Scan results

Recommendation: Trustworthy

CITT rates WhatsApp trustworthy: message content is protected by Signal Protocol end-to-end encryption so Meta cannot read it, iCloud backups use hardware-bound encryption that is inaccessible to Apple, and no third-party analytics or advertising SDKs are present in this build. MetaAI conversations are processed on Meta's servers without end-to-end encryption and may be retained on those servers.

Key Findings

Data Security: 0 findings

Network Security: 0 findings

Code Safety: 3 findings (3 low)

Privacy: 0 findings

Privacy Concerns

What Leaves the Device

• Phone book contacts: the permission string in this build discloses that contact information may be sent to WhatsApp's servers for contact discovery
• MetaAI conversation content: the MetaAI integration processes conversational content on Meta's servers; this content is not covered by WhatsApp's end-to-end encryption

What Stays on the Device

• Message content: end-to-end encrypted with keys held on the user's device; message content is not readable by Meta or WhatsApp
• iCloud backup encryption keys: hardware-bound to the user's device; Apple cannot access backup contents
• Chat Lock content: protected by Secure Enclave biometric-bound keys that cannot leave the device

Third-Party Data Sharing

Third parties that may receive data from the app:

• Meta (WhatsApp parent company) - platform infrastructure, contact discovery, MetaAI processing
• Ipification - SIM-based phone number verification at registration
• Apple - stores encrypted iCloud backup data; encryption keys remain on the user's device

Understanding the Scores

Security: 91/100
Privacy: 80/100

Security Breakdown

• Data Security: 92/100. Keychain items in this build are device-locked and cannot migrate to another device through backups. Chat Lock content is Secure Enclave-bound and inaccessible without the user's biometric.
• Network Security: 87/100. Production API communications use HTTPS with additional transport verification layers at the messaging and media layers. The build's App Transport Security configuration includes a global override across all bundle targets, which is noted as an area for improvement below.
• Code Safety: 88/100. Three low-severity observations were identified in this build relating to internal infrastructure references in the binary's string table, in-app browser scripting scope, and payment-related link handling.

Privacy Breakdown

• Data Collection: 88/100. No advertising identifier APIs are linked in this build; attribution uses Apple's privacy-preserving SKAdNetwork only. No third-party analytics SDKs are linked in the binary.
• Data Sharing: 94/100. Data sharing is limited to Meta's own infrastructure and a single SIM-verification partner. No data brokers or third-party advertising networks were identified in this build.
• User Control: 92/100. Users retain custody of message encryption keys and iCloud backup encryption keys on their own device. Contact upload is disclosed in the permission prompt before access is granted.

Positive Security Features

• Signal Protocol symbols are confirmed in this binary, indicating end-to-end encryption is implemented for messages; message content is not readable by Meta or WhatsApp
• iCloud backup encryption keys are hardware-bound to the user's device, making backup contents inaccessible to Apple
• No third-party analytics or advertising SDKs are linked in this build; all telemetry routes through Meta's own infrastructure
• No advertising identifier (IDFA) APIs are linked in the binary; attribution uses Apple's privacy-preserving SKAdNetwork
• Chat Lock content is protected by Secure Enclave biometric-bound keys that cannot leave the device
• All Keychain items in this build are device-locked and cannot migrate to another device through backups
• Contacts, as disclosed in the permission string, flow to WhatsApp and Meta-owned infrastructure only; no third-party vendor endpoints were identified for contact data
• Production messaging and media connections use HTTPS with additional transport verification layers

Areas for Improvement

Disclosure observations

Observations about disclosure, each stated against the published guidance so a reader can compare:

1. Privacy Manifest Advertising Purpose Declaration
   Apple's App Store privacy guidelines encourage developers to declare their data-use purposes in a privacy manifest (Apple developer documentation). The privacy manifest in this build declares third-party advertising purposes in its required-reason API entries while the NSPrivacyTracking flag is set to false. Readers comparing these two values may find them inconsistent; whether this precisely reflects the current data practices could not be determined from the binary alone.

2. Contact Upload Disclosure
   The permission string in this build explicitly discloses that contact information may be uploaded to WhatsApp's servers for contact discovery. This disclosure is in line with Apple's requirement for clear permission descriptions. Users who prefer not to share their contact list can decline the contacts permission; core messaging functionality continues with manual number entry.

Security Enhancements

1. App Transport Security Scope
   The build applies a global App Transport Security override across all bundle targets. Narrowing this to the specific domains that require it would reduce the potential surface for network-level risks.

2. Default File Protection Level
   App files in this build default to Class B protection, meaning they are accessible when the device is locked. Raising the default to Class C would ensure app files are inaccessible in a locked-device state.

3. Debug Interfaces in Production
   The production binary includes debug Bonjour service registrations and an internal automation interface. Removing these before submission would reduce the information available to someone who analyzes the binary.

Technical Context

App Type: Encrypted messaging, high sensitivity (contacts, messages, media, payments)
Classes Analyzed: 3,400
Third-Party Services: 1 (Ipification)
Context Tags: social, contacts, camera, sensitive_data, financial

About This Analysis

This security analysis was conducted by CITT (Can I Trust That), an independent security analysis service. The analysis is static code review of iOS applications, intended to help people make informed decisions about app security and privacy.

App Details

Developer: WhatsApp LLC (Meta Platforms)
Version: 26.31.74 (Build 1035496826)
Analysis Date: 2026-08-13
Package: net.whatsapp.WhatsApp

Analysis Limitations

• Static analysis only (code review without running the app)
• Based on iOS build 26.31.74 (Build 1035496826) analyzed on 2026-08-13
• May not reflect server-side security controls
• Cannot detect all runtime behaviors