My client has an android application requirement. The users of the application are workers who might have to work at places where internet connectivity is unavailable. So an offline login feature is necessary. At the moment, it is implemented by setting a pin code during the first sign in by a user into the app for a device. Next time when offline login is attempted, the pin is checked locally and guid is used to cross verify the device check and offline access is granted.
The user can use the app as normal, update any field he wants and the data is stored locally. When internet connectivity is restored the app will send them to the server. No other check is implemented here.
Is this secure enough from a security perspective? What things can be done here to improve the security of this feature?