Mobile app security audit: how do we ensure the dev actually protects data before sign-off?

Health data is classified as special category data under DSGVO Article 9 in Germany. Claiming you're secure because of SSL is like having a sturdy lock on the building's front door while leaving every room inside wide open. Definitely do not release that final milestone payment without seeing an independent test report.

Our developer on a similar health app insisted everything was rock-solid. We brought in a 3rd party for a 2-day API test costing 2,500 EUR. The report revealed that simply tweaking the patient ID parameter allowed anyone to pull the entire appointment history. That single test saved us from potential six-figure fines.

Does your contract include a formal sign-off (Abnahme) clause? German contracts usually grant a 14 to 30-day review period following delivery. If that's in place, you can conduct your independent testing within that statutory window and formally submit remediation demands.

Be sure to ask whether they implemented certificate pinning on the mobile client. Also have them specifically test session key (JWT) expiry on the back end and verify whether tokens are properly invalidated upon logout. That's where things slip through the cracks most often.

Even without a technical background you can upload the app build file to an open-source mobile security scanner. You'll get a clear 15-minute report highlighting basic blunders like hardcoded database credentials or exposed API keys.

Don't fall for 40-page boilerplate PDF reports spat out by automated tools that agencies love to wave around. Automated scanners can't catch business logic and broken authorization flaws. The report must be signed off by a specialist who conducted manual testing.

if security wasnt explicitly defined in the contract it migt be hard to push now, but bring up compliance and legal mandates in healthcare. tbh tell them you cant go live without an independent audit they will have to cooperate.

completely valid concern and developers usually just check if buttons work and screens load leaving back-end data isolation as an afterthought. protect yourself: delay launch by two weeks if needed, but make sure you sign off with total peace of mind.

I'm in the same situation, that's why I'm asking. An untested backup is not a backup.

I have an objection here. Any unwritten clause becomes a point of disagreement later, as both sides remember it differently.

If you have questions, write them; I'll answer as best I can.

The opposite happened to me, that's why I'm writing. Everything goes well for the first three months; problems arise in the fourth.

This is my opinion, I'm not claiming it's absolute truth.

Good call starting this thread.

I felt relieved reading this answer, so it's not just me. tbh any unwritten clause becomes a point of disagreement later, as both sides remember it differently.

That's all sorry if I went on too long.

I agree, and I'd like to emphasize that. The biggest time-waster for us was not knowing who had the final say.

Just leaving this note, it might be useful.

You're right.

Thanks, that was the answer I was looking for.

you're right, I've been down that road too. i mean your time to detect an issue directly determines its cost.

processes without records never improve, beacuse you dont know what to fix.

I was thinking the same thing. If it's your first time, start small; scaling comes later.

If you have questions, write them; I'll answer as best I can.