CITT

    Scan results

    Sage Self Service

    Android

    Sage Self Service for Sage 300 People empowers you as an employee or manager to have on-demand access to HR information from the comfort of your mobile device. You can apply for leave, view your latest payslip and approve leave requests anytime anywhere.

    CITT SCORE
    81
    out of 100
    TRUSTED

    Quick Verdict

    Best for: Employees managing HR and payroll on the go

    What It Means For You

    Data stays largely within the app with minimal sharing to outside parties. A small set of standard libraries handles user information, and no advertising or marketing trackers were detected. Workplace data, including payroll and HR details, is not being passed to third-party ad networks.

    Method and Limitations

    Static analysis only. CITT reviewed the code of this build without running the app, so runtime behavior was not observed. The findings below describe the analyzed build and may not reflect server-side controls or later versions. CITT makes no determination about compliance with any law or platform policy; it reports what the artifacts contain and cites the published guidance so a reader can compare.

    How CITT scores an app

    Findings (15)

    Data Security

    4 total
    1 High
    2 Medium
    1 Info

    Network Security

    3 total
    1 High
    1 Medium
    1 Low

    Code Security

    4 total
    1 Low
    3 Info

    Privacy

    2 total
    1 Low
    1 Info

    Third-Party Risk

    1 total
    1 Info

    Permission Usage

    1 total
    1 Low

    Third-Party Services

    Microsoft .NET MAUI, Google Tink, AndroidX Security Crypto, AndroidX BiometricPrompt, ZXing.Net.MAUI, Lottie Android, MPowerKit.Lottie, Glide, OkIO, Google Gson, Google Material Design, AndroidX CameraX, Kotlin Coroutines, AndroidX Window

    Security Strengths

    • ✓No JavaScript bridge exposed — WebView attack surface minimal
    • ✓android:allowBackup="false" prevents cloud and ADB backup of HR data
    • ✓No analytics or tracking SDKs — minimal data collection footprint
    • ✓EncryptedSharedPreferences with AES-256-GCM backed by hardware Android Keystore (API 23+)
    • ✓No hardcoded secrets in visible Java/resource layer
    What changed since the last scan

    Version diff is on the Developer plan. See developer plans.

    Context Tags

    financial
    sensitive data
    enterprise
    hr
    contacts
    camera

    Package

    com.sage.mobileess

    Version

    3.1.172 (versionCode 172)

    Analysis Date

    Apr 7, 2026

    Classes Analyzed

    5,874

    Was this analysis helpful?

    Feedback helps us improve our analysis

    View on Play Store

    Recommendation: Trustworthy

    Key Findings

    Data Security - 4 findings (1 high, 2 medium, 1 info)

    Network Security - 3 findings (1 high, 1 medium, 1 low)

    Code Safety - 0 findings

    Privacy - 2 findings (1 low, 1 info)

    Privacy Concerns

    What Data is Collected

    Employment details, payroll figures, and HR records are processed locally within the app. Camera access supports document capture and QR code scanning for time-and-attendance and identity verification workflows. Usage data serves the app's core operational functions, including authentication and payroll display.

    Third-Party Data Sharing

    User information is handled by a limited set of utility libraries covering image display, local data storage, and layout rendering. These components serve functional purposes only. HR and payroll data is not routed to advertising networks, data brokers, or third-party analytics platforms.

    Understanding the Scores

    CategoryScore
    Security75/100
    Privacy94/100
    Data Security74/100
    Network Security70/100
    Code Safety94/100
    Data Collection96/100
    Data Sharing100/100
    User Control95/100

    Positive Security Features

    • Biometric authentication protects access to the account and sensitive payroll information
    • Encrypted local storage keeps HR data secured on the device
    • A dedicated data protection library (Google Tink) is used to safeguard data operations
    • HR and payroll data is handled exclusively by the app's core functions, with no routing to advertising or tracking ecosystems

    Areas for Improvement

    • Some network connections could use stronger protections to better secure data as it travels between the device and company servers.
    • Local data storage settings could be further hardened to reduce exposure on shared or lost devices.
    • A small number of configuration patterns follow older practices that would benefit from modernization to align with current standards.

    About This Analysis

    Static analysis of the app's code and configuration was used to identify security and privacy characteristics. This scorecard reflects the state of the app at the time of the scan.

    App Details

    • Package: com.sage.mobileess
    • Version: 3.1.172 (build 172)
    • Scan Date: April 7, 2026
    • Platform: Android

    Right of Reply

    Developer not yet contacted