CITT

    Scan results

    ONECTA

    Android

    ONECTA is Daikin's smart home heating and cooling controller app, enabling remote monitoring and control of connected Altherma heat pumps and air conditioning units with scheduling, energy tracking, and voice control support.

    CITT SCORE
    58
    out of 100
    TRUSTish

    Quick Verdict

    Best for: Controlling your Daikin AC from your phone

    What It Means For You

    Usage activity and device data are sent to Firebase Analytics and Google. Location is accessed to support device mapping features. Network protections have notable weaknesses, so using the app on untrusted Wi-Fi networks carries some risk to user account data.

    Method and Limitations

    Static analysis only. CITT reviewed the code of this build without running the app, so runtime behavior was not observed. The findings below describe the analyzed build and may not reflect server-side controls or later versions. CITT makes no determination about compliance with any law or platform policy; it reports what the artifacts contain and cites the published guidance so a reader can compare.

    How CITT scores an app

    Findings (16)

    Data Security

    4 total
    4 Medium

    Network Security

    2 total
    1 Critical
    1 High

    Code Security

    8 total
    1 Critical
    1 High
    4 Medium
    2 Low

    Privacy

    2 total
    1 High
    1 Low

    Third-Party Services

    Firebase Analytics, Firebase Messaging, Firebase Remote Config, Firebase In-App Messaging, Sentry, Google Play Services Maps, Google Play Services Location, Google Play Services ML Kit, Google Play Services Ads ID, Google Play Services Auth, AppAuth

    Security Strengths

    • ✓EncryptedSharedPreferences with AES-256-GCM
    • ✓Android KeyStore integration
    • ✓Backup disabled (android:allowBackup="false")
    • ✓Parameterized SQL queries (no SQL injection)
    • ✓Secure SSL error handling in WebView
    What changed since the last scan

    Version diff is on the Developer plan. See developer plans.

    Context Tags

    iot
    hvac
    smart home
    oauth
    location
    analytics
    ads
    sensitive credentials

    Package

    com.daikineurope.online.controller

    Version

    3.45.1-17247 (Build 34501001)

    Analysis Date

    Mar 25, 2026

    Classes Analyzed

    14,420

    Was this analysis helpful?

    Feedback helps us improve our analysis

    View on Play Store

    Recommendation: Use With Caution

    Key Findings

    Data Security - 4 findings (4 medium)

    Network Security - 2 findings (1 critical, 1 high)

    Code Safety - 0 findings

    Privacy - 3 findings (1 high, 1 medium, 1 low)

    Privacy Concerns

    What Data is Collected

    ONECTA collects usage activity, device identifiers, and location data. This information supports features such as device mapping and helps improve service performance.

    Third-Party Data Sharing

    Data is shared with the following third-party services:

    • Firebase Analytics and Firebase Remote Config (Google) - behavioral and usage data
    • Google Play Services (Maps, Location, Ads ID, Auth) - location and device identity
    • Sentry - error and diagnostic reporting
    • AppAuth - authentication support
    • Firebase Messaging and Firebase In-App Messaging - push notification delivery

    Understanding the Scores

    CategoryScore
    Security50/100
    Privacy77/100
    Data Security77/100
    Network Security52/100
    Code Safety57/100
    Data Collection79/100
    Data Sharing100/100
    User Control84/100

    Positive Security Features

    • The app's third-party data sharing practices received a perfect score, keeping user data within expected service boundaries rather than dispersing it broadly across advertising networks.
    • User control options scored well above average, giving users meaningful choices over how their data is handled within the app.

    Areas for Improvement

    • The app's network protections have serious weaknesses that could leave user account data less protected when connecting on public or untrusted Wi-Fi networks.
    • Some data the app stores on the device could be better secured to reduce the risk of other installed apps accessing it.
    • The app's code safety practices fall below average, which may affect how reliably the app protects user information across different usage situations.

    About This Analysis

    This scorecard reflects automated analysis of the app's compiled code as of the scan date. It is intended to help users make informed decisions about their app choices.

    App Details

    App NameONECTA
    Package IDcom.daikineurope.online.controller
    Version3.45.1-17247 (Build 34501001)
    Scan Date2026-03-25
    Total Findings17 (2 critical, 3 high, 9 medium, 3 low)

    Right of Reply

    Developer not yet contacted