Review product quality
Judge the user experience on both platforms separately, because one shared codebase does not produce one shared standard. Check how the app behaves on a small Android screen with the system font size raised, then check it again with a screen reader running. Under EN 301 549 Chapter 11, which became enforceable for private-sector digital services through the European Accessibility Act on 28 June 2025, honouring platform font settings and offering a non-biometric login alternative are requirements.
Offline and synchronisation deserve the same scrutiny. Ask what happens to a queued write when the token expires mid-flight, and who resolves the conflict. For security and privacy, the OWASP MASVS control groups give you a shared vocabulary with the supplier covering storage and cryptography, and competent cross-platform app developers will already be testing against them. A company that treats privacy as a post-development questionnaire rather than a design input will cost you later, since the Information Commissioner's Office treats data protection by design as a legal obligation under Article 25.
The product design should reflect these requirements from the beginning.
Inspect delivery controls
Ask to see a pipeline. You want evidence of unit and integration tests and end-to-end runs against real hardware. You want automated accessibility checks and a code review record with actual comments in it. Emulators hide the problems that matter, which is why the device lab question is worth pressing: OpenSignal counted 24,093 distinct Android devices in its 2015 fragmentation report, and that estate has only grown more varied since.
Stability is measurable, so measure it. Google Play's bad behaviour thresholds sit at a 1.09% user-perceived crash rate and a 0.47% ANR rate, and exceeding either reduces your visibility in the store. Any Flutter React Native agency bidding for production work should know those numbers without looking them up, and should be able to show you where its last three releases landed against them. Rollback procedure and environment separation come next, and a cross-platform app development company without a documented rollback has never needed one, which is its own answer.
A documented delivery process should make these controls visible before the contract is signed.
Confirm lifecycle ownership
Decide now who holds the Apple and Google developer accounts, because retrieving them later is painful. Then get specific about upgrades. Google Play required new apps and updates to target Android 15, API level 35, from 31 August 2025, with the bar rising to API 36 a year later, so framework and SDK upgrade work is a permanent line item rather than a one-off.
Framework cadence compounds it. Flutter ships four stable releases a year on published branch cutoff dates, and skipping two of them turns a routine upgrade into an archaeology project. Ask who triages a Saturday night crash spike and what the response time is. Ask what documentation you receive at handover. A Flutter React Native agency that cannot answer the incident question is selling you a build.
Test evidence firsthand
Install the supplier's shipped apps on your own devices. Use an older mid-range Android handset alongside a current iPhone, because that comparison exposes layout and performance assumptions faster than any demo call. Statcounter data from 2025 showed Android 13 still ahead of Android 14 in worldwide version market share, so the oldest device in your test set is closer to your users than the newest.
Then ask for the artefacts behind the apps. Repository access under a non-disclosure agreement and an architecture diagram with its trade-offs annotated. A test report with failures in it and pipeline configuration. Release history with dates. Experienced developers expect this request and have the material ready, which is itself a signal about how a cross-platform app development company runs its projects.
Reference calls are worth more when you choose the referee. Ask for a client whose project went wrong, and ask that client how the supplier behaved during the recovery.