Scan results

Recommendation: Acceptable with Awareness

Booking uses biometric security and HTTPS for primary endpoints, but some cached data (messages, GraphQL responses) lacks encryption. Users should know their precise location and device identity are shared with fraud analytics vendors.

Key Findings

Data Security - 2 findings (2 medium)

Network Security - 5 findings (3 medium, 2 low)

Code Safety - 5 findings (1 medium, 3 low, 1 info)

Privacy - 6 findings (1 medium, 2 low, 3 info)

Privacy Concerns

What Data is Collected

• Personal information: name, email, account credentials, government ID documents (for identity verification flows)
• Device information: device ID, device fingerprint (via FingerprintPro and Riskified Beacon), advertising identifier
• Location data: precise GPS location (linked to your identity via Riskified fraud analytics)
• Usage data: booking history, browsing behavior, app interactions, search preferences
• Biometric data: facial comparison data (during identity verification via Au10tix)
• Payment information: payment method metadata, transaction history

Third-Party Data Sharing

The following third parties may receive your data:

• Riskified - fraud scoring (receives your precise location and device identity linked to your account)
• FingerprintPro - device fingerprinting for fraud prevention
• TMXProfiling - fraud detection and risk scoring
• BehavioSec - behavioral biometrics for fraud detection
• Klarna - payment processing and embedded payment UI
• Adyen - payment processing (3D Secure authentication)
• Stripe - payment processing
• PayPal - payment processing
• Au10tix - identity document scanning and biometric verification
• AppsFlyer - mobile attribution and marketing analytics
• OneTrust - consent management platform
• Firebase Crashlytics - crash reporting and app stability
• Google AdMob - advertising
• Zendesk - customer support
• Embrace - app performance observability
• RevolutAuth - embedded Revolut payment authentication

Understanding the Scores

Security: 88/100
Privacy: 87/100

Security Breakdown

• Data Security: 89/100 - Primary API data is well protected, though some cached messages and GraphQL responses on-device lack full encryption
• Network Security: 89/100 - Core booking and payment flows use HTTPS exclusively; a small number of legacy and CDN exceptions remain
• Code Safety: 94/100 - Strong biometric and Secure Enclave protections; minor development artifacts remain in the production binary

Privacy Breakdown

• Data Collection: 89/100 - Broad but expected data collection for a travel commerce platform; consent management is active via OneTrust
• Data Sharing: 90/100 - Data sharing with fraud analytics vendors (including linked precise location) warrants awareness
• User Control: 91/100 - OneTrust consent platform actively gates Firebase Analytics and ad signals; analytics opt-out is supported

Positive Security Features

• Biometric-protected Secure Enclave key storage - login credentials are held in hardware-backed storage that cannot be extracted from the device
• Active upgrade campaign migrating existing users to stronger biometric-bound storage (V1 to V2 migration)
• OneTrust consent management actively disables Firebase Analytics, Facebook SDK, and Google Ads signals when users decline tracking
• All primary booking, authentication, and payment endpoints use HTTPS exclusively
• Dedicated consent-aware analytics architecture - analytics collection is off by default and gated on explicit user consent

Areas for Improvement

GDPR / CCPA Compliance

The app's privacy practices could be strengthened by:

1. Riskified Precise Location Disclosure
   Users are not prominently informed that a fraud analytics vendor receives their precise GPS location linked to their identity. Clearer disclosure of this practice in the privacy policy and consent flow would strengthen transparency.

2. App Store Privacy Nutrition Label Completeness
   The app's privacy manifest does not include declarations for first-party data collection and tracking status, which may leave the App Store privacy label incomplete. Completing these declarations would give users a more accurate picture before installing.

3. Analytics Consent Signal Consistency
   A configuration flag enabling data upload to server-side analytics containers appears active alongside consent flags that disable client-side analytics collection. Aligning these flags ensures users who decline analytics are fully opted out across all collection paths.

Security Enhancements

1. On-Device Cache Encryption
   Conversation messages and travel data cached on-device use a weaker protection class that leaves them readable after the first device unlock. Applying stronger file protection to these caches would reduce exposure on physically compromised devices.

2. Development Configuration Cleanup
   Several development-only configurations (internal server hostnames, localhost telemetry endpoints, a test URL scheme) remain in the production binary. Removing these before App Store submission reduces the attack surface and improves build hygiene.

3. Klarna Payment Bridge Message Validation
   The embedded Klarna payment component's JavaScript bridge accepts cross-window messages without validating the sending origin. Adding origin validation to this bridge would prevent cross-frame interference with the payment flow.

Technical Context

App Type: Travel commerce platform with payment processing, identity verification, and fraud detection - high sensitivity
Classes Analyzed: 29
Third-Party Services: 26 identified
Context Tags: travel, financial, location, sensitive_data, ads, biometric, identity_verification

About This Analysis

This security analysis was conducted by CITT (Can I Trust That), an independent security analysis service. We perform static code analysis on iOS applications to help users make informed decisions about app security and privacy.

App Details

Developer: Booking.com B.V.
Version: 65.4 (Build 65.4.2453304889)
Analysis Date: 2026-04-18
Package: com.booking.BookingApp

Analysis Limitations

• Static analysis only (code review without running the app)
• Based on IPA version 65.4 analyzed on 2026-04-18
• May not reflect server-side security controls
• Cannot detect all runtime behaviors