Skip to content
CipherCruCipherCru

Menu

Mobile App Development

Enterprise Mobile App Development

An app your staff have to use is a different problem from an app your customers choose to. It has to work on the device they were issued, on the network they have, under the policy your security team wrote.

Typical duration
Six to fifteen months
Team shape
Three to six senior engineers
Starts with
A four-week diagnostic
A field service application in use on a company-issued handset

The device is not the user's, and that changes everything

Consumer apps optimise for install and retention. An internal app has neither problem and a different set: it has to enrol into device management, authenticate against your directory, work where your staff work, and leave an audit trail of what was done on it.

None of that can be added at the end. Enrolment shapes the release process, SSO shapes the session model, and offline requirements shape the data model. We establish all three in the diagnostic — usually in a room with IT and security rather than only with the business — because those are the constraints that decide whether the app is deployable at all.

What usually goes wrong, and what we do instead

Enterprise mobile projects rarely fail on features. They fail on deployment.

Where enterprise mobile gets stuck

  • Device management discovered after the app is built, not before
  • Authentication that assumes a browser and a connection
  • Offline behaviour designed for an office, used in a basement
  • An audit trail added when compliance asks rather than by design
  • Distribution through a public store when it should never be public

How we build it instead

  • Enrolment and distribution decided with IT before any code
  • SSO with a session model that survives days without a connection
  • Offline scoped against the real working environment, on site
  • Every action attributable and exportable from the first release
  • Managed distribution, so a release reaches devices rather than a store

What we build

The surfaces an internal app needs before IT will deploy it.

Device management

Enrolment, configuration and managed app settings across the MDM your organisation already runs.

Single sign-on

SAML or OIDC against your directory, with conditional access and a session model built for the field.

Offline operations

Work captured where there is no signal and reconciled on return, with a conflict rule per record.

Audit trail

Who did what, on which device, when — attributable and exportable from the first release.

Line-of-business integration

The systems the process actually depends on, integrated on agreed record ownership.

Managed distribution

Releases that reach enrolled devices through your MDM rather than a public store listing.

What you end up with

Stated from your side rather than ours.

  • An app IT will actually deploy

    Enrolment, policy and distribution were designed with them from week one, so approval is a step rather than an obstacle.

  • Staff who can work anywhere

    A basement, a rural site or a shielded building stops being the reason the job was recorded on paper and typed up later.

  • Answers ready before the audit

    Who did what, on which device and when is a query rather than a project, because the model carried it from the start.

  • Support that can diagnose remotely

    Errors broken down by device, version and user, so a problem in the field does not need a site visit to understand.

How the build runs

The same five stages as every engagement, applied to an app the business runs on.

Diagnose

The real working environment, the device estate, and what IT and security require — established on site, not in a meeting room.

Decide

Enrolment, the session model, the offline data set and the audit scope, written down with their trade-offs.

Prove

One workflow, on an enrolled device, in the place it will be used, offline and back.

Deliver

Features built in slices, each deployed to a pilot group before the next is scoped.

Hand over

Your team ships a release with us watching, then without us.

What we build it with

Chosen for what an app has to prove before it can be deployed to staff.

Application

  • Kotlin
  • Swift
  • React Native
  • Flutter

Device and identity

  • MDM
  • SSO
  • Azure
  • Firebase

Services

  • Node.js
  • Java
  • Spring Boot
  • PostgreSQL
  • Kafka

Platform

  • AWS
  • Azure
  • Kubernetes
  • Datadog

What you get, and when

Handed over as it is produced, not assembled at the end.

  • The device estate and the enrolment approach, agreed with IT
  • The session model, including what happens after days offline
  • The audit scope and the retention policy it has to satisfy
  • Source in repositories you own
  • A signing and distribution pipeline through your MDM
  • Pilot releases from the first slice onwards
  • Audit trail schema and its retention policy
  • Access review evidence and a device-loss procedure
  • A rollout runbook your team has used on a pilot group

Where we have built this

Sectors where the work happens away from a desk and still has to be evidenced.

An open-plan office with a laptop showing a workforce dashboard - headcount, attendance, leave requests and approvals - and the same modules on a phone

HRMS

Workforce systems built around how organisations actually operate.

We build and improve workforce platforms spanning recruitment, onboarding, employee management, attendance, operational workflows, reporting, and integrations, reducing friction across the employee lifecycle.

A clinician talking with a patient at the bedside while a monitor shows that patient's record - vitals, scans and recent reports - with the same case open on a phone

Healthcare

Technology that connects complex care and operational workflows.

We help build digital healthcare platforms, operational workflows, integrations, and data-driven applications designed around reliability, secure information handling, usability, and the realities of interconnected healthcare systems.

A cafe table by an airport window with a laptop open on a travel booking screen showing destinations and dining, a passport, a boarding pass and a phone beside it

Food & Travel

Digital experiences that keep customers and operations moving.

We build customer journeys and operational platforms around ordering, booking, marketplaces, partner integrations, administration, and real-time workflows where experience and operational efficiency need to work together.

A banking hall desk where a laptop shows an account dashboard with a running balance, recent transactions and a monthly activity chart, a phone beside it

Fintech & BFSI

Secure, reliable systems for businesses built on trust.

We build and modernize financial platforms, workflows, integrations, and customer-facing applications where reliability, data integrity, auditability, security, and performance are fundamental to the business.

Questions about enterprise mobile

The ones we are asked most often before a first conversation.

Will it work with our device management platform?
Yes — Intune, Jamf, Workspace ONE and the other major platforms are standard work. What varies is the configuration your organisation has already applied, which is why we want IT in the room during the diagnostic rather than at deployment. Managed app configuration in particular is worth designing for early, because it is how you avoid shipping a build per region or per business unit.
Our staff use their own phones. Does that change things?
Considerably, and it is worth deciding the policy before the build. On personal devices you generally cannot manage the whole device, so the protections move into the app — containerised storage, its own passcode, and a remote wipe that removes company data without touching anything personal. That is a different design from a managed-device app, and retrofitting one into the other is expensive.
Does it have to go through a public app store?
No, and usually it should not. Both platforms support private distribution to your own organisation — Apple Business Manager and Google's managed Play — which means no public listing, no review queue between you and a fix, and no risk of a competitor downloading it. We set that up as part of the engagement, because it also determines how releases reach devices.
How much has to work offline?
Whatever your staff actually do where there is no signal, which we establish by going to those places rather than by asking in a meeting. It is almost always more than the office expects and less than everything. Each record that works offline needs a conflict rule, so we would rather make the three real field workflows completely reliable than make everything half-available.
Can you meet our compliance requirements?
We can build the technical controls an auditor asks about — access control, audit trail, retention, encrypted storage, device loss procedures — and evidence them. We cannot promise a certification outcome, because certification covers your organisation rather than one app, and anyone promising otherwise on a web page is selling something. Bring the specific requirements to the diagnostic and we will map them to what the app has to do.
Do we need separate iOS and Android builds?
Only if the app leans on platform capabilities that a shared codebase cannot reach well. For most internal apps — forms, lists, capture, sync — a shared codebase in React Native or Flutter is the better economics, because one team maintains one implementation of the workflow. We will recommend based on what the app actually has to do, and if your estate is single-platform the question is moot.

Building an app your staff have to use?

Tell us where they work and what IT requires. We will tell you what that means for the build.

Strictly necessaryEssential for the site to function: page navigation, security, session management, and remembering the cookie choices you make here.
Always on
FunctionalRemembers choices you make, such as language, region or display preferences, so the site opens the way you left it.
Performance and analyticsPerformance and analytics cookies show us how the Website is used: which pages are visited, how long is spent on them, where visitors came from, and what errors occur. They are set by Google Analytics and by HubSpot, whose cookies also link the pages you viewed to any enquiry you later send us.
Marketing and targetingTracks browsing activity to measure advertising and show relevant ads. We set none of these today, and will not without your opt-in.