Impact Portfolio Security & Privacy Scorecard

by Triodos Bank · iOS

92
Overall trust score
Very Secure
88
Security
100
Privacy

User credentials are stored using device-only keychain protection and FIDO2 passkey authentication. Firebase is present but used exclusively for push notifications, with analytics explicitly disabled. No advertising, attribution, or behavioral tracking SDKs are included.

Best for

Triodos customers tracking their impact portfolio

Findings

  • 0 critical
  • 0 high
  • 2 medium
  • 6 low
  • 7 info

0 issues identified across security and privacy analysis.

Top security issues

  • OTA bundle update framework (CapgoCapacitorUpdater) ships without RSA bundle signing configured — if OTA is activated, any MITM or server compromise can deliver malicious JS controlling all auth flows
  • Staging domain authorized for passkey/password AutoFill in production entitlements — staging server compromise could associate credentials with the production banking app
  • Capacitor native bridge exposes Keychain, biometrics, and FIDO2 plugins to WebView JS without origin validation — XSS precondition enables full credential extraction

Top privacy issues

  • Demo mode fixtures with 344 internal API URLs and backend service names compiled into production bundle — exposes complete backend architecture to any user who unpacks the IPA
  • Session cookies for investment portfolio backend persisted to disk (WKWebView Library/Cookies/) with only Class B file protection — readable on jailbroken devices
  • ECDSA device-binding private key transits JavaScript heap as plaintext PEM string during registration — risk for PSD2/SCA device-binding compliance on compromised devices

Full analysis

Triodos Impact Portfolio

What This Means for You

Your investment data is protected by phishing-resistant biometric login and stored securely on your device, but a built-in software update mechanism is present without the tamper-proofing needed to prevent unauthorized code from reaching your device if it were ever activated.

Recommendation: Use With Caution

Strong authentication (FIDO2) and minimal tracking, but the OTA update framework lacks bundle integrity verification and a staging domain is configured in production entitlements. Suitable for Triodos customers with awareness of these medium-risk issues.

Best For: Triodos Impact Portfolio customers who want strong biometric login, no advertising tracking, and minimal data collection

Key Findings

Data Security - 5 findings (4 low, 1 info)

Network Security - 5 findings (1 medium, 1 low, 3 info)

Code Safety - 3 findings (1 medium, 1 low, 1 info)

Privacy - 2 findings (2 info)

Privacy Concerns

What Data is Collected

  • Device information: device identifier used for push notification delivery
  • Biometric data: Face ID or Touch ID prompt for local authentication (processed on-device only, not transmitted)
  • Usage data: app interactions within the investment portfolio interface
  • Financial data: investment portfolio holdings and transaction data (transmitted to Triodos servers)

Third-Party Data Sharing

The following third parties may receive your data:

  • Firebase (Google) - Receives your device identifier solely for delivering push notifications; analytics and behavioral tracking are explicitly disabled
  • Alamofire - Open-source networking library used for secure HTTPS communication with Triodos servers; no data leaves to external parties via this library
  • Capacitor - Open-source app framework; no external data transmission

No advertising, attribution, or behavioral analytics companies receive your data.

Understanding the Scores

Security: 88/100
Privacy: 100/100

Security Breakdown

  • Data Security: 90/100 - Credentials are stored in the device-secured storage area; some session data and app logic files use a lower protection level that allows access while the device is running
  • Network Security: 92/100 - All connections use encrypted HTTPS with no exceptions; a staging server domain is authorized in the production app configuration
  • Code Safety: 91/100 - Strong biometric and passkey authentication implemented; software update framework is present without bundle integrity verification enabled

Privacy Breakdown

  • Data Collection: 100/100 - Only collects what is essential to operate an investment management app; no advertising identifiers or behavioral profiling
  • Data Sharing: 100/100 - No data shared with advertising, analytics, or attribution companies
  • User Control: 100/100 - No background data collection; no clipboard access; minimal permission requests

Positive Security Features

  • Phishing-resistant biometric login (Face ID/Touch ID) with passkey support properly bound to the Triodos production domain
  • Sensitive account data stored in the device's secure storage area, isolated to this app and not backed up to iCloud
  • All network connections require encrypted HTTPS with no insecure exceptions permitted
  • Network library configured to properly verify server identity on all connections
  • Firebase Analytics explicitly disabled - Firebase is used only for push notification delivery
  • No advertising, tracking, attribution, or behavioral analytics SDKs present
  • Production builds refuse to store sensitive data in less-secure locations - a hard safeguard
  • No custom app-opening links registered - eliminates a common class of external attack

Areas for Improvement

GDPR / CCPA Compliance

The app's privacy practices could be strengthened by:

  1. Raising File Protection Level
    Application files, including cached app logic, are protected at a level that allows access while the device is powered on and unlocked. Enabling the highest iOS file protection level would ensure these files are inaccessible when the screen is locked.

  2. Removing Staging Environment References from Production Build
    The production app includes references to a test server environment and internal backend service names. Removing these from the production release would reduce the information available to anyone examining the app package.

Security Enhancements

  1. Enable Bundle Integrity Verification for Software Updates
    The app includes a software update framework capable of delivering new application code over the internet. This framework supports a bundle-signing feature that would verify updates have not been tampered with before installation - this feature is not currently enabled, though automatic updates are also currently disabled.

  2. Restrict Staging Server Authorization
    The production app's configuration authorizes a staging server for passkey and password autofill. Limiting this authorization to the production domain only would remove a potential boundary between test and production environments.

  3. Restrict In-App Browser Navigation
    External links opened within the app's built-in browser do not check whether the destination is on an approved list of domains. Adding a domain allow-list would prevent users from being navigated to unintended sites within the Triodos app interface.

Technical Context

App Type: Financial investment management - high sensitivity
Classes Analyzed: 23
Third-Party Services: 12 (framework and infrastructure components; no advertising or tracking SDKs)
Context Tags: financial, sensitive_data, investment

About This Analysis

This security analysis was conducted by CITT (Can I Trust That), an independent security analysis service. We perform static code analysis on iOS applications to help users make informed decisions about app security and privacy.

App Details

Developer: Triodos Bank
Version: 2.0.0 (Build 1)
Analysis Date: 2026-04-17
Package: de.triodos.impactportfolio

Analysis Limitations

  • Static analysis only (code review without running the app)
  • Based on IPA version 2.0.0 analyzed on 2026-04-17
  • May not reflect server-side security controls
  • Cannot detect all runtime behaviors

Versions & scan history

ScanDateOverall score
#4 (current) 92/100
#3 82/100
#2 89/100