What mobile app security covers for a business
Start with an inventory, not with technology. Write down what the app knows about people and about your company: customer names and phone numbers, delivery addresses, order history, bonus points, login tokens, and keys to payment services. The less you collect, the less you can lose. If a phone number is enough to place an order, do not ask for passport details just in case.
Then list what only your team sees: the admin panel, customer exports, access to mailings and Telegram bots. This layer is often the least protected, because everyone assumes only insiders can reach it.
- Customer data and order history
- Accounts, sessions and login tokens
- Payments and payment confirmations
- Bonuses, promo codes and discounts that can be abused
- The admin panel and staff permissions
- API keys and access to third-party services
The weak spot is usually the server, not the phone
An app is a storefront. The data lives on a server and travels through an API. If the server does not check who is asking for what, a polished screen will not help: someone can tweak a request and see another person's orders or add points to their own balance. Permission checks, rate limits and input validation therefore belong on the server, not inside the app.
This is where mobile development meets websites. Many companies run the app, the website and the admin panel on one backend, so a single hole in the web part opens everything. Security works best when designed as one system rather than as separate projects.
On the phone itself, the basics are different: do not keep passwords or keys in plain text inside the app code, use the device's secure storage, send data only over HTTPS, and avoid writing sensitive details to logs.
Payments and personal data in Uzbekistan
If you accept payments through Click, Payme or other providers, follow a simple rule: card data should never pass through your server, let alone be stored there. Use the provider's official integration, and confirm that a payment happened on the server, based on the notification from the payment system, not on a "success" message sent by the app.
Personal data of Uzbekistan's citizens is governed by a dedicated law with requirements for collection, storage and processing. Exact obligations depend on your business model, so confirm them with a lawyer rather than guessing.
Questions to ask your developer before work starts
The answers say a lot about a contractor. If you want a reference point, use the international OWASP MASVS standard. It describes security requirements for mobile apps and helps you build a pre-release checklist.
- How does authentication work, and what happens if a token is stolen?
- What can each role do: customer, courier, manager, administrator?
- Where is the data stored, and who can access it?
- How are backups made, and has restoring from one been tested?
- Which third-party libraries are used, and who keeps them updated?
- Is the app checked against a list before it goes to the app stores?
- Who owns the source code and the server credentials?
Security after launch
Release day is not the finish line. New Android and iOS versions appear, libraries get updated, and staff come and go. Revoke access for people who leave, turn on two-factor protection for the admin panel, and keep passwords in a password manager rather than a shared chat. Watch for anomalies: a sudden jump in orders that use bonuses, mass logins from one address, a spike in errors after an update.
Decide in advance what happens during an incident: who disables access, who informs customers, where data is restored from. A plan on paper saves hours at the moment you need it.
One honest note: sometimes you do not need an app yet. A responsive website or a Telegram bot can solve many tasks with a smaller attack surface and less to maintain.
Where to start
Make a list of your data, roles and integrations, then ask the contractor to explain the protection for each item in plain language. If the answer is "don't worry, it's all secure", treat that as a warning sign.
markdev builds turnkey websites in Uzbekistan and looks at security together with the server side, the admin panel and integrations. If you would like to discuss your project, get in touch: we can work out whether you need an app at all and what protection to build in from day one.
FAQ
What matters most in mobile app security?
The server side: authentication, permission checks and API protection. Other people's data is most often reached through the server, so start there and only then move on to protecting the code on the phone.
Is it safe to accept Click and Payme payments in an app?
Yes, if you use the official integrations, do not store card data yourself, and confirm payments on the server using the payment system's notification. Check connection terms with the providers directly.
Should an app be checked before publishing?
Yes. Build a checklist based on a standard such as OWASP MASVS and go through it before release: data storage, role permissions, HTTPS transfer and key handling.
What should I do if I suspect a data leak?
Immediately disable compromised access and tokens, save a copy of the logs, find the source of the problem and only then restore service. It is best to inform customers honestly and on time.
Let’s look at your task for free
Leave your contact — in a 15-minute call we’ll show where leads get lost and what to fix first.