SAP Analytics Cloud Security & Privacy Scorecard

Android

91
Overall trust score
Very Secure
88
Security
98
Privacy

Data flows between the app and the user's organization SAP backend over HTTPS. Firebase Installations registers a device identifier with Google as part of app setup. Enterprise usage telemetry is collected only when enabled by an organization administrator and requires a consent screen before activation.

Best for

Enterprise finance teams on SAP deployments

Findings

  • 0 critical
  • 0 high
  • 2 medium
  • 2 low
  • 2 info

1 issue identified across security and privacy analysis.

Top security issues

  • AES-GCM IV Stored and Reused Across Encrypt Operations
  • PBKDF2WithHmacSHA1 with Only 1,000 Iterations for User Passcode Key Derivation
  • WebView JavaScript Bridge Exposed to Remote SAP Cloud Content Without Origin Validation

Top privacy issues

  • Android ID (ANDROID_ID) Transmitted as X-SMP-DEVICEID on Every SAP Mobile Platform Request
  • SAP Foundation Telemetry Collects Device and App Metadata (Enterprise Policy-Gated)
  • Production Logback File Appender Logs OAuth Error Bodies; User-Enabled Debug Mode Amplifies Exposure

Full analysis

SAP Analytics Cloud

What This Means for You

Strong encryption protects your business data in transit and on your device, and any usage telemetry sent to SAP is controlled by your enterprise administrator.

Recommendation: Very Secure

Purpose-built for secure enterprise analytics access. Strong encryption, HTTPS enforcement, and admin-controlled privacy policies protect authorized corporate users.

Best For: Enterprise employees on MDM-managed corporate devices accessing SAP Analytics Cloud

Key Findings

Data Security - 3 findings (2 medium, 1 low)

Network Security - 0 findings

Code Safety - 1 finding (1 low)

Privacy - 2 findings (2 info)

Privacy Concerns

What Data is Collected

  • Device information: Your device identifier and model details are sent to SAP's servers on every connection.
  • Usage data: When your enterprise administrator enables telemetry, app usage activity, timestamps, and device details may be sent to SAP.
  • No location, health, or personal contact information was identified as leaving the device.

Third-Party Data Sharing

The following third parties may receive your data:

  • SAP SE - Receives your device identifier with every session and may receive usage telemetry when enabled by your administrator.
  • Google (Firebase) - May receive a Firebase Installation ID when enterprise telemetry is active.

Understanding the Scores

Security: 88/100
Privacy: 98/100

Security Breakdown

  • Data Security: 81/100 - Local data is secured with strong database encryption. The method used to derive encryption keys from your passcode and how certain encryption values are managed could be hardened to better protect data on a lost or stolen device.
  • Network Security: 95/100 - All connections to SAP's backend use secure, encrypted channels with strong protection throughout.
  • Code Safety: 97/100 - The codebase demonstrates strong security practices throughout, with hardware-backed protections for sensitive operations.

Privacy Breakdown

  • Data Collection: 100/100 - The app requests only the minimum information needed for its enterprise analytics function.
  • Data Sharing: 100/100 - Data that leaves your device is limited to SAP's own infrastructure, with no sharing to advertising networks or unrelated third parties.
  • User Control: 100/100 - Your enterprise administrator holds full authority over data policies, and the app respects those controls completely.

Positive Security Features

  • Local database uses strong encryption to protect stored business data
  • All SAP backend communications are enforced over secure, encrypted connections
  • Enterprise telemetry is gated by server-side admin policy with a consent screen shown before app access
  • Hardware-backed key storage protects the auto-unlock path on compatible devices

Areas for Improvement

GDPR / CCPA Compliance

The app's privacy practices could be strengthened by:

  1. Stronger Passcode Key Derivation
    Increasing the number of iterations used to derive encryption keys from passcodes would make them significantly more resistant to offline guessing attacks if a device is lost or stolen.

  2. Encryption Value Freshness
    Using a freshly generated value for each encryption operation, rather than storing and reusing the same value, would strengthen local data protection.

Security Enhancements

  1. Debug Logging Controls
    Requiring administrator authorization before users can enable verbose logging would reduce the risk of sensitive operational details appearing in device logs.

  2. Web Layer Request Validation
    Verifying the origin of requests before processing commands from the embedded web layer would add a further layer of defense for the native interface.

Technical Context

App Type: Enterprise business analytics (sensitive corporate data)
Classes Analyzed: 2,800
Third-Party Services: 16 identified
Context Tags: enterprise, sensitive_data

About This Analysis

This security analysis was conducted by CITT (Can I Trust That), an independent security analysis service. We perform static code analysis on Android applications to help users make informed decisions about app security and privacy.

App Details

Developer: SAP SE
Version: 1.55.0
Analysis Date: 2026-06-13
Package: com.sap.epm.fpa

Analysis Limitations

  • Static analysis only (code review without running the app)
  • Based on APK version 1.55.0 analyzed on 2026-06-13
  • May not reflect server-side security controls
  • Cannot detect all runtime behaviors

Versions & scan history

ScanDateOverall score
#1 (current) 91/100