Scan results

Recommendation: Use With Caution

Non-functional connection protection on the banking domains hosting your account data, combined with in-app web bridges that accept commands without verifying their source, create a meaningful network-level risk for active banking sessions. The app's underlying security stack is genuinely strong, with commercial runtime protection, encrypted strings, and self-hosted analytics, but the network-layer gaps need to be fixed before those strengths fully count. Users on private, trusted networks face lower risk than those on shared or public connections.

Key Findings

Data Security - 0 findings

Network Security - 2 findings (1 high, 1 medium)

Code Safety - 8 findings (3 medium, 1 low, 4 info)

Privacy - 4 findings (1 low, 3 info)

Privacy Concerns

What Data is Collected

• Personal information: name, email, account details used for banking
• Location data: precise GPS coordinates collected during identity verification (KYC onboarding)
• Device information: device model, operating system version, security patch level, network IP address
• Usage data: screen names, session timestamps, and in-app interactions via self-hosted analytics

Third-Party Data Sharing

The following third parties may receive your data:

• Fourthline (Netherlands, KYC vendor) - precise GPS location, IP address, device model and OS version, and device security state are sent during the identity verification flow
• Personetics - financial insight data including account transactions and balances passes through a Personetics-powered feature
• Bugsnag - crash reports and diagnostic information for app stability monitoring

Understanding the Scores

Security: 74/100
Privacy: 93/100

Security Breakdown

• Data Security: 100/100 - Data stored on-device follows strong protection practices
• Network Security: 70/100 - Connection protection is correctly applied to the main API but is non-functional on the three domains delivering banking session content
• Code Safety: 84/100 - In-app web bridges accept commands without verifying the source page; a development-time component remains accessible in the production build

Privacy Breakdown

• Data Collection: 97/100 - Data collection is narrow and relevant to banking; precise GPS collection is limited to the identity verification step
• Data Sharing: 94/100 - Third-party data sharing is minimal; Firebase Analytics is fully disabled
• User Control: 89/100 - Data deletion is supported; however, users who rely on accessibility services are blocked from the app entirely

Positive Security Features

• Firebase Analytics fully disabled via four explicit configuration flags - Google receives no analytics data
• Self-hosted analytics on Triodos infrastructure (Matomo) - no third-party analytics company receives your usage data
• In-app browser file and content access explicitly disabled, preventing local file theft via the embedded web content
• Connection protection correctly applied with real cryptographic pins on the main Triodos API endpoint
• Commercial runtime application protection (Promon SHIELD) deployed, raising the bar for tampering attempts significantly
• Encrypted string storage throughout the app using a strong stream cipher - string extraction is not possible via static analysis alone
• No security findings across more than 4,000 analyzed native code functions
• Layered device integrity checks: root detection, screen mirroring detection, isolated process services, and overlay attack prevention

Areas for Improvement

GDPR / EAA Compliance

The app's compliance posture could be strengthened by:

1. Accessibility Service Compatibility
   The app unconditionally terminates sessions when any accessibility service is detected, blocking users who rely on screen readers (TalkBack), Switch Access, or Voice Access. The European Accessibility Act has applied to financial services apps in the EU since June 28, 2025. Distinguishing between fraud-overlay tools and legitimate assistive technologies would align the app with both regulatory requirements and inclusive design.

2. Identity Verification Data Minimization
   The identity verification (KYC) component sends precise GPS coordinates, device security state, and high-frequency sensor data to Fourthline, a Netherlands-based third-party processor. Reviewing whether precise location (rather than approximate location) and sensor data are strictly necessary for identity verification would reduce the personal data footprint.

Security Enhancements

1. Connection Protection on Banking Session Domains
   The three domains serving account overviews, transfers, and payment confirmations (bankieren.triodos.nl, banking.triodos.be, banking.triodos.co.uk) are configured with a placeholder pin value that is never matched against a real server certificate. Replacing the placeholder with valid pins would close the gap and bring these domains in line with the correctly pinned main API.

2. In-App Web Bridge Source Validation
   The in-app web bridges that control session dismissal, navigation, and financial insight commands do not verify that the page invoking them is the expected Triodos domain. Adding origin checks before acting on bridge commands would prevent those commands from being triggered by any injected content.

3. Remove Development Component from Production Build
   An Android Studio UI preview component is exported and accessible to other apps on the device in the production release. Removing it from the release build configuration would reduce the app's exposed surface area.

Technical Context

App Type: Financial services - retail and business banking (high sensitivity)
Classes Analyzed: 20,141
Third-Party Services: 14 identified
Context Tags: financial, sensitive_data, location

About This Analysis

This security analysis was conducted by CITT (Can I Trust That), an independent security analysis service. We perform static code analysis on Android applications to help users make informed decisions about app security and privacy.

App Details

Developer: Triodos Bank N.V.
Version: 5.4.2 (Build 748)
Analysis Date: 2026-05-20
Package: com.triodos.bankingbe

Analysis Limitations

• Static analysis only (code review without running the app)
• Based on APK version 5.4.2 analyzed on 2026-05-20
• May not reflect server-side security controls
• Cannot detect all runtime behaviors