ZeSI mobile Security & Privacy Scorecard

ZeSI mobile

What This Means for You

Your personal document data is never saved to your phone and is protected from screenshots, but a backend security weakness is embedded directly inside the app, meaning anyone who downloads it could extract a private authentication key and access the developer's cloud infrastructure.

Recommendation: Use With Caution

ZeSI mobile handles the sensitive identity data you scan with strong privacy practices, keeping it in memory only and never writing it to your device. However, a critical issue was identified: private authentication details for the app's backend cloud services are bundled inside the app itself, where they can be extracted by anyone. This undermines the integrity verification the app is designed to perform. Use this app only on standard, unmodified devices.

Best For: General users verifying German administrative documents on a standard, unmodified device

Key Findings

Data Security - 2 findings (2 info)

Network Security - 1 finding (1 info)

Code Safety - 3 findings (1 critical, 1 low, 1 info)

Privacy - 2 findings (2 info)

Privacy Concerns

What Data is Collected

• Document verification data (name, date of birth, address, document type, nationality) is processed in memory only and never stored on your device
• No personal data is collected or retained by the app

Third-Party Data Sharing

No third-party data sharing was identified in this analysis.

Understanding the Scores

Security: 76/100
Privacy: 100/100

Security Breakdown

• Data Security: 100/100 - Certificates and sensitive identity data are stored with strong hardware-backed encryption
• Network Security: 100/100 - All communication is encrypted; the app blocks unencrypted connections entirely
• Code Safety: 76/100 - A private backend authentication key is embedded inside the app code where it can be extracted by anyone

Privacy Breakdown

• Data Collection: 100/100 - No personal data is collected or retained by the app
• Data Sharing: 100/100 - No user data is shared with third parties
• User Control: 100/100 - Scanned document data lives only in memory and disappears as soon as you close the screen

Positive Security Features

• Document scan results are never saved to your phone - data exists only in memory and is cleared when you close the app
• Screenshots and screen recordings of verification results are blocked by the app, protecting sensitive document details
• All network communication uses encrypted connections with no exceptions, even on older Android versions
• Sensitive certificates are stored using hardware-backed encryption tied to your specific device
• The app verifies that your device has not been tampered with before performing document verification
• No advertising SDKs or analytics tracking - your usage is not monitored or profiled

Areas for Improvement

GDPR / CCPA Compliance

The app's privacy practices could be strengthened by:

1. Backend Service Authentication
   Move the private backend authentication details out of the distributed app and into a secure server-side proxy. As currently implemented, any party can extract these details from the publicly available app download.

Security Enhancements

1. Cryptographic Library Update
   The cryptographic library used for barcode signature verification is an older version with known issues. Updating to the latest release addresses problems that could allow a specially crafted barcode on a forged document to cause the app to freeze or stop responding.

2. Backend Integrity Verification
   The device integrity check the app performs is undermined by the fact that the backend authentication details it relies on are accessible inside the app itself. Moving authentication server-side would restore the intended security guarantee.

Technical Context

App Type: Government document verification tool (high sensitivity - processes identity document data)
Classes Analyzed: 533
Third-Party Services: 11 (Google ML Kit Barcode, OkHttp3, BouncyCastle, Google Tink, Google Play Integrity API, RootBeer, AndroidX Security Crypto, AndroidX CameraX, Google Firebase Components, and others)
Context Tags: government, identity, documentverification, sensitivedata, camera

---

About This Analysis

This security analysis was conducted by CITT (Can I Trust That), an independent security analysis service. We perform static code analysis on Android applications to help users make informed decisions about app security and privacy.

App Details

Developer: Bundesdruckerei GmbH
Version: 1.2.1 (Build 275603458)
Analysis Date: 2026-04-21
Package: de.bdr.zesi

Analysis Limitations

• Static analysis only (code review without running the app)
• Based on APK version 1.2.1 analyzed on 2026-04-21
• May not reflect server-side security controls
• Cannot detect all runtime behaviors