Can I trust MyNISSAN®?

Trust checks

• Secure by Design

  ● Strong

  Strong security foundation

  Why this result

  This check looks for security issues at high severity or above in the code of this build, and none were recorded. Its scope covers stored credentials, how the app protects data on the device, and how it protects data in transit.

  The app disables iOS's built-in transport security enforcement globally, removing the operating system's guarantee that all network connections use encryption. All the app's identified production endpoints use encrypted connections, and the app applies meaningful security controls: Zimperium's runtime threat defense monitors the app against tampering and phishing, chat session data is encrypted on device with a strong database cipher, the app uses Apple's authenticated encryption for app-layer data, and account credentials are protected by biometric authentication in the secure Keychain. Certificate pinning infrastructure is also present. The confirmed transport security bypass and the otherwise strong security posture produce genuinely mixed signals.

• Data Minimization

  ● Strong

  Tracking done right

  Why this result

  The check looks at analytics and attribution code for companies other than the developer: the data it reads, the companies named in code as recipients, and whether a consent step runs before that code. In this build, either no such code was recorded, or a consent step runs before it and the app's own disclosures describe the collection.

  The Dynatrace configuration in the build sets user-linked behavioral data capture to start on launch without requiring user consent, and the Adobe Analytics SDK includes code to store a persistent visitor identifier and send behavioral events to Adobe's servers. Four analytics services run simultaneously with no unified consent framework evident in the code. Firebase Analytics is fully deactivated, a deliberate and responsible choice. The concerning SDK consent configurations exist alongside the app's intentional disabling of Firebase, producing mixed signals on whether the overall consent approach is sound.

• Manifest Mismatch

  ◐ One criterion not met

  Disclosure incomplete or contradicted

  Why this result

  The check compares the app's privacy disclosures against what the code does, and at least one claim did not match in this build. Mismatches of this kind include a data category collected but not disclosed, a recipient the disclosure omits, and an identifier attached to data the disclosure describes as anonymous.

• User Control

  ● Strong

  No lock-in

  Why this result

  The check looks for a way to export the data an account has accumulated and a way to delete the account itself. In this build, either both were found, or the app has no account of its own and keeps its data on the device. For an app without an account, the developer has no server-side copy to export or delete, and deleting the app removes the data in its own storage.

  No artificial barriers to leaving the service were identified. The app does not rely on proprietary data formats that would trap user content, and no code patterns suggesting obstacles to account deletion or service switching were found.

What the app contains

• 17 services

  Third-party services the scan names in the build:

  • Dynatrace
  • Firebase Crashlytics
  • Firebase Remote Config
  • Firebase Installations
  • ZDefend (Zimperium)
  • Branch.io
  • Adobe Experience Platform Analytics
  • Apptentive
  • Google Maps SDK
  • Google Places SDK
  • Salesforce Mobile SDK (SMIClientCore)
  • Apollo GraphQL
  • AndroidAutoUKey2Wrapper (BoringSSL)
  • Google Tag Manager
  • AdSupport (IDFA)
  • SKAdNetwork
  • AdServices (Apple)

Method and limits

Static analysis: the decompiled code, manifest and resources of this build, read file by file. Network traffic at run time is established by a capture of the running app.

Scan date

30 August 2026

Corrections

No correction is published for this app.