Device-bound keys
Each phone gets a hardware-protected key. Every request is signed with it, and sessions are tied to that device.
LTAB's OCTA app, rebuilt around the driver's two key tasks.
We are rebuilding LTAB's mobile app from the ground up. New design, new security model and a guided accident statement that two drivers complete and sign on their own phones.
Key gains
- OCTA status at a glanceEach car shows whether OCTA is active, ends in a set number of days or has expired, so lapses are spotted early.
- Each driver signs on their own phoneThe second driver joins by QR or code. An unfinished statement can be resumed, and retries never create duplicates.
- A lost phone loses accessEach phone holds its own hardware-protected key. Removing a device or deleting the account takes effect within 30 seconds.
The problem
Logic on the phone made every change slow.
In the previous app much of the business logic ran on the phone, so changing a rule meant shipping a new version, and sign-in ran inside an embedded browser.
LTAB asked for a version that is easier to use and change, and harder to misuse.
What we are building
Business rules live on the server, not in the app.
The new app shows each driver's cars with a clear OCTA status: active, ending soon or expired. Cars are found automatically in the LTAB register or added by hand, with a guide to the registration certificate.
The accident statement is a guided flow: safety questions, roles, time and place on a map, photos and voice notes, witnesses, vehicles and a final review. The second driver joins by QR code or a four-digit code, and both sign with Smart-ID or eParaksts on their own phones.
- All business rules and records handled on the server
- Unfinished statements can be resumed at any time
- Retries never create duplicate submissions
- Sign-in with Smart-ID or eParaksts through the phone's secure system browser
- No advertising or social media tracking libraries
What we built
Security and accessibility from the start
Genuine app checks
Apple and Google integrity services confirm that requests come from the real app on a real device.
Fast revocation
Removing a device or deleting the account takes effect within 30 seconds. Short sessions limit the damage of a lost phone.
Readable for everyone
WCAG AA contrast, large touch targets and layouts tested at 200% text size, in light and dark mode.
Notifications inbox
Statement updates in one place, grouped by day.
No ad trackers
No advertising or social media tracking libraries in the app.
Screens
Screens from the current build
Scroll for more screens
Screens show the current development build with sample data. Details may change before release.
Where it stands
Core flows built and tested, release preparation under way.
The core flows are built and run end to end against test data. The remaining work is release preparation: testing with real Smart-ID and eParaksts accounts and setting up the app integrity services for both stores.
Business rules sit on the server, so most changes reach drivers without an app update.
- Readable at double text size, in light and dark mode
- Agreed statement signed on both drivers' phones
- Security model designed for lost and stolen devices
- Release planned after real-account testing
Next step
Have an idea? Let's discuss it.
Send a few lines about what you want to build and by when. We reply with questions, a delivery plan and an estimate.