We develop mobile applications for legal consultations, where every document and client action undergo an audit trail.
A lawyer sends the client scans containing personal data of third parties, the client uploads a passport — all of this must be protected from leaks and comply with 152-FZ Federal Law No. 152-FZ "On Personal Data".
Without the right architecture, such an application becomes a source of problems with the regulator. Our team has solved this task for 30+ projects, using Flutter with native bridges for iOS and Android.
Technical challenges encountered during development
Document workflow — the main pain point. PDF files on a mobile device need to be not just downloaded, but securely opened, annotated, and sent back.
WKWebView on iOS does not support annotations without third-party libraries — we use native PDFKit (iOS 11+), which handles signatures and markup 2 times faster. In Flutter, this required writing a platform channel for bridging.
The second problem is the role model. The application involves: client, lawyer, administrator, accountant — each sees their own set of data.
Implementation via Spatie Permissions on the backend and local guards in Flutter is standard, but the cost of an error here is higher than in e-commerce.
Case-linked chat is not just a messenger, but a correspondence with message numbering and a prohibition on deletion. Stream Chat SDK allows making messages immutable through custom message actions, and export to PDF for court takes 2-3 seconds. We also add client-side message encryption (AES-256) for additional protection.
How do we protect clients' personal data?
Storage: all files are encrypted on disk using AES-256, keys are stored in Keychain (iOS) and KeyStore (Android). Transmission: HTTPS with Let's Encrypt certificates, for FCM we use end-to-end encryption. An audit trail records every action: who, when, what data.
Logs are written to a separate table with append-only access. We also implement automatic data deletion upon user request (right to be forgotten).
How we solve this: architecture and stack
We write the client side in Flutter 3.x (a single codebase for iOS and Android), the backend — Laravel 10 with REST API and PostgreSQL.
For online consultations we use Daily.co or Agora with session recording — the recording is encrypted and stored on S3, accessible only to participants.
Electronic signature: for qualified electronic signature (QES) — integration with CryptoPro DSS, for a simple one — recording of IP, time, and email. Notifications via FCM, billing — via YuKassa with automatic generation of acts.
Why is Flutter the optimal choice for a legal application?
Flutter allows releasing updates simultaneously on both platforms, which is critical for compliance with App Store Review Guidelines during frequent changes in legislation. Native libraries (PDFKit, CoreData) are bridged through platform channel without performance loss.
Example: loading a 10-page PDF with a signature takes < 1 second. In addition, we use code generation for data models to avoid errors during serialization.
How to implement a secure chat linked to a case?
We use Stream Chat with a custom backend: each message is signed with a token generated on the server. The client cannot modify or delete a message after sending — this guarantees the integrity of the correspondence. For video consultations, the recording is saved to S3 with role-based access control.
Work stages and approximate timelines
| Stage | Duration | Deliverable |
|---|---|---|
| Analytics and technical specification | 1-2 weeks | Specification of roles, data flows, integrations |
| Design (UX/UI) | 2-3 weeks | Figma mockups with client approval |
| Development | 6-12 weeks | Finished code, CI/CD, test environment |
| Load testing | 1 week | Performance report |
| Publishing (App Store + Google Play) | 1-2 weeks | App in the stores |
| Support (3 months) | — | Monitoring, fixes, updates |
For a single lawyer (booking, chat, documents, payment) — from 10 to 16 weeks. An aggregator with a lawyer marketplace, CRM, and billing — from 24 weeks. Cost calculated after audit.
What is included in the work
- Technical specification and architectural diagram
- Source code with comments (GitHub/GitLab)
- Access to App Store Connect and Google Play Console
- Staff training (1-2 online sessions)
- 3 months of technical support
- Operation documentation
The base package also includes automated testing (unit + integration) and CI/CD setup. Every application undergoes a security audit: OWASP Mobile Top 10 check, static analysis (Dart Analyzer, SonarQube).
Example notification configuration
// FCM initialization
final fcm = FirebaseMessaging.instance;
await fcm.requestPermission();
final token = await fcm.getToken();
// Sending to the backend
await api.post('/devices', data: {'token': token});
Our experience and guarantees
We have been engaged in mobile development for 5+ years and have launched more than 30 apps in the stores. We guarantee compliance with the App Store Review Guidelines (Section 4.2, 5.1) and the requirements of 152-FZ. Every app undergoes a security audit at the testing stage.
Contact us to discuss your project — we will select an architecture tailored to your practice. Request a consultation, and we will show you a demo prototype in 2 days.