app undergoes a security audit: OWASP Mobile Top 10 check, static analysis (Dart Analyzer, SonarQube).

// Initialize FCM
final fcm = FirebaseMessaging.instance;
await fcm.requestPermission();
final token = await fcm.getToken();
// Send to backend
await api.post('/devices', data: {'token': token});

Our Experience and Guarantees

We have been developing mobile apps for years and launched over 30 apps in the stores. We guarantee compliance with App Store Review Guidelines (Sections 4.2, 5.1) and requirements of 152-FZ. Each app undergoes a security audit during testing.

Contact us to discuss your project — we will tailor the architecture to your practice. Schedule a consultation, and we will show a demo prototype within 2 days.

How to choose cross-platform development: Flutter, React Native, or KMM?

We often work with startups that need two apps—iOS and Android—with a budget for one team. Or corporations that want to release an internal tool in three months on both platforms. Cross-platform development solves a specific economic problem: one codebase instead of two. The question is not 'cross-platform or native'—it's 'which tool for which task.'

Each framework dictates its own stack and imposes limitations. An incorrect choice leads to rewriting the project in six months—we've seen it many times with clients who came to us after a failed first attempt. Therefore, before starting, we conduct an audit of technical requirements and team expertise. With 8+ years of cross-platform experience and 50+ delivered apps, we know the pitfalls firsthand.

The three main players now: Flutter, React Native, and Kotlin Multiplatform Mobile. They solve different problems and are poorly compared head-on. Below, we'll break down how to choose the best option for your project.

How do we choose the technology? 4 steps

1. Requirements analysis — list of native APIs, need for offline work, branded UI or standard.
2. Team assessment — expertise in Dart, JavaScript/Kotlin, availability of an iOS developer.
3. Proof-of-concept — implement a critical scenario on the chosen stack in 2–3 days.
4. Final decision — based on performance benchmarks and maintenance cost.

Case from our practice: a fintech startup needed an MVP on both platforms in 10 weeks. Their team had deep React experience, so we selected React Native. The app passed App Store and Google Play review on the first submission, and they launched on schedule. That choice saved 4 weeks compared to training for Flutter.

Comparison of Flutter and React Native: under the hood

Rendering model

Flutter renders UI independently via the Impeller engine (replaced Skia starting with version 3.10). The platform only provides a canvas—Flutter draws every pixel itself. This means:

• Pixel-perfect on all platforms. The same widget looks identical on iOS and Android—good for branded apps, bad if you need a 'native' look on each platform.
• No dependency on OS version. Material 3 in Flutter works the same on Android 8 and Android 14. System Android components are not involved.
• Platform channels for native code. Access to camera, Bluetooth, NFC—via MethodChannel or EventChannel. flutter_camera, flutter_blue_plus are wrappers over platform channels.

React Native uses native platform components. <View> on iOS is UIView. <Text> is UILabel. This means:

• Native look and feel without extra effort.
• New Architecture (Fabric + TurboModules) with JSI removed the JSON bridge between JS and native code. Synchronous calls work without serialization. This is critical for animations and gestures.
• React Native Reanimated 3 runs worklets on the UI thread—animations at 60/120 fps without blocking the JS thread.

Performance in practice

For most business apps, the performance difference between Flutter and React Native New Architecture is imperceptible. The difference appears in edge cases.

Flutter is slower when interacting with platform APIs via platform channels—each call is asynchronous, with data serialization overhead. google_maps_flutter renders the map via PlatformView—a native UIView/View embedded in the Flutter tree. Before Impeller, this caused performance issues (Hybrid Composition vs Virtual Display). With Impeller, Flutter renders UI 2–3x faster on low-end devices compared to Skia, and PlatformView performance improved by 40%.

React Native is slower in scenarios with heavy JS logic on the main thread. Parsing large JSON, complex computations—these block the JS thread and appear as UI freezes. Solution: Hermes (JS engine optimized for RN) + offloading computations to a native module or react-native-workers. With Hermes, cold start time is reduced by 30–40% compared to JavaScriptCore—that's 2x improvement on older devices.

Ecosystem and maturity

Dart is a barrier to entry for teams with a JS/TS background. It's possible to learn basic Dart in a week, but shifting your mindset to Flutter widgets and widget tree takes longer.

TypeScript in React Native is the de facto standard. A team with React experience becomes productive faster.

When to choose Flutter?

• Need a unified branded UI on all platforms (iOS, Android, Web, Desktop).
• Team is ready for Dart.
• Lots of custom animation and custom UI—Flutter is more predictable.
• The app is not tied to specific native APIs.

When to choose React Native?

• Team has React/TypeScript expertise.
• Need native look and feel.
• Heavy use of native components (Maps, Camera with native capabilities).
• Sharing code with React web via monorepo.

Kotlin Multiplatform Mobile: a different story

KMM solves not a UI problem, but the problem of business logic duplication. The concept: write business logic, networking, caching, validation once in Kotlin. iOS receives a .framework via Kotlin/Native, Android uses the library directly. UI on each platform is native.

// Shared Kotlin code — works on iOS and Android
class UserRepository(
    private val httpClient: HttpClient, // Ktor
    private val database: AppDatabase   // SQLDelight
) {
    suspend fun getUser(id: String): User {
        return database.userQueries.selectById(id).executeAsOneOrNull()
            ?: httpClient.get("$BASE_URL/users/$id").body<User>().also {
                database.userQueries.insert(it)
            }
    }
}

Ktor — HTTP client for KMM (works on iOS via Darwin engine, on Android via OkHttp). SQLDelight generates a typesafe Kotlin API for SQLite, works on both platforms.

Real limitations of KMM

Coroutines on iOS: suspend functions from shared code are called through automatically generated wrappers. SKIE (Swift/Kotlin Interface Enhancer) from Touchlab significantly improves the Swift interface: async/await instead of callbacks, AsyncStream for Flow. Without SKIE, working with coroutines from Swift is inconvenient.

Compose Multiplatform: JetBrains is developing Compose for iOS — UI in Compose works on iOS via Metal. This blurs the line with Flutter: one Compose code for both platforms. Status today: Beta, with early adopters in production (Touchlab, JetBrains own products), but stability is lower than Flutter.

Complexity of iOS integration: XCFramework from KMM module is added to an Xcode project. SPM integration exists and works. But iOS developers must understand the Kotlin API and memory management rules via Kotlin/Native (ARC + Kotlin GC work together, which is not always obvious).

When KMM is justified

The company already has mature iOS and Android teams that duplicate business logic. Switching everything to Flutter or React Native is too radical. KMM allows starting small: extract networking and models into shared code, keep UI native. Gradual migration without rewriting everything.

Typical mistakes in technology selection

Choosing Flutter "because it's a single codebase" for an app heavily reliant on native APIs (custom camera, BLE, background processing). Implementing these via platform channels adds complexity that eats up the development speed advantage.

React Native without understanding the JS thread. Heavy operations on the JS thread cause visible freezes. This is solvable, but requires understanding the architecture—otherwise the app will perform worse than native.

KMM without an iOS developer on the team. Shared Kotlin code requires an iOS engineer who integrates the framework into Xcode, writes SwiftUI on top of KMM APIs, and debugs Kotlin/Native crashes.

What is the development process and timeline?

A cross-platform project goes through the same stages as a native one: requirements audit → stack selection → design → development → testing on real devices of both platforms → publication in App Store and Google Play → support.

Testing on real devices is not optional. An emulator does not reproduce memory issues on budget Android phones and does not show differences in gesture behavior on iOS. We test 40+ scenarios on at least 5 real devices covering both OS versions.

Budget savings compared to two native teams can be up to 40–50%. The cost is calculated individually after analyzing the stack and requirements.

What's included in our work

• Technical audit and stack selection for your project.
• Architecture design (clean architecture, MVVM, BLoC/Redux).
• UI development according to design mockups for both platforms.
• Integration of native modules (camera, geolocation, push notifications).
• CI/CD setup (GitHub Actions, Codemagic).
• Testing on real devices (iOS/Android) — at least 40 scenarios.
• Preparation and publication in App Store and Google Play following guidelines (App Store Review, Google Play Policy).
• Technical support for 3 months after launch.
• Handover of source code, documentation, and access — all turnkey.

We'll evaluate your project in one day—get a consultation on stack selection. Order turnkey development and receive a cross-platform app within the agreed timeline, backed by our experience and guaranteed milestones.