CITT

    Scan results

    Triodos Bank UK

    iOS

    Download the Triodos Mobile Banking App for free and easily check your balance, make payments and transfer money, view all transactions, and see personalized impact of your savings and investments.

    CITT SCORE
    88
    out of 100
    TRUSTED

    Quick Verdict

    Best for: Triodos customers comfortable with standard analytics

    What It Means For You

    In-app usage and session activity is shared with Piwik PRO analytics, and crash reports including device details are sent to Bugsnag. During account setup, identity documents and a facial scan are processed by a third-party verification service. A personalization service also analyzes transaction history to generate financial insights shown inside the app.

    Method and Limitations

    Static analysis only. CITT reviewed the code of this build without running the app, so runtime behavior was not observed. The findings below describe the analyzed build and may not reflect server-side controls or later versions. CITT makes no determination about compliance with any law or platform policy; it reports what the artifacts contain and cites the published guidance so a reader can compare.

    How CITT scores an app

    Findings (12)

    Data Security

    3 total
    1 Medium
    2 Info

    Network Security

    2 total
    1 Low
    1 Info

    Code Security

    4 total
    1 Medium
    3 Info

    Privacy

    3 total
    2 Low
    1 Info

    Third-Party Services

    TrustKit, Bugsnag, PiwikPROSDK, FourthlineCore, FourthlineVision, PersoneticsCoreIos, Parley, Lottie, SnapKit, SwiftMessages, DeviceKit, BigInt, MarkdownKit

    Security Strengths

    • ✓TrustKit certificate pinning active across main app and both Apple Pay extensions
    • ✓Keychain uses most restrictive accessibility constants (WhenPasscodeSetThisDeviceOnly, WhenUnlockedThisDeviceOnly) — no iCloud sync
    • ✓Biometric authentication uses ECDSA P-256 with Secure Enclave binding — private key never leaves device
    • ✓In-app chat messages encrypted at rest via Parley encrypted storage
    • ✓No hardcoded secrets or API keys — string encryption applied throughout bankingukx.framework
    What changed since the last scan

    Version diff is on the Developer plan. See developer plans.

    Context Tags

    financial
    sensitive data
    biometric
    location
    apple pay

    Package

    com.triodos.bankinguk

    Version

    5.3.0 (Build 743)

    Analysis Date

    Apr 9, 2026

    0

    Was this analysis helpful?

    Feedback helps us improve our analysis

    View on App Store

    Recommendation: Trustworthy

    Key Findings

    Data Security - 3 findings (1 medium, 2 info)

    Network Security - 2 findings (1 low, 1 info)

    Code Safety - 0 findings

    Privacy - 3 findings (2 low, 1 info)

    Privacy Concerns

    What Data is Collected

    Session activity and in-app behavior are recorded for analytics. Device information is collected and sent to a crash reporting service if the app encounters an error. During account setup, identity documents and a biometric scan are captured by a third-party verification provider. Transaction history is analyzed by a personalization service to generate financial recommendations shown inside the app.

    Third-Party Data Sharing

    • Piwik PRO: Receives in-app usage and session data for analytics purposes.
    • Bugsnag: Receives crash reports that include device details when the app encounters an error.
    • Fourthline: Processes identity documents and facial scan during account verification.
    • Personetics: Analyzes transaction history to generate personalized financial insights within the app.

    Understanding the Scores

    CategoryScore
    Security89/100
    Privacy88/100
    Data Security91/100
    Network Security94/100
    Code Safety91/100
    Data Collection86/100
    Data Sharing95/100
    User Control88/100

    Positive Security Features

    • The app's consistently strong scores across all security and privacy categories reflect sound, careful implementation throughout.

    Areas for Improvement

    • The volume of device and behavioral data sent to third-party analytics and crash reporting services could be reduced to limit how much user information leaves the app.
    • Clearer in-app disclosure about how identity documents and transaction history are handled by external providers would give users better visibility into their data.
    • Minor improvements to network communication configuration could provide an additional layer of protection for data sent between the app and outside services.

    About This Analysis

    This scorecard is based on a review of the app's packaged code and configuration. Scores reflect the security and privacy posture of the version analyzed and may not reflect changes introduced in later updates.

    App Details

    • App: com.triodos.bankinguk
    • Version: 5.3.0 (Build 743)
    • Scan Date: 2026-04-09

    Right of Reply

    Developer not yet contacted