Security and GDPR audit of a Flutter and Firebase medical app
I audit Flutter and Firebase apps that store patient data. A fixed package of 12 h for 2 580 PLN net: a read-only review of the repository and the Firebase configuration, a written report within 7 working days of access being granted, and a 60 min call to go through it. The technical review and the GDPR basics come from one person in one engagement.
Who can do a security audit of a Flutter and Firebase app that stores patient data?
I can. I am Piotr Bomba, a software engineer in Poland. I build Flutter and Firebase apps for healthcare, the most recent one is in a clinical trial, and I came to this work from medical physics research at University College London. In the audit I read your code and your Firebase project the way I would review my own before a hospital pilot: Firestore security rules, authentication, where the data goes, what the third-party SDKs receive.
Who can check whether our mobile app with patient data is GDPR compliant?
Security firms and GDPR law firms are usually separate, and neither reads the other's work. This audit puts the technical review and the GDPR basics in one report: lawful basis, records of processing and whether a DPIA is needed, next to the findings in the code and the configuration. It is not a legal opinion. If you need one, you still need a lawyer, and the report gives them the facts about the app.
The package
- Who it's for
- Teams with a Flutter app on Firebase, or another mobile or web app, that handles patient or health data, finished or nearly there, who want it checked before launch, before a hospital pilot, or before an investor or a customer does their due diligence.
- What I review
-
A read-only review of the repository and the cloud or Firebase configuration:
- Authentication and access rules, including Firestore and Cloud Storage security rules
- Where personal and health data is stored and where it flows
- Encryption in transit and at rest
- Logging and audit trail
- Pseudonymisation and key handling
- Backups and retention
- Third-party SDKs and what they receive
- GDPR (RODO) basics: lawful basis, records of processing, whether a DPIA is needed
- What you get
- A written report with findings ordered by risk and a concrete fix for each, and a 60 min call where we go through it. It is not a penetration test, not a certification and not a legal opinion.
- Timeline
- Report within 7 working days after access is granted.
- Price
- Fixed package of 12 h: 2 580 PLN net, paid in advance. Free 15 min intro call first.
How it works
- A free 15 min intro call. We check that the app and the stack fit the package and what you want the report for.
- You pay the package in advance and grant read-only access to the repository and to the Firebase or cloud project.
- I review the code and the configuration. I change nothing.
- Within 7 working days you get the written report, findings ordered by risk with a fix for each.
- A 60 min call where we go through the findings and the order in which to fix them.
Want to check the app yourself first? Use the audit checklist for a Flutter and Firebase app with patient data. It covers the same areas as the package.
Questions and answers
Is this a penetration test?
No. I read the code and the Firebase or cloud configuration and change nothing. There is no attack simulation, no certification and no legal opinion. You get a written report with findings ordered by risk and a concrete fix for each.
What do you need from me to start?
A free 15 min intro call, the payment, then read-only access to the repository and to the Firebase or cloud project configuration. The 7 working days for the report start when the access is granted.
Does the audit cover GDPR?
It covers the GDPR basics next to the technical review: lawful basis, records of processing and whether a DPIA is needed. It is not a legal opinion. The point is that the technical review and the GDPR basics come from one person in one engagement, instead of a security firm and a law firm working separately.
What does it cost and how long does it take?
A fixed package of 12 h for 2 580 PLN net, paid in advance after a free 15 min intro call. The report arrives within 7 working days of access being granted, and then we go through it on a 60 min call.
Which stacks do you audit?
Flutter apps on Firebase first: Firestore security rules, Firebase Authentication, Cloud Storage, Cloud Functions and the rest of the project configuration. Mobile or web apps on another cloud backend too, as long as the repository and the configuration can be read.
In which language is the report?
The report and the call are in English or Polish, your choice.