Skip to content
CipherCruCipherCru

Menu

Cross Platform App Development

Enterprise Cross Platform Application Development

A mixed device estate is the strongest argument for a shared codebase there is. It is also where the enterprise requirements bite hardest, on both platforms at once.

Typical duration
Seven to sixteen months
Team shape
Three to six senior engineers
Starts with
A four-week diagnostic
A shared codebase under development against a mixed device estate

Two platforms, one policy, and both have to satisfy IT

An internal app on a mixed estate has to enrol into device management on Android and iOS, authenticate against one directory on both, and produce one audit trail regardless of what the record was created on. The shared codebase makes that consistent. It does not make it automatic.

The enterprise surfaces — enrolment, SSO, managed configuration, distribution — sit closest to the platform, which means they are also the parts most likely to need native code. So this engagement starts by drawing the boundary with IT in the room rather than only the business, because the deployment constraints determine how much can honestly be shared.

What usually goes wrong, and what we do instead

Enterprise cross-platform projects fail on deployment, and they fail on both platforms differently.

Where these projects get stuck

  • Device management discovered after the boundary is drawn, not before
  • SSO working on one platform and subtly broken on the other
  • Audit records that differ depending on which device created them
  • Managed configuration handled natively on one side and not the other
  • Distribution designed for a public store when it should never be public

How we build it instead

  • IT and security in the room before the shared and native line is drawn
  • One identity integration, verified on both platforms from the first slice
  • One audit schema, so a record does not reveal what created it
  • Managed configuration read through one interface on both sides
  • Managed distribution to enrolled devices, built in the first month

What we build

The surfaces an internal app needs before IT will deploy it to a mixed estate.

Device management on both platforms

Enrolment, managed configuration and policy across the MDM your organisation already runs.

Single sign-on

One SAML or OIDC integration against your directory, verified on both platforms from the first slice.

Offline operations

One sync contract and one conflict rule per record, implemented once for the whole estate.

Unified audit trail

One schema, so who did what and when reads the same regardless of the device it came from.

Line-of-business integration

The systems the process depends on, integrated once on agreed record ownership.

Managed distribution

One pipeline releasing to enrolled devices on both platforms, rather than to a public listing.

What you end up with

Stated from your side rather than ours.

  • One app for a mixed estate

    Staff on either platform get the same product and the same process, which is usually the point of the exercise.

  • One audit trail, not two

    A single schema means compliance questions have one answer rather than one per platform to reconcile.

  • One team, one release

    A policy change is implemented once and reaches both platforms in the same release rather than in two.

  • An app IT will actually deploy

    Enrolment, policy and distribution were designed with them from week one, on both platforms at once.

How the build runs

The same five stages as every engagement, applied to a shared codebase the business runs on.

Diagnose

The device estate, the working environment, and what IT and security require on each platform.

Decide

The shared and native boundary, the identity model and the audit scope, written down with their trade-offs.

Prove

One workflow on an enrolled device of each platform, in the place it will be used, offline and back.

Deliver

Features built in slices, each deployed to a pilot group on both platforms before the next is scoped.

Hand over

Your team ships a release to the estate with us watching, then without us.

What we build it with

Chosen for what an app has to prove before it can be deployed to a mixed estate.

Shared

  • React Native
  • Flutter
  • TypeScript

Device and identity

  • MDM
  • SSO
  • Azure
  • Kotlin
  • Swift

Services

  • Node.js
  • Java
  • Spring Boot
  • PostgreSQL
  • Kafka

Platform

  • AWS
  • Azure
  • Kubernetes
  • Datadog

What you get, and when

Handed over as it is produced, not assembled at the end.

  • The device estate and the enrolment approach, agreed with IT
  • The shared and native boundary, with the enterprise surfaces placed
  • The audit scope and the retention policy it has to satisfy
  • Source in repositories you own
  • One pipeline distributing to enrolled devices on both platforms
  • Pilot releases on both platforms from the first slice
  • One audit schema, verified identical across platforms
  • Access review evidence and a device-loss procedure
  • A rollout runbook your team has used on a pilot group

Where we have built this

Sectors where staff carry whatever they were issued and the process has to be the same regardless.

An open-plan office with a laptop showing a workforce dashboard - headcount, attendance, leave requests and approvals - and the same modules on a phone

HRMS

Workforce systems built around how organisations actually operate.

We build and improve workforce platforms spanning recruitment, onboarding, employee management, attendance, operational workflows, reporting, and integrations, reducing friction across the employee lifecycle.

A clinician talking with a patient at the bedside while a monitor shows that patient's record - vitals, scans and recent reports - with the same case open on a phone

Healthcare

Technology that connects complex care and operational workflows.

We help build digital healthcare platforms, operational workflows, integrations, and data-driven applications designed around reliability, secure information handling, usability, and the realities of interconnected healthcare systems.

A cafe table by an airport window with a laptop open on a travel booking screen showing destinations and dining, a passport, a boarding pass and a phone beside it

Food & Travel

Digital experiences that keep customers and operations moving.

We build customer journeys and operational platforms around ordering, booking, marketplaces, partner integrations, administration, and real-time workflows where experience and operational efficiency need to work together.

A banking hall desk where a laptop shows an account dashboard with a running balance, recent transactions and a monthly activity chart, a phone beside it

Fintech & BFSI

Secure, reliable systems for businesses built on trust.

We build and modernize financial platforms, workflows, integrations, and customer-facing applications where reliability, data integrity, auditability, security, and performance are fundamental to the business.

Questions about enterprise cross-platform

The ones we are asked most often before a first conversation.

Can a shared codebase really meet enterprise requirements?
Yes, and the enterprise surfaces are the part most likely to need native code — enrolment, managed configuration and some identity flows sit close to the platform. That is not a failure of the approach; it is what the shared and native boundary is for. The saving still lands where it matters, on business logic, the sync contract and the screens, which is the great majority of the app.
Will it work with our device management platform?
Yes — Intune, Jamf, Workspace ONE and the other major platforms are standard work, and managed app configuration is supported on both operating systems. What varies is the configuration your organisation has already applied, which is why we want IT in the room during the diagnostic rather than at deployment. We read managed configuration through one interface so the two platforms cannot drift apart.
How do we know the audit trail is the same on both?
Because there is one schema and one implementation of the code that writes it, which is one of the more underrated arguments for a shared codebase in a regulated environment. Two native apps produce two audit implementations that agree until one is changed. We also test it explicitly: the same action on each platform must produce records that differ only in the device field.
Can you meet our compliance requirements?
We can build the technical controls an auditor asks about — access control, audit trail, retention, encrypted storage, device loss procedures — and evidence them on both platforms. We cannot promise a certification outcome, because certification covers your organisation rather than one app, and anyone promising otherwise on a web page is selling something. Bring the requirements to the diagnostic and we will map them to what the app has to do.
Does it have to go through public app stores?
No, and usually it should not. Both platforms support private distribution to your own organisation — Apple Business Manager and managed Play — which means no public listing and no review queue between you and a fix. We build one pipeline that produces both, because two release processes maintained separately is exactly the divergence a shared codebase is meant to prevent.
Our estate is one platform. Should we still do this?
Probably not, and we will say so. The main argument for a shared codebase is a mixed estate or a second platform you expect to add; without either, native is usually the better engineering with fewer moving parts. If a second platform is genuinely coming, deciding now is cheaper than converting later. If it is not, our Enterprise Mobile App Development service is the honest recommendation.

Mixed estate that needs one app?

Tell us what your staff carry and what IT requires. We will tell you where the shared and native line should sit.

Strictly necessaryEssential for the site to function: page navigation, security, session management, and remembering the cookie choices you make here.
Always on
FunctionalRemembers choices you make, such as language, region or display preferences, so the site opens the way you left it.
Performance and analyticsPerformance and analytics cookies show us how the Website is used: which pages are visited, how long is spent on them, where visitors came from, and what errors occur. They are set by Google Analytics and by HubSpot, whose cookies also link the pages you viewed to any enquiry you later send us.
Marketing and targetingTracks browsing activity to measure advertising and show relevant ads. We set none of these today, and will not without your opt-in.