How to Secure Your FlutterFlow App's Data

Open the Firebase Console, select your project, navigate to Firestore Database, and click the Rules tab. If your rules contain allow read, write: if true; — your database is completely open to the public internet. Replace this immediately. The correct starting point for most FlutterFlow apps is to allow read and write only when the requesting user is authenticated and the document's userId field matches their auth UID. For admin-only collections, require a custom claim. After editing, click Publish. FlutterFlow does not manage Firestore Security Rules — you must edit them directly in the Firebase Console or via the Firebase CLI.

1rules_version = '2';
2service cloud.firestore {
3  match /databases/{database}/documents {
4
5    // Users can only read/write their own profile
6    match /users/{userId} {
7      allow read, write: if request.auth != null && request.auth.uid == userId;
8    }
9
10    // Users can only access their own records in any collection
11    match /{collection}/{docId} {
12      allow read, write: if request.auth != null
13        && resource.data.userId == request.auth.uid;
14      allow create: if request.auth != null
15        && request.resource.data.userId == request.auth.uid;
16    }
17
18    // Admin-only collection — requires custom claim
19    match /admin_settings/{docId} {
20      allow read, write: if request.auth != null
21        && request.auth.token.admin == true;
22    }
23  }
24}

Firebase automatically encrypts all Firestore data at rest using AES-256 and all data in transit using TLS 1.3. You do not need to enable these — they are on by default and cannot be disabled on standard Firebase projects. To verify: open Firebase Console, go to Project Settings, and check the Google Cloud project ID. In the Google Cloud Console under Security, confirm the project has not disabled default encryption. For sensitive fields like medical data or private notes, consider field-level encryption using a Cloud Function that encrypts values with a key stored in Google Secret Manager before writing to Firestore. This way, even a compromised Firestore rule cannot expose plaintext.

In the Firebase Console, go to Firestore Database and click the Import/Export tab. For automated daily backups, open Google Cloud Console, navigate to Cloud Scheduler, and create a new job. Set the schedule to 0 2 * * * (daily at 2 AM), the target type to HTTP, and the URL to the Firestore export REST endpoint: https://firestore.googleapis.com/v1/projects/YOUR_PROJECT_ID/databases/(default):exportDocuments. Set the request body to include your Cloud Storage bucket URI as the outputUriPrefix. Grant the Cloud Scheduler service account the Cloud Datastore Import Export Admin role in IAM. Exports are stored as .overall_export_metadata files in your Cloud Storage bucket.

Open FlutterFlow's Firestore panel and review every field in every Document Type. Delete fields that your app never reads. Common over-collection mistakes in FlutterFlow apps include storing full address strings when only city is needed, saving raw phone numbers when only verification status matters, and keeping failed payment attempt details when only the final status is relevant. In FlutterFlow's Create/Update Document actions, uncheck any fields you are not intentionally setting — this prevents accidental writes of empty or default values. Add a Firestore Security Rule validation using request.resource.data.keys() to allowlist which fields can be written, rejecting unexpected fields.

If your FlutterFlow app handles payments, never write card numbers, CVVs, or expiry dates to Firestore. This is not just a best practice — storing raw card data without PCI DSS certification is illegal in most jurisdictions. Instead, use Stripe's Payment Intent flow: the Stripe SDK on the client collects card details and exchanges them for a PaymentMethod ID (pm_xxx) which is safe to pass to your server. In FlutterFlow, call a Supabase Edge Function or Firebase Cloud Function with the PaymentMethod ID and customer ID. The Cloud Function calls Stripe's API server-side to confirm the payment. Store only the Stripe customer ID (cus_xxx) and subscription status in Firestore — never the raw payment method details.