Back to the blog Business apps

Will Your Self-Hosted Business App Work Offline? A Practical Evaluation Checklist

Learn how to test whether a self-hosted business app can truly support offline work—not just display cached pages—and assess synchronization, conflicts, authentication, attachments, and device risk.

Operations team testing a business application offline on a laptop and phone

Start by defining what “offline” means for your team

Offline requirements vary. A brief Wi-Fi interruption during a site visit is different from working for a full shift with no reliable connection, and both differ from operating at a location with no expected connectivity for days.

Write down the longest likely disconnection, how many people may work offline at once, what data they need, and how quickly changes must reach colleagues. Include your actual devices and browsers: offline behavior can vary by application and browser, and some browser background-sync capabilities are not available everywhere.

Set an acceptable recovery expectation. For example, decide whether staff must complete a task immediately offline, or whether it is acceptable to record a draft and finish it after reconnecting. These are different requirements and may point to different tools.

  • Occasional interruption: the app should preserve in-progress work and recover gracefully when the connection returns.
  • Extended disconnection: users may need to view and edit a useful set of records and submit actions later.
  • No reliable internet: consider whether an offline-capable app or a local deployment is necessary, rather than assuming a cloud-hosted service will meet the need.
Start by defining what “offline” means for your team

Separate cached access from completing a workflow

A page that opens offline is not proof that the work can be completed. A web app can cache page assets or previously viewed content, but the application determines how each request is handled. Cached pages may be stale, incomplete, or read-only.

Test the whole task, not just the screen. Can a user find the right record, edit it, add a note, submit the change, and see a clear confirmation while disconnected? Does the app save a draft locally, queue a request, or simply show an error? Ask the vendor to explain the exact behavior for each critical action.

Treat these as separate capabilities: viewing previously stored content, editing it offline, queuing changes for later, and completing an end-to-end workflow without a server connection. Do not infer one from another.

  • Offline access: which records and reference pages are available, and how recently were they refreshed?
  • Offline editing: which fields or actions can be changed without a connection?
  • Queued submission: where is the pending change stored, and how does the user know it has not yet reached the server?
  • Workflow completion: which steps still require the server, such as approval, validation, or generating a shared result?
Separate cached access from completing a workflow

List the records, attachments, and reference material users need

Build a short inventory based on real work rather than a general request for “offline mode.” Name the specific record types, the fields people change, and the reference information they consult. Include attachments such as photos or documents, and test them separately from ordinary text.

Ask how users choose data to make available before going offline. Is it downloaded automatically, or must a user open or select it first? Check whether records remain accessible for the full expected offline period and whether the app makes the age of local data visible.

Browser storage has limits and differs across browsers and devices. Stored data can be removed under storage pressure. Verify that the app handles missing local data clearly and determine whether the business can tolerate re-downloading records or attachments before work begins.

  • Identify essential records and the minimum fields needed to act on them.
  • List required photos, files, forms, maps, procedures, or other reference material.
  • Check approximate offline data volume and the device storage available to staff.
  • Test whether the app indicates what has been downloaded and when it was last updated.
  • Decide what a user should do if required offline content is missing.

Verify synchronization, retries, and conflict handling

A queued action is not necessarily a safely synchronized action. Find out what triggers synchronization: an automatic browser process, opening the app, a user pressing a sync button, or another step. Background synchronization is not supported in every widely used browser, so test the actual combinations your team uses.

Ask what happens if the connection drops during an upload, or if the app cannot tell whether a request reached the server. Retrying a state-changing action can create duplicate effects unless the application can safely identify a repeat or determine whether the first attempt succeeded. Test actions such as creating a record, submitting a form, or uploading an attachment for duplicate results.

Conflicts can arise when someone edits the same record online while another person changes an offline copy. The application needs a defined approach: it might show competing versions, merge changes, or ask a user to review and edit again. Establish which data wins, who resolves the conflict, and whether the original values remain available for review.

  • Can users see pending, completed, and failed sync actions?
  • Are failed uploads retried, and can a user safely retry manually?
  • How does the app prevent duplicate records or repeated submissions?
  • What happens when the same record changes on two devices before they reconnect?
  • Can a user inspect and resolve conflicts, or does the app apply a rule automatically?
  • What happens if the browser or device closes before the queued work is sent?

Test authentication, permissions, and shared devices

Include login and access-control cases in the evaluation. Find out whether a user can open already-downloaded data after an authentication session expires, and what the app allows them to do until it reconnects. A device that is offline cannot check with the server for newly changed permissions, so confirm how the application handles that gap and how promptly access changes take effect after reconnection.

Pay special attention to shared or shift-based devices. Determine whether one person can see another person’s locally stored records or pending changes, what sign-out does to local data, and how users distinguish their own unsent work. Do not assume that a sign-in screen protects information already stored in the browser.

Offline access creates a local copy of business information. OWASP warns that users with access to a machine may be able to access browser-stored data, and advises against storing sensitive information or session identifiers in local storage. Ask the application provider what it stores on-device and assess whether that is appropriate for your data.

  • Test expired sessions while online and offline.
  • Test a permission change, account disablement, and user sign-out, then reconnect.
  • Check whether one device user can access another user’s cached data or queued actions.
  • Document the sensitivity of locally stored records and who can access the device.

Include attachments and device loss in the risk assessment

Offline support is also a data-governance decision. A device may hold records and attachments that are not on the server yet. Decide what information may be stored locally, for how long, and which users and devices are allowed to carry it.

Ask whether local data is encrypted and what device controls your organization requires. NIST mobile-device guidance recommends encryption for stored data and describes remote wiping as a measure when a device may be lost, stolen, or otherwise in untrusted hands. Check whether your device-management process can meet the requirements for the devices staff actually use.

Document a lost-device response. Include how to report the loss, disable access where possible, handle locally stored data, and identify whether unsynchronized work could be lost. The application’s offline feature does not replace your organization’s access, retention, and incident procedures.

  • Classify the data and attachments that could be stored on each device.
  • Set device encryption, screen-lock, and management requirements appropriate to your organization.
  • Confirm what remote actions are available and what they can or cannot remove.
  • Define how staff report a lost device and how pending work is recovered or recreated.

Run a controlled offline test with representative work

Use a test account, representative records, and the same browser and device models your team plans to use. Start online, prepare the data that is supposed to be available offline, and confirm what the app says is ready. Then disconnect the network deliberately and carry out the agreed critical tasks.

Reconnect and wait for the documented synchronization trigger. Check both the user interface and the server-side result: confirm that intended changes arrived, failed work is visible, attachments are complete, and no action was duplicated. Repeat the test with a conflict and an interrupted upload. Record the exact steps and results so the team can rerun the test after configuration or application changes.

Do not test only an ideal, short interruption. Include the expected maximum offline period and conditions such as closing and reopening the browser, restarting the device, or switching users where those situations are part of normal operations.

  • Prepare a test checklist for each critical workflow and expected result.
  • Disconnect the network and attempt the workflow from beginning to end.
  • Interrupt at least one upload or submission, then restore connectivity.
  • Check for missing changes, duplicate effects, unresolved conflicts, and clear user feedback.
  • Repeat on every browser and device combination the team will rely on.
  • Record limitations and decide whether they are acceptable, require a workaround, or disqualify the app.

Choose the deployment model that fits the work

Self-hosting describes who operates the application environment; it does not by itself provide offline data, offline editing, or synchronization. An app hosted on a server still needs a connection when its workflow depends on that server. Conversely, an application with carefully designed offline behavior may support selected tasks while disconnected, subject to its own limits.

Airbip manages cloud infrastructure for self-hosted applications: application instances run as Docker workloads on Airbip cloud servers, with routing and TLS certificates automated through Traefik and Let’s Encrypt, plus DNS checks, service lifecycle management, and configurable daily, weekly, and monthly backups. That hosting model does not add offline workflow capabilities to an application. Evaluate the app’s documented behavior separately, and consider whether users’ locations can reach the hosted service when work is online.

If users must complete essential work in places with no dependable connection, select an application and deployment model that demonstrably supports those workflows, or design an explicit offline procedure. If only occasional interruptions matter, a tested queue-and-sync workflow may be sufficient. If work requires immediate shared, server-validated actions, an online-only process with a clear fallback may be safer than claiming the workflow works offline.

  • Choose offline-capable software when critical tasks must be completed without a server connection.
  • Choose a tested deferred-sync workflow only when its conflict and duplicate-action behavior is acceptable.
  • Choose an explicit online-only workflow when actions require live server validation or shared current data, and provide a practical fallback for outages.
  • Treat hosting, application features, local device controls, and staff procedures as separate parts of the decision.

Frequently asked questions

Does self-hosting make a business application available offline?

No. Self-hosting concerns where and how the application is operated; offline access and synchronization depend on the application’s design and the data available on the user’s device. A self-hosted app that needs its server for a task will still need a connection for that task.

Is a cached page enough to call an app offline-capable?

No. Cached assets or pages may make some content viewable, but they do not prove users can edit records, submit actions, upload files, or finish a workflow. Test each critical task while disconnected and verify the result after reconnecting.

Can queued offline actions create duplicates?

They can if an action is retried after an uncertain failure and the application cannot safely determine whether it already succeeded. Test repeated submissions and interrupted connections, and ask how the app handles retries and duplicate prevention.

What should we test when an offline edit conflicts with an online edit?

Change the same record from two devices or users, with one edit made offline. After reconnection, verify whether the app presents both versions, merges changes, or asks for review, and confirm that users can identify and resolve the result.

Is browser storage reliable enough for critical offline data?

Do not assume so without testing. Browser storage limits and eviction behavior vary, and data may be cleared under storage pressure. Confirm how the app prepares and protects offline data, then test availability for the period and devices your team expects to use.

What should happen if a device with offline data is lost?

Have a documented response covering reporting, access control, device management, and locally stored data. Assess device encryption and remote-wipe options, and decide how to handle work that had not yet synchronized.

Sources and further reading

  1. Offline and background operation — Progressive web apps — MDN Web Docs
  2. Background Synchronization API — MDN Web Docs
  3. Retrying requests when back online — Chrome for Developers
  4. Storage quotas and eviction criteria — MDN Web Docs
  5. HTML5 Security Cheat Sheet — OWASP
  6. RFC 9110: HTTP Semantics — Internet Engineering Task Force
  7. Replication and conflict model — Apache CouchDB
  8. Guidelines for Managing the Security of Mobile Devices in the Enterprise — National Institute of Standards and Technology
  9. Service Worker API — MDN Web Docs