CITT

    Scan results

    APCOA Connect – Parking

    Android

    APCOA Connect offers seamless parking and EV charging payment through a mobile app available at 300+ UK locations. Book, pay, and manage your parking sessions with vehicle tracking and tailored rewards.

    CITT SCORE
    70
    out of 100
    TRUSTish

    Quick Verdict

    Best for: Drivers who pay for parking on the go

    What It Means For You

    Payment activity goes through Judo Payments, and location is processed via Google Maps and Google Pay. Some data is stored with moderate protections, so avoiding saving sensitive information beyond what the app requires is a reasonable precaution.

    Method and Limitations

    Static analysis only. CITT reviewed the code of this build without running the app, so runtime behavior was not observed. The findings below describe the analyzed build and may not reflect server-side controls or later versions. CITT makes no determination about compliance with any law or platform policy; it reports what the artifacts contain and cites the published guidance so a reader can compare.

    How CITT scores an app

    Findings (9)

    Data Security

    5 total
    3 High
    2 Medium

    Code Security

    3 total
    1 Medium
    2 Low

    Privacy

    1 total
    1 Medium

    Third-Party Services

    Judo Payments, Google Maps, Google Pay, ML Kit Barcode, Expo SDK, React Native

    Security Strengths

    • ✓Certificate pinning implemented
    • ✓TLS 1.2/1.3 enforced
    • ✓Cleartext traffic disabled
    • ✓Android KeyStore used for biometric authentication
    • ✓SQL injection protection via parameterized queries
    What changed since the last scan

    Version diff is on the Developer plan. See developer plans.

    Context Tags

    financial
    location
    camera
    payment
    sensitive data

    Package

    com.apcoaconnect

    Version

    9.2.0 (90200)

    Analysis Date

    Mar 4, 2026

    Classes Analyzed

    18,155

    Was this analysis helpful?

    Feedback helps us improve our analysis

    View on Play Store

    Recommendation: Acceptable

    Key Findings

    Data Security - 6 findings (3 high, 2 medium, 1 info)

    Network Security - 0 findings

    Code Safety - 0 findings

    Privacy - 1 finding (1 medium)

    Privacy Concerns

    What Data is Collected

    APCOA Connect collects user location, payment details, and in-app activity. Device identifiers are also gathered as part of normal app operation.

    Third-Party Data Sharing

    User data is shared with the following third-party services:

    • Judo Payments - Processes parking payments
    • Google Maps - Powers location and mapping features
    • Google Pay - Handles payment transactions
    • ML Kit Barcode - Reads barcodes scanned within the app
    • Expo SDK / React Native - Core framework underpinning the app

    Understanding the Scores

    CategoryScore
    Security68/100
    Privacy72/100
    Data Security58/100
    Network Security100/100
    Code Safety88/100
    Data Collection65/100
    Data Sharing78/100
    User Control100/100

    Positive Security Features

    • All data transmitted between the app and remote services is sent over secure connections.
    • Users have full control over their data and privacy choices within the app.
    • The app's code is well-constructed with few safety concerns.

    Areas for Improvement

    • How payment and account data is stored on the device could be better protected against local access.
    • The app collects a broader range of information than a parking service strictly requires, which increases the amount of user data at risk.
    • Data storage practices could be tightened to give personal details stronger at-rest protection.

    About This Analysis

    This scorecard is produced through automated static analysis of the app's code and configuration. Scores reflect the security and privacy practices observed at the time of the scan.

    App Details

    • App: APCOA Connect - Parking
    • Package: com.apcoaconnect
    • Version: 9.2.0 (90200)
    • Scan Date: 2026-03-04
    • Platform: Android

    Right of Reply

    Developer not yet contacted