BERRY9 IT Services, home +91 86868 92922

Mobile app penetration testing in Kochi

Guests, patients and borrowers in Kochi carry apps that hold passport numbers, bookings, prescriptions and loan documents. We examine the Android and iOS builds, the data they leave on the phone and the server they talk to, all from our Hyderabad office.

Request a scoping call Call +91 86868 92922
Typical duration
5 to 10 working days
Testing
Manual, by engineers
Report
Executive + engineering
Delivery
Remote from Hyderabad, visits by arrangement

Last reviewed

01 / Local need

Why Kochi companies test their mobile apps

Apps for travelers, patients and borrowers hold the most personal data in the business.

A travel or hospitality app stores bookings, passport details and payment tokens, and travelers use it on public Wi-Fi in airports and hotel lobbies. A hospital app keeps appointments, reports and prescriptions. An NBFC's app collects identity documents and sends them to a server. All three are published to strangers, who can unpack the file, read what is inside and try it on a rooted phone.

For these apps the first practical question is which build the test should cover, because Kochi teams often run an Android app that is updated weekly and an iOS app that follows later. We record the version tested and test the API once for both. Readers who want the full method should open the mobile application testing page, and those comparing firms can start at VAPT services in Kochi.

Finally, decide who in your team will own the fixes. In small Kochi companies the app is often built by an agency, so we write the engineering report in a form an agency can act on, with each finding tied to a screen, a request or a setting, and the executive report for the person who pays the agency and has to explain the result.

02 / Scope

Mobile apps we test most often for Kochi companies

Most of our Kochi mobile work falls into six kinds of app.

  • Travel and hospitality apps

    Apps for bookings, check-in and room services. We test stored identity details, payment hand-off, deep links from messages and what the app sends on public networks.

  • Hospital and patient apps

    Appointment, report and prescription apps. We test what is written to storage and backups, how report links open and what the API returns for another patient's identifier.

  • NBFC and loan apps

    Apps that collect identity documents and repayments. We test the upload path, device binding, one-time passcodes and the transactions the app can send.

  • Logistics and driver apps

    Apps used by drivers and port-side staff to scan, confirm and photograph. We test the offline store, the sync calls and what a lost phone exposes.

  • Agent and partner apps

    Apps for travel agents and field staff. We test what each login can see and whether one agent can reach another's customers.

  • The API behind each app

    The server is where the worst findings usually turn up, so we send the app's own requests straight to it, signed in and signed out, as different users.

03 / From our guide

From our guide: what to hand over and what to check before release

Kochi teams ask what a mobile tester needs and what they can do themselves before a release. This is how our checklist answers both.

What to give the tester

  • A release build and, if useful, a debug build of the same version.
  • Test accounts for every user role, with sample data that is not real.
  • A rooted test device, or permission to use emulators.
  • The API documentation and the environment the app talks to.
  • A list of what is out of scope, such as a third-party SDK or payment page.

Before you publish a release

  1. Remove debug flags and test endpoints.
  2. Move secrets out of the package and into server-side calls.
  3. Disable cleartext traffic and review the network security configuration.
  4. Restrict exported components to what is needed.
  5. Test on the Android versions your users have, including the target level.

For a team on the other side of a state line, a build delivered by link and a test account that works the first time save the most days. What an Android test covers, and the standards behind it, are in the full Android checklist.

04 / What we find

Weak points we expect in Kochi travel, care and lending apps

Apps for guests, patients and borrowers share a few recurring weaknesses.

Show details for Weak points we expect in Kochi travel, care and lending apps
  • Identity details kept on the phone. Passport or ID numbers saved in a local database that a rooted or misplaced handset hands over.
  • Tokens that outlive the session. A booking or loan session token that stays valid after logout or a password change.
  • Documents sent without protection. Loan documents uploaded over a connection that a hostile Wi-Fi network could read when pinning is weak.
  • Screens that leak. Balances, reports and bookings showing in recent-apps previews and in allowed screenshots.
  • Links that skip a check. A deep link in a booking message that opens a reservation without confirming who is signed in.
  • Old builds still accepted. A server that keeps answering a version from years ago, without later fixes.

Fixes that need a new store release are listed apart from those the backend can enforce today, because a store review can take days while a guest is booking.

Fast-moving travel apps have another habit worth checking: each campaign or festival season brings a new promotion screen, a new web view or a new partner SDK, and each one widens what the app trusts. We list the SDKs and web views present in the build we test, which gives your team a baseline to compare against the next release and a quick way to notice when something unexpected has been added.

05 / Rules and customers

What Kochi customers, lenders and stores ask about apps

Stores, regulators and clients abroad each have a different question.

Show details for What Kochi customers, lenders and stores ask about apps

Whatever personal data the app collects is covered by India's DPDP Act, and the DPDP testing page shows where a test helps. Lenders and the firms serving them work to their regulator's own directions on what testing is expected of a financial app; check them with whoever handles compliance and tell us what applies.

Google changed the Play Store rule this year. As of 31 August 2026 new apps and updates need Android 16 (API level 36) as their target, with the extension period over on 1 November 2026. Because a higher target alters permissions and file access, the build worth testing is the one you intend to publish.

06 / How it runs

Fitting a mobile test around Kochi store submissions

Nothing needs to be carried across the state, so your submission dates set the pace.

Show details for Fitting a mobile test around Kochi store submissions

  1. Before day 1

    Agreeing the scope

    A call settles the platforms, the exact build, the backend and the test accounts, and picks a window that avoids your next store submission and the tourist season.

  2. Day 1

    Builds arrive

    A download link carries the release and debug builds, and you add one account for every role. Our devices install them to check they start and sign in.

  3. Days 2 to 7

    Package, phone, then server

    We study the package, inspect storage and traffic on instrumented phones and then attack the API directly, calling you about anything urgent.

    OutputScreens, requests and responses as evidence

07 / Questions to ask

What to ask a mobile tester about travel, care and lending apps

Apps that hold identity documents deserve these questions.

Show details for What to ask a mobile tester about travel, care and lending apps
  • Will you test the build we publish, and record its number?
  • How will you treat apps that run on public Wi-Fi, such as in airports and hotels?
  • Will you test how documents are uploaded and where they are stored?
  • Can you test the API directly, with and without a login?
  • How do you handle an older version that some users still run?

08 / Delivery

Delivery of mobile tests to Kochi companies

Where the work happens

Testing is run from our office in Yellareddyguda, Hyderabad, which is our only office. Outside Hyderabad nothing about these tests needs us in your building; if a customer or a site rule asks for someone present, we come by arrangement and write the travel cost into the proposal.

What you receive

One report is written for management, customers and auditors, and a second, more technical one for the engineers who make the fixes. A walkthrough call covers both, and after your fixes we retest and mark each finding closed or open. Every inquiry gets a reply: we respond within 24 hours.

How to prepare

Test accounts, a staging address, our testing addresses allowed through your firewall and a named contact are what we ask for. The preparation article explains each item, and the one-page checklist (PDF) is a printable version.

09 / Price

Mobile test pricing for Kochi teams

Counting the API behind it, an app is a mid-sized job that begins from INR 27,000 + 18% GST; extra platforms, roles or a bigger API raise it. Our mobile cost guide shows how.

The starting price for small scopes includes one free retest. For larger scopes, the retest terms are written into the proposal before work starts.

10 / FAQ

Frequently asked questions

Short answers about scope, price and how testing works. For anything else, call +91 86868 92922.

Which platform do you start with for a Kochi app?

Usually Android, because its package opens up for free study; iOS follows with its own checks, and one API test covers both. See the section on Mobile apps we test most often for Kochi companies above.

Can you test an app used on public Wi-Fi?

Yes. We check how the app protects traffic, whether pinning can be removed and what a hostile network could read or change. See the section on Mobile apps we test most often for Kochi companies above.

Do you check how loan documents are uploaded?

Yes. We test the upload path, file handling on the server and who can fetch a stored document afterwards. See the section on Mobile apps we test most often for Kochi companies above.

Does the Play Store target rule matter for testing?

Potentially. Raising the target to API 36 shifts permissions and file access, which argues for testing the post-upgrade build. See the section on What Kochi customers, lenders and stores ask about apps above.

Is any BERRY9 tester based in Kochi?

No. Our testers work from Hyderabad, and the builds and readout travel by link and call. See the section on Delivery of mobile tests to Kochi companies above.

What should we budget?

Budget from INR 27,000 + 18% GST, with platforms, roles and API size deciding the rest. See the section on Mobile test pricing for Kochi teams above.

Plan your next security test

Tell us what needs testing and when you need it done, and we will propose a scope and timeline. We respond within 24 hours. If you would rather talk first, call or write to us.

Request a scoping call WhatsApp