How to Build a Mobile App With Document Uploads

What document uploads in a business app actually involve

A document upload feature in a mobile app lets a user submit files, usually photographs of paper documents or PDFs, which the app transmits to your server, stores securely and presents to staff for review. The four moving parts are capture (camera or file picker), transport (upload that survives poor connections), storage (private, encrypted, access-controlled) and workflow (who reviews what, and what happens next). Most of the engineering effort sits in the last three. Any developer can add a button that picks a photo. Fewer build uploads that finish on a 3G connection in Ajegunle, storage that would satisfy an NDPA audit, and a review queue that tells an applicant within the hour that the bank statement was cut off.

Which Nigerian businesses need document uploads?

Document uploads matter for any business whose process starts with "send me your documents". In Nigeria that includes lenders, fintechs, schools, HR teams, insurers, property firms and procurement departments.

The pattern is the same: a checklist of required documents, an applicant who is often on a low-end phone with limited data, and staff who need to review, approve or reject each item.

Capture: getting a usable document from the phone

Capture determines whether staff can read what arrives. Give users a camera route with a document-scanning mode that detects page edges, corrects perspective and flattens lighting, plus a file picker for PDFs and existing images. Then validate type, size and page count before anything leaves the phone.

• Document-scanning mode. Google's ML Kit Document Scanner on Android and Apple's VisionKit document camera on iOS both provide edge detection, cropping, perspective correction and multi-page capture. In Flutter and React Native, plugins wrap these native tools. The result is a flat, legible page instead of a photo of a table.
• File picker. Bank statements now arrive as PDFs from banking apps; results and certificates are often already scanned. Let users pick from Files, Google Drive or the Downloads folder.
• WhatsApp reality. Many users will have the document as an image forwarded on WhatsApp. The file picker must handle those, and the app should accept a screenshot with a warning that a clearer copy may be requested.
• Compression. A 12-megapixel photo can exceed 5 MB. Compress on the phone to a target size (a legible A4 page rarely needs more than 300–600 KB) before upload. This is the single biggest saver of data cost and upload failures.
• Validation on the phone. Check file type, size limit, page count and, for photographs, basic blur detection so the user retakes immediately rather than waiting a day for a rejection.
• Guidance. A short on-screen frame ("place the whole ID inside the box, avoid glare") reduces rejections more than any later automation.

Transport: uploading on unreliable Nigerian networks

Uploads fail in Nigeria for ordinary reasons: the user walks out of coverage, the network switches from 4G to 2G, the phone runs out of data mid-transfer. Design for this rather than hoping it will not happen.

• Resumable, chunked uploads. Split each file into chunks and upload with a protocol that can resume where it stopped (the tus protocol, or multipart upload on S3-compatible storage). A dropped connection then costs one chunk, not the whole file.
• Direct-to-storage with signed URLs. The server issues a short-lived upload URL and the phone sends the file straight to object storage. Your backend never becomes the bottleneck and hosting costs stay lower.
• Background upload and queueing. Queue files locally and continue uploading when the app is in the background or when the connection returns. Show per-file progress and a clear "waiting for network" state.
• Retries with backoff. Retry automatically a few times, then leave the file in the queue with a visible "retry" button.
• Idempotency. Give each upload a unique ID so a retry never creates a duplicate record on the server.

Offline queueing needs to be explicit in your scope document. It is the difference between an app that works in Lagos Island and one that works in Lokoja.

Storage and security: where the documents live

Uploaded documents in a Nigerian business app should be stored in private object storage, encrypted at rest, and served only through short-lived signed links to staff whose role permits it. Never store customer documents in a public bucket, on a shared drive or in a WhatsApp group. Storage options. Managed object storage is the practical choice: S3-compatible services (Amazon S3, DigitalOcean Spaces, Backblaze B2, Cloudflare R2), Firebase Storage, or a media service such as Cloudinary for image-heavy workloads. All are priced in USD per gigabyte stored and transferred, so exchange-rate movements affect the monthly bill. Security controls that belong in scope:

• Private buckets with no public read access.
• Signed download URLs that expire in minutes, generated per request.
• Encryption at rest (provider-managed keys are acceptable for most SMEs; regulated firms may need customer-managed keys).
• Role-based access: a loan officer sees applications assigned to them, an admin sees everything, a rider sees nothing. The guide to building a mobile app with multiple user roles covers the permission model.
• An access log recording who viewed or downloaded each document and when.
• Malware scanning on upload, because PDFs can carry payloads.
• A retention policy with automated deletion after the business purpose ends.

Data residency. The NDPA 2023 contains provisions on transferring personal data outside Nigeria. Most cloud storage regions are abroad, so document the legal basis for the transfer and, for regulated businesses, ask a data protection professional whether a Nigerian-hosted option is required. Do not treat this as settled without advice.

The review workflow and admin dashboard

The review workflow is what makes uploads useful. Staff need a web dashboard showing each application's checklist, the status of every document (pending, approved, rejected with reason), a one-tap "request re-upload" that notifies the applicant, and queue management so that nothing sits unreviewed for days.

• Checklists per process. A loan application needs four documents; a tenant screening needs three. Define these in the dashboard, not in code, so they can change without a release.
• Statuses and reasons. Rejection reasons should be a fixed list ("cut off", "blurry", "expired", "name mismatch") so applicants get a clear message and managers can see why rejections happen.
• Notifications. Push notification inside the app, with an SMS or WhatsApp fallback for users who have not opened the app. The guide to building a mobile app with notifications covers the delivery options.
• Assignment and SLA. Route applications to reviewers, show ageing, and flag anything older than an agreed number of hours.
• Optional extraction. OCR or an AI model can read the name, ID number and dates off a document to pre-fill fields and flag mismatches. Treat the output as a suggestion for a human reviewer; do not auto-approve on it.
• Audit trail. Every approval, rejection and view is logged with the staff member's identity.

The guide to building a mobile app with an admin dashboard covers how this backend is typically built alongside the app.

What changes in Nigeria: NDPA, document types and fraud

For a Nigerian business, the main differences when building document uploads are the legal duties under the Nigeria Data Protection Act 2023, the specific documents Nigerians actually hold, the condition of the phones and networks the documents travel through, and the fraud risk in edited or borrowed documents.

• NDPA 2023. An ID card, bank statement or certificate is personal data, and some contents (health records, biometrics) are sensitive. You need a lawful basis and a stated purpose, you should collect only what the purpose requires, and you must secure and eventually delete the data. Businesses processing significant volumes may have registration and data protection officer obligations with the NDPC. Verify your obligations with the Nigeria Data Protection Commission or a qualified adviser; this is not legal advice.
• Data minimisation in practice. Do not ask for a BVN document image if a BVN number and consent for verification will do. Do not collect a passport data page for a process that only needs proof of address.
• Document types. Build the checklist around what Nigerians actually carry: NIN slip or NIN card, voter's card, driver's licence, international passport, utility bills, bank statements from banking apps, CAC certificates and status reports for businesses, and letters of employment. Each has a different shape and legibility problem.
• Phones and data. Low storage and expensive data mean the app must compress before upload and clean up temporary files. Do not keep full-resolution copies on the phone.
• Fraud. Edited PDFs and borrowed IDs are common. Pair uploads with a live selfie where identity matters, compare names across documents, check bank statement totals against the transaction lines, and keep humans in the approval loop. For regulated KYC, the guide to building a fintech app in Nigeria covers the verification providers used for NIN and BVN checks.
• Staff behaviour. The biggest leak is a staff member downloading an ID and sending it on WhatsApp "to check something". Signed links that expire, no bulk download, and a visible access log change behaviour.

How to build it: step by step

1. Write the checklist for each process: which documents, which formats, which are mandatory, who reviews them, and the retention period.
2. Confirm the legal basis and NDPA position with a qualified adviser, including whether foreign cloud storage is acceptable for your category of data.
3. Design the capture screens: document-scanning mode, file picker, guidance frames, on-phone validation and compression.
4. Choose storage and set it private: S3-compatible or Firebase Storage with encryption at rest and signed URLs.
5. Build resumable, direct-to-storage uploads with a local queue, background transfer and retries.
6. Build the backend: application records, document records, statuses, reasons, assignment, access logs and the notification pipeline.
7. Build the review dashboard with checklists, queue ageing and one-tap re-upload requests.
8. Add malware scanning and retention automation.
9. Test on entry-level Android phones with throttled networks, including killing the app mid-upload and switching off data.
10. Pilot with one branch or one process, measure rejection rates and reasons, then adjust guidance and checklists.
11. Train staff on document handling and publish a short privacy notice inside the app.

Example (hypothetical): a microfinance lender in Ibadan

Example (hypothetical): a microfinance institution in Ibadan processes small business loans across Oyo and Osun. Applicants currently send photos of their ID, a utility bill, three months of bank statements and a passport photograph to a loan officer's WhatsApp. Files get lost, statements arrive as twelve separate screenshots, and head office cannot see how long applications sit with each officer. The build: a Flutter app with a document-scanning camera mode and a file picker; a four-item checklist per application; compression to under 500 KB per page; resumable direct-to-storage uploads with an offline queue; private storage with signed links; a web dashboard where officers review documents, reject with fixed reasons and request re-uploads that trigger a push notification and an SMS fallback; an access log per document; and automated deletion of documents from declined applications after the retention period the lender sets with its adviser. What the lender would measure: the share of applications with all four documents accepted first time, the average time from submission to decision, and how many re-upload requests are resolved within a day. This scope sits in the middle of the cost table below.

How much does a document upload app cost in Nigeria?

For a Nigerian business in 2026, adding a document upload feature with basic review to an existing app is indicatively ₦400,000–₦2,000,000; a simple standalone app whose main job is collecting and reviewing documents is ₦2,500,000–₦6,000,000; and a full onboarding or KYC app with resumable uploads, a review dashboard, notifications, access logs and retention automation is ₦6,000,000–₦15,000,000. Figures are indicative and vary with scope, vendor and exchange rate.

Indicative 2026 ranges; actual quotes vary with scope, vendor and exchange rate. Recurring costs: object storage and bandwidth (USD per GB per month; a few thousand documents at 500 KB each is small, but retention policy decides growth); hosting for the backend (roughly ₦150,000–₦800,000+ per year); SMS or WhatsApp notification charges; OCR or AI extraction usage in USD if used; and maintenance at typically 15–25% of the build cost per year. What drives cost: number of distinct processes and checklists, resumable and background uploads, OCR or identity verification, the depth of the review dashboard, and compliance features such as access logs and retention automation. When comparing quotations, ask each vendor to state explicitly whether offline queueing, signed URLs, access logging and re-upload requests are in scope; these are the items most often quietly excluded.

Mistakes to avoid

• Storing documents in a public bucket or on a shared drive. It is the most common serious failure and it is an NDPA breach waiting to be discovered.
• Uploading full-resolution photos. Uploads fail, data costs rise and storage bills grow for no benefit in legibility.
• No re-upload workflow. Without it, staff fall back to WhatsApp to ask for a clearer copy, and the app loses its purpose.
• Collecting more documents than the process needs. More friction for applicants and more liability for you.
• Auto-approving on OCR output. Extraction errors and edited documents make this a fraud channel.
• Ignoring retention. Documents from declined applications kept indefinitely are pure risk.
• Testing only on Wi-Fi. The failure modes that matter appear on a weak mobile connection with the app in the background.

Conclusion

A document upload feature succeeds on the parts users never see: uploads that finish on a poor connection, storage that keeps customer IDs private, and a review workflow that gets a clear answer back to the applicant quickly. Define the checklist for each process, compress and validate on the phone, upload in resumable chunks to private storage, build the review dashboard with fixed rejection reasons and re-upload requests, and take the NDPA seriously from the first design session rather than after the first complaint. If you are planning a loan, onboarding, admissions or HR app that depends on document collection and want the capture, storage and review workflow scoped properly, Linestech builds mobile apps and secure backends for Nigerian businesses and can review your requirements before you commit.

Frequently asked questions

Can users upload documents they received on WhatsApp?

Yes, if the app's file picker accepts images and PDFs from the phone's gallery and downloads folder, where WhatsApp saves media. Expect quality to be lower than a scan taken in the app, so validate legibility on the phone and keep the re-upload request one tap away for reviewers.

What file size limit should the app allow?

Set a per-file limit that suits the document rather than the phone: a compressed page image of 300–600 KB is legible, and a bank statement PDF is usually under 2 MB. Compress on the phone before upload and reject anything far above the limit with a message explaining why. Large limits mostly produce failed uploads on mobile data.

Is it safe to store customers' ID documents in the cloud?

It can be, if the storage is private, encrypted at rest, accessed only through expiring signed links, restricted by role and logged. The risk usually comes from configuration and staff behaviour, not the cloud itself. Confirm with a data protection adviser whether storing the data outside Nigeria is acceptable for your business category under the NDPA 2023.

Do I need consent to collect documents under the NDPA?

You need a lawful basis, which may be consent, a contract with the person, or a legal obligation such as KYC rules, plus a clear privacy notice stating the purpose. Consent is not the only basis, and choosing the wrong one creates problems later. Verify your position with the Nigeria Data Protection Commission's guidance or a qualified adviser.

Can the app read information off an ID automatically?

OCR and document-understanding models can extract names, numbers and dates from clear images and pre-fill forms. Accuracy drops on glare, worn cards and low-end camera photos, and edited documents will pass OCR. Use extraction to speed up human review and flag mismatches, not to make approval decisions on its own.

How long should we keep uploaded documents?

As long as the business purpose and any regulatory rule require, and no longer. A declined loan application and a rejected tenant have no ongoing purpose, so schedule deletion. Regulated businesses may have minimum retention periods for approved customers. Set the periods with your adviser and automate deletion so it actually happens.

Sources and further reading

Figures, platform rules and regulations change. These are the primary references behind this article and the places to check before you act on it.

• Corporate Affairs Commission (CAC)
• Nigeria Data Protection Commission (NDPC)
• Core Web Vitals — web.dev
• Firebase documentation
• Node.js documentation
• OWASP Top 10