Triodos Bank. Banca Móvil Security & Privacy Scorecard

by TRIODOS BANK NV SUCURSAL EN ESPANA · iOS

85
Overall trust score
Trustworthy
82
Security
92
Privacy

Usage patterns and crash reports are shared with Google through Firebase Analytics and Crashlytics. Apple's ad attribution services record how the user originally discovered and installed the app. Banking transactions and account data stay within Triodos's own systems.

Best for

Triodos Bank customers comfortable with Google analytics

Findings

  • 0 critical
  • 0 high
  • 5 medium
  • 3 low
  • 7 info

1 issue identified across security and privacy analysis.

Top security issues

  • Custom URL scheme triodosapp:// accepts calls from any installed app without source validation, enabling inter-app attacks on banking sessions
  • Bundled SSL pinning certificates expired October 2023, risking either MitM vulnerability (if expiry suppressed) or connection failures (if enforced)
  • Hardcoded private IP addresses and pre-production banking endpoints expose internal network topology in publicly available App Store binary

Top privacy issues

  • Financial documents written to NSDocumentDirectory are accessible via USB/iTunes without any authentication, bypassing Face ID/PIN
  • Missing NSFileProtectionComplete entitlement leaves financial files decryptable by forensic tools whenever the device has been unlocked since last reboot
  • ATT consent string omits Firebase Analytics and Apple AdServices as named data recipients, violating GDPR Article 13 in a banking context

Full analysis

Triodos Bank. Banca Móvil

Developer: TRIODOS BANK NV SUCURSAL EN ESPANA
Version: 1.0.64 (build 1.0.64.0)
Platform: iOS
Analyzed: 2026-04-09

What This Means for You

App usage patterns and crash reports are sent to Google via Firebase Analytics and Crashlytics. Apple's attribution framework records whether the user arrived through an ad. Financial account data stays within Triodos and is not shared with advertising or marketing companies.

Recommendation: Trustworthy

Best For: Triodos customers comfortable with standard analytics

Key Findings

Data Security - 2 findings (2 medium)

Network Security - 2 findings (1 medium, 1 low)

Code Safety - 0 findings

Privacy - 2 findings (2 low)

Privacy Concerns

What Data is Collected

  • App usage patterns and session activity, via Firebase Analytics
  • Crash reports and device diagnostics, via Firebase Crashlytics
  • Ad attribution data (whether the user came from an advertisement), via Apple AdServices and SKAdNetwork
  • Push notification delivery status, via Firebase Messaging

Third-Party Data Sharing

  • Google receives app usage patterns and crash reports via Firebase Analytics and Crashlytics.
  • Apple receives ad attribution signals via AdServices and SKAdNetwork.
  • Financial account data is not shared with advertising or marketing companies.

Understanding the Scores

Category Score
Security 82/100
Privacy 92/100
Data Security 78/100
Network Security 84/100
Code Safety 85/100
Data Collection 94/100
Data Sharing 95/100
User Control 94/100

Positive Security Features

  • Financial account data stays within Triodos and is not shared with advertising or marketing networks.
  • Data sharing is limited to infrastructure services - analytics, crash reporting, and push notifications - with no ad networks or data brokers in the mix.
  • A high user control score (94/100) reflects that the app exposes minimal personal data to outside parties.

Areas for Improvement

  • The app stores certain data in a format that, under some conditions, other apps on the same device could potentially read. Keeping the device updated and avoiding untrusted apps reduces this exposure.
  • Some of the app's network connections use settings that fall slightly short of current best practices, leaving a small margin for improvement in how data is protected in transit.
  • Apple's ad attribution framework is present in the app, which records how the user first discovered it. This is a minor privacy consideration with low practical impact on day-to-day use.

About This Analysis

This scorecard is based on automated static analysis of the app binary. Scores reflect the app's behavior as observed in the code - actual runtime behavior may vary.

App Details

  • App: Triodos Bank. Banca Móvil
  • Package ID: es.triodos.bank.mobile
  • Developer: TRIODOS BANK NV SUCURSAL EN ESPANA
  • Version: 1.0.64 (build 1.0.64.0)
  • Scan Date: 2026-04-09

Versions & scan history

ScanDateOverall score
#1 (current) 85/100