a.s.r. Security & Privacy Scorecard
Android
In-app behavior is tracked by Microsoft Clarity and Tealium, which record how users interact with screens and buttons. User data passes through several third-party platforms including analytics and feedback tools. Users have limited control over what is collected, and user data may not be fully protected.
Best for
a.s.r. customers who need account access on the go
Findings
- 1 critical
- 5 high
- 8 medium
- 3 low
- 5 info
1 issue identified across security and privacy analysis.
Top security issues
- Exported OAuth WebView with universal file access and arbitrary URL injection enables complete private storage exfiltration by any app on the device
- SSL error handlers overridden with empty body in both WebView clients, silently suppressing TLS validation for authenticated sessions and OAuth flows
- JavaScript interface launches arbitrary URIs without validation, compounding the WebView attack surface for XSS-to-intent exploitation
Top privacy issues
- Microsoft Clarity session recording (including PIN entry screens) and AppCenter Analytics initialized before any user consent is obtained, in violation of GDPR Article 7
- OneTrust consent management does not disable native SDK tracking — user opt-out has no effect on Clarity, AppCenter, or Tealium data collection
- Advertising ID permissions (AD_ID, AdServices) present in an insurance app with no advertising purpose, enabling cross-app user tracking
Full analysis
a.s.r.
What This Means for You
In-app behavior is tracked by Microsoft Clarity and Tealium, which record how users interact with screens and buttons. User data passes through several third-party platforms including analytics and feedback tools. Users have limited control over what is collected, and user data may not be fully protected.
Recommendation: Use With Caution
Best For: a.s.r. customers who need account access on the go
Key Findings
Data Security - 7 findings (1 high, 3 medium, 1 low, 2 info)
Network Security - 6 findings (1 high, 1 medium, 2 low, 2 info)
Code Safety - 0 findings
Privacy - 2 findings (1 high, 1 medium)
Privacy Concerns
What Data is Collected
The app collects behavioral data about how users interact with it, including which screens are visited, which buttons are tapped, and how long users spend in each section. Crash reports and diagnostic information are also gathered. Device details and usage patterns are accessible to multiple analytics providers operating within the app.
Third-Party Data Sharing
User data is shared with the following third parties:
- Microsoft Clarity: Records user in-app interactions and screen activity for behavioral analysis
- Tealium: Manages and routes user behavioral data to connected marketing and analytics platforms
- Microsoft AppCenter: Receives app usage statistics and diagnostic reports
- Mopinion: Collects in-app feedback or survey responses users submit
- OneTrust: Handles consent preference management
- Firebase Messaging: Delivers push notifications to users' devices
- YouTube Player: Processes video playback activity when users view embedded content
Understanding the Scores
| Category | Score |
|---|---|
| Overall Security | 28/100 |
| Overall Privacy | 25/100 |
| Data Security | 48/100 |
| Network Security | 42/100 |
| Code Safety | 30/100 |
| Data Collection | 22/100 |
| Data Sharing | 55/100 |
| User Control | 20/100 |
Positive Security Features
- No notable positive security practices were identified for this version of the app.
Areas for Improvement
- The app shares user behavioral and usage data with multiple third-party platforms, giving users little visibility into what is collected, where it goes, or how it is used.
- Data handled by the app is not consistently protected during transmission, which means some user information travels with less protection than expected.
- The app provides very limited options for users to manage, restrict, or opt out of data collection, leaving users with minimal control over their information.
About This Analysis
Scores reflect the app's security and privacy posture based on the version analyzed. Individual scores range from 0 to 100, where higher scores indicate better practices.
App Details
| Field | Value |
|---|---|
| App Name | a.s.r. |
| Package ID | com.asr.mobileapp |
| Version | 1.4.9 (build 94) |
| Analysis Date | 2026-02-17 |
Versions & scan history
| Scan | Date | Overall score |
|---|---|---|
| #1 (current) | 26/100 |