Scan results

Recommendation: Use With Caution

Strong security controls protect your authentication data, and your data stays entirely within comdirect's own systems. However, mock banking customer IDs bundled in the app increase risk if the app file is extracted or backed up. Comdirect customers who understand this limitation can use the app safely for TAN generation.

Key Findings

Data Security - 3 findings (2 medium, 1 low)

Network Security - 1 finding (1 info)

Code Safety - 0 findings

Privacy - 2 findings (2 info)

Privacy Concerns

What Data is Collected

• Account activity: screen views and authentication interactions linked to your account identifier
• Diagnostic data: operational error reports sent to comdirect's own servers
• Device information: device identifiers used for secure authentication binding

Third-Party Data Sharing

The following third parties may receive your data:

• Google (Firebase) - push notification delivery only

Understanding the Scores

Security: 91/100
Privacy: 99/100

Security Breakdown

• Data Security: 88/100 - Test banking account identifiers are bundled in the production app; biometric setup preferences are stored without full protection
• Network Security: 100/100 - All network traffic uses enforced secure connections with no exceptions configured
• Code Safety: 100/100 - No dangerous code patterns detected across all analyzed binaries

Privacy Breakdown

• Data Collection: 100/100 - Only collects data necessary for authentication and TAN generation
• Data Sharing: 100/100 - No data shared with advertising or analytics companies
• User Control: 100/100 - Privacy disclosures are complete and accurate

Positive Security Features

• All network communications use secure connections with no exceptions
• Your authentication data is protected by hardware-backed device binding that ties it specifically to your device
• Biometric authentication keys are invalidated automatically if you re-enroll Face ID or Touch ID
• Local app data is stored in a strongly encrypted database
• Usage analytics and Firebase Analytics are fully disabled
• No advertising, tracking, or analytics companies receive your data
• No advertising identifier is accessed
• TAN codes are derived on-device with no network dependency for the core cryptographic operation
• Backend database access requires authentication - unauthenticated access is blocked at the server
• Privacy disclosures are complete and accurate, covering all required data types

Areas for Improvement

GDPR / CCPA Compliance

The app's privacy practices could be strengthened by:

1. Removing Test Data from Production Builds
   Mock banking account numbers and session data should be excluded from released app builds to avoid bundling identifiable account patterns in files that can be extracted from device backups.

2. Protecting Biometric Setup Preferences
   Authentication state settings should be stored in protected system storage rather than general app preferences, preventing manipulation if device storage is accessed directly.

Security Enhancements

1. Stronger File Protection at Rest
   Enabling the highest level of iOS file protection would ensure that even temporary or cached files remain inaccessible while the device screen is locked, not just after the first unlock following a reboot.

2. Request URL Logging Precision
   Confirming that operational error reports use URL templates rather than fully constructed addresses would prevent account identifiers from appearing in server-side log pipelines.

Technical Context

App Type: Financial - banking TAN generator, high sensitivity
Classes Analyzed: 149
Third-Party Services: 21 libraries identified (cryptographic, networking, and notification frameworks)
Context Tags: financial, sensitive_data

About This Analysis

This security analysis was conducted by CITT (Can I Trust That), an independent security analysis service. We perform static code analysis on iOS applications to help users make informed decisions about app security and privacy.

App Details

Developer: comdirect
Version: 9.11.0 (build 3654)
Analysis Date: 2026-04-11
Package: de.comdirect.phototan

Analysis Limitations

• Static analysis only (code review without running the app)
• Based on iOS app version 9.11.0 analyzed on 2026-04-11
• May not reflect server-side security controls
• Cannot detect all runtime behaviors