CITT

    Scan results

    Salesforce

    Android

    Run your business from your phone or tablet with the Salesforce mobile app. Access the power of the world's #1 CRM platform and transform your business with real-time data and mobile-tailored Lightning apps. Built-in enterprise-grade security protects your data.

    CITT SCORE
    45
    out of 100
    unTRUSTED

    Quick Verdict

    Best for: Business teams on managed corporate devices

    Not For: Users storing sensitive work data on personal devices

    What It Means For You

    Device details and app crash data are automatically shared with Bugsnag's crash reporting service, and push notifications route through Google Firebase. The app leaves some data protections short of expectations, which could leave work communications and business data less protected than expected, making it a higher risk on personal or unmanaged devices.

    Method and Limitations

    Static analysis only. CITT reviewed the code of this build without running the app, so runtime behavior was not observed. The findings below describe the analyzed build and may not reflect server-side controls or later versions. CITT makes no determination about compliance with any law or platform policy; it reports what the artifacts contain and cites the published guidance so a reader can compare.

    How CITT scores an app

    Findings (27)

    Data Security

    5 total
    1 High
    3 Medium
    1 Low

    Network Security

    5 total
    1 Critical
    1 High
    3 Medium

    Code Security

    10 total
    2 Critical
    2 High
    1 Medium
    3 Low
    2 Info

    Privacy

    5 total
    1 High
    3 Medium
    1 Info

    Third-Party Risk

    2 total
    2 Medium

    Third-Party Services

    Bugsnag, Firebase Cloud Messaging, ML Kit (Barcode, Text Recognition, Document Scanner, Entity Extraction), Google Play Services

    Security Strengths

    • ✓SQLCipher AES-256-CBC encryption for SmartStore with hardware-backed keys
    • ✓OAuth tokens properly managed via Android AccountManager
    • ✓Backup disabled (allowBackup=false) prevents ADB extraction
    • ✓First-party analytics only (AILTN) with no third-party behavioral tracking
    • ✓Per-user data isolation with separate encrypted databases
    What changed since the last scan

    Version diff is on the Developer plan. See developer plans.

    Context Tags

    business
    crm
    enterprise
    sensitive data
    contacts
    location
    camera
    webview

    Package

    com.salesforce.chatter

    Version

    254.000.0 (Build 254000055)

    Analysis Date

    Feb 3, 2026

    Classes Analyzed

    35,279

    Was this analysis helpful?

    Feedback helps us improve our analysis

    View on Play Store

    Recommendation: Use With Caution

    Key Findings

    Data Security - 5 findings (1 high, 3 medium, 1 low)

    Network Security - 5 findings (1 critical, 1 high, 3 medium)

    Code Safety - 0 findings

    Privacy - 5 findings (1 high, 3 medium, 1 info)

    Privacy Concerns

    What Data is Collected

    The app collects device information and crash data to support diagnostics. Features including barcode scanning, text recognition, document scanning, and entity extraction process content directly on the device via Google ML Kit.

    Third-Party Data Sharing

    ServicePurpose
    BugsnagCrash reporting - receives device details and error logs
    Firebase Cloud MessagingDelivers push notifications to the device
    ML Kit (Barcode, Text Recognition, Document Scanner, Entity Extraction)On-device feature processing
    Google Play ServicesCore platform services

    Understanding the Scores

    CategoryScore
    Security35/100
    Privacy55/100
    Data Security60/100
    Network Security40/100
    Code Safety30/100
    Data Collection70/100
    Data Sharing85/100
    User Control65/100

    Positive Security Features

    • ML Kit features (barcode scanning, text recognition, document scanning, entity extraction) process data directly on the device rather than transmitting it to external servers.
    • Push notifications are routed through Google Firebase, a widely maintained and regularly updated platform.

    Areas for Improvement

    • Network communication protections need strengthening to better guard business data as it travels between the app and its servers.
    • Data storage and handling practices should be tightened to reduce the risk of sensitive work information being exposed on the device.
    • Greater transparency and user control over data collection and sharing practices would better protect user privacy.

    About This Analysis

    This report is based on automated static analysis of the app's published code and configuration.

    App Details

    • App: Salesforce
    • Package: com.salesforce.chatter
    • Version: 254.000.0 (Build 254000055)
    • Scan Date: 2026-02-03

    Right of Reply

    Developer not yet contacted