On the phone
Each phone holds an encrypted database of the operative's jobs, with the key kept in the phone's secure keychain. Everything a user does is saved on the phone first and shows straight away, then joins a queue that sends changes in order whenever there is a connection, retrying with growing gaps between attempts. The queue survives the app being closed. Signing out wipes the key first, then the data and photos.
Photos are resized, stripped of their location metadata and watermarked on the phone, then uploaded straight to storage, picking up where they left off if the connection drops.
Between the phone and the back office
The app never talks to the back-office system directly. A gateway on AWS Lambda, defined in Terraform, handles sign-in, syncing and every write, and only makes the kinds of change on its allow-list. Sync fetches only what has changed since the phone last checked, when the app opens, every few minutes, in the background and when a notification arrives.
When the office and the phone have both changed the same detail, a rule for that kind of change decides. Where it matters, such as an appointment time, the phone shows which fields changed and lets the operative choose. Overriding the office's version is logged.
Security
Operatives sign in with their existing portal account and a text message code, then Face ID or a passcode. Sessions are short-lived and renewed automatically, every device is registered, and sign-ins are rate-limited and recorded. Signing in on a phone never signs anyone out of the desktop portal.