Scan results

Recommendation: Use With Caution

Strong authentication (FIDO2) and minimal tracking, but the OTA update framework lacks bundle integrity verification and a staging domain is configured in production entitlements. Suitable for Triodos customers with awareness of these medium-risk issues.

Key Findings

Data Security - 5 findings (4 low, 1 info)

Network Security - 5 findings (1 medium, 1 low, 3 info)

Code Safety - 3 findings (1 medium, 1 low, 1 info)

Privacy - 2 findings (2 info)

Privacy Concerns

What Data is Collected

• Device information: device identifier used for push notification delivery
• Biometric data: Face ID or Touch ID prompt for local authentication (processed on-device only, not transmitted)
• Usage data: app interactions within the investment portfolio interface
• Financial data: investment portfolio holdings and transaction data (transmitted to Triodos servers)

Third-Party Data Sharing

The following third parties may receive your data:

• Firebase (Google) - Receives your device identifier solely for delivering push notifications; analytics and behavioral tracking are explicitly disabled
• Alamofire - Open-source networking library used for secure HTTPS communication with Triodos servers; no data leaves to external parties via this library
• Capacitor - Open-source app framework; no external data transmission

No advertising, attribution, or behavioral analytics companies receive your data.

Understanding the Scores

Security: 88/100
Privacy: 100/100

Security Breakdown

• Data Security: 90/100 - Credentials are stored in the device-secured storage area; some session data and app logic files use a lower protection level that allows access while the device is running
• Network Security: 92/100 - All connections use encrypted HTTPS with no exceptions; a staging server domain is authorized in the production app configuration
• Code Safety: 91/100 - Strong biometric and passkey authentication implemented; software update framework is present without bundle integrity verification enabled

Privacy Breakdown

• Data Collection: 100/100 - Only collects what is essential to operate an investment management app; no advertising identifiers or behavioral profiling
• Data Sharing: 100/100 - No data shared with advertising, analytics, or attribution companies
• User Control: 100/100 - No background data collection; no clipboard access; minimal permission requests

Positive Security Features

• Phishing-resistant biometric login (Face ID/Touch ID) with passkey support properly bound to the Triodos production domain
• Sensitive account data stored in the device's secure storage area, isolated to this app and not backed up to iCloud
• All network connections require encrypted HTTPS with no insecure exceptions permitted
• Network library configured to properly verify server identity on all connections
• Firebase Analytics explicitly disabled - Firebase is used only for push notification delivery
• No advertising, tracking, attribution, or behavioral analytics SDKs present
• Production builds refuse to store sensitive data in less-secure locations - a hard safeguard
• No custom app-opening links registered - eliminates a common class of external attack

Areas for Improvement

GDPR / CCPA Compliance

The app's privacy practices could be strengthened by:

1. Raising File Protection Level
   Application files, including cached app logic, are protected at a level that allows access while the device is powered on and unlocked. Enabling the highest iOS file protection level would ensure these files are inaccessible when the screen is locked.

2. Removing Staging Environment References from Production Build
   The production app includes references to a test server environment and internal backend service names. Removing these from the production release would reduce the information available to anyone examining the app package.

Security Enhancements

1. Enable Bundle Integrity Verification for Software Updates
   The app includes a software update framework capable of delivering new application code over the internet. This framework supports a bundle-signing feature that would verify updates have not been tampered with before installation - this feature is not currently enabled, though automatic updates are also currently disabled.

2. Restrict Staging Server Authorization
   The production app's configuration authorizes a staging server for passkey and password autofill. Limiting this authorization to the production domain only would remove a potential boundary between test and production environments.

3. Restrict In-App Browser Navigation
   External links opened within the app's built-in browser do not check whether the destination is on an approved list of domains. Adding a domain allow-list would prevent users from being navigated to unintended sites within the Triodos app interface.

Technical Context

App Type: Financial investment management - high sensitivity
Classes Analyzed: 23
Third-Party Services: 12 (framework and infrastructure components; no advertising or tracking SDKs)
Context Tags: financial, sensitive_data, investment

About This Analysis

This security analysis was conducted by CITT (Can I Trust That), an independent security analysis service. We perform static code analysis on iOS applications to help users make informed decisions about app security and privacy.

App Details

Developer: Triodos Bank
Version: 2.0.0 (Build 1)
Analysis Date: 2026-04-17
Package: de.triodos.impactportfolio

Analysis Limitations

• Static analysis only (code review without running the app)
• Based on IPA version 2.0.0 analyzed on 2026-04-17
• May not reflect server-side security controls
• Cannot detect all runtime behaviors