Mobile app maintenance: the work after launch
Why a released app needs regular work, which yearly Apple and Google deadlines drive it, and how to plan security and data protection upkeep in Singapore.
An app is never finished in the way a brochure is. The phones it runs on, the stores that distribute it and the services it talks to all keep changing. Maintenance is the work of keeping up, and it is a running cost, not an optional extra.
The two deadlines that come every year
Apple and Google each raise their minimum requirements on a yearly cycle:
- Apple requires uploads to be built with a recent Xcode and SDK. Since 28 April 2026 that means Xcode 26 or later. An app that has not been rebuilt cannot ship any update, including an urgent fix, until it is.
- Google requires apps to target a recent Android version. From 31 August 2026, new apps and updates must target API level 36, and existing apps below API level 35 stop being offered to new users on newer Android versions.
Raising a target version is rarely a one-line change. New OS versions change how permissions, background work and notifications behave, so each move needs testing.
What else falls under maintenance
- Bug fixes reported by users or crash logs.
- Dependency updates for the libraries and SDKs inside the app, which have their own security fixes and deprecations.
- Back-end upkeep: server patches, certificate renewals, database backups and the cloud bill.
- Store housekeeping: answering reviews, keeping screenshots and privacy answers in line with what the app actually does.
Security
OWASP’s MASVS is a widely used standard for mobile app security. Its control groups make a practical checklist for a yearly review: storage of sensitive data on the device, cryptography, authentication, network communication, interaction with the platform, code quality and updates, resistance to tampering, and privacy.
For the organisation behind the app, the Cyber Security Agency of Singapore runs Cyber Essentials, a certification aimed at organisations including SMEs, which now also covers cloud, OT and AI security.
Data protection does not stop at launch
Several PDPA obligations are ongoing duties rather than launch tasks: protecting the personal data you hold, deleting it when no longer needed, answering access and correction requests, and assessing any breach. If a breach is likely to cause significant harm or is of significant scale, the PDPC and the affected people must be notified as soon as practicable. Decide in advance who in your company makes that call, and make sure your maintenance contract says how quickly the developer must tell you about an incident.
Writing the maintenance agreement
Whether the work stays with the original developer or moves elsewhere, put these in writing:
- Who rebuilds the app for each year’s Apple and Google requirements, and by when.
- Response times for crashes, security issues and store rejections.
- Who holds the store accounts, signing keys and server credentials (it should be you).
- How many hours or which tasks the fee covers, and the rate for anything beyond.
If the original developer is no longer available, the consultancy guide covers handing an app to someone new.