Scan results

Recommendation: Very Secure

Session provides exceptional privacy through end-to-end encryption, a metadata-resistant onion routing network, and zero tracking or advertising SDKs. The app is built so that even the servers relaying your messages cannot read them or identify who you are communicating with. Highly recommended for privacy-conscious users seeking secure messaging without sacrificing usability.

Key Findings

Data Security - 2 findings (1 low, 1 info)

Network Security - 1 finding (1 medium)

Code Safety - 4 findings (1 medium, 1 low, 2 info)

Privacy - 3 findings (3 info)

Privacy Concerns

What Data is Collected

• Personal information: No name, phone number, or email address is required. Your account identity is created automatically on your device and no personal information is needed.
• Camera and microphone: Accessed on your device when you take photos, record videos, or send voice messages. This content stays on your device until you choose to send it to a recipient.
• Files and photos: Accessed on your device when you share them in a conversation.
• GIF search text: If you use the in-app GIF or sticker search feature, the words you type are sent to Giphy to retrieve results.

Third-Party Data Sharing

The following third parties may receive your data:

• Giphy - Receives your GIF and sticker search text when you use the in-app GIF search feature
• Firebase Cloud Messaging - Receives your device's push notification delivery identifier to send message alerts; all Firebase data collection features are explicitly disabled

Understanding the Scores

Security: 90/100
Privacy: 97/100

Security Breakdown

• Data Security: 94/100 - Your entire message database is protected with strong database encryption. Push notifications use individually generated per-account decryption keys, providing robust protection for notification content.
• Network Security: 93/100 - All connections are routed through a three-hop relay network so no single server can link your identity to your conversations. Entry-point connections use embedded security certificates with custom trust anchors that resist compromise of public certificate authorities.
• Code Safety: 92/100 - The app contains no in-app browser components and no custom link schemes, eliminating the most common category of web-facing attacks on Android. All database queries use parameterized inputs throughout the codebase.

Privacy Breakdown

• Data Collection: 97/100 - The app is built without any tracking, analytics, or advertising SDKs. All optional Firebase data collection features are explicitly turned off, and creating an account requires no personal information whatsoever.
• Data Sharing: 97/100 - Message traffic routes exclusively through Session's privacy-preserving relay network. No advertising networks, analytics providers, or data brokers receive information about your usage or activity.
• User Control: 100/100 - The app includes an emergency panic response for rapid data wipe, prevents cloud and ADB backup extraction of your message database, and your account exists entirely on your device with no server-side dependency on a phone number or email address.

Positive Security Features

• Your entire message database, contact list, and session state are protected with strong encryption
• A three-hop onion relay network ensures no single server can read your messages or link your identity to your conversations
• Entry-point connections use embedded security certificates with custom trust anchors, immune to public certificate authority compromise
• No analytics, advertising, or behavioral tracking SDKs of any kind are included in the app
• Firebase analytics, crash reporting, advertising ID collection, and device ID collection are all explicitly disabled
• Push notifications use individually generated per-account random decryption keys, resolving a prior shared-key design
• No in-app browser components or custom link schemes, eliminating entire categories of web-facing attacks
• Cloud backup and ADB backup extraction of the message database are prevented
• No phone number, email address, or personal information required to create an account
• Biometric authentication is properly bound to device unlock and is invalidated when biometric enrollment changes
• Emergency panic response integration for immediate data wipe
• All database queries use parameterized inputs throughout the codebase

Areas for Improvement

GDPR / CCPA Compliance

The app's privacy practices could be strengthened by:

1. Data Safety Disclosure Alignment
   The Google Play data safety declaration states that no data is shared with third parties, but GIF and sticker search queries are sent to Giphy when that feature is used. Updating the store listing to reflect this would improve transparency with users.

Security Enhancements

1. Database Protection Key Binding
   The key used to protect the message database could be further hardened by binding it to device unlock, so that accessing the protection key requires a PIN, password, or biometric on a physically compromised device.

2. Session Pro Backend Configuration
   The Session Pro subscription service is configured to use a developer-environment server address in the production app. Switching to a dedicated production endpoint would reduce reliance on a development environment for paid feature verification.

Technical Context

App Type: Encrypted private messaging application
Classes Analyzed: 4,500
Third-Party Services: 16
Context Tags: privacy, social, sensitive_data, encrypted_messaging

About This Analysis

This security analysis was conducted by CITT (Can I Trust That), an independent security analysis service. We perform static code analysis on Android applications to help users make informed decisions about app security and privacy.

App Details

Developer: Session Foundation (Session Technology Stiftung)
Version: 1.32.1 (versionCode 4445)
Analysis Date: 2026-06-30
Package: network.loki.messenger

Analysis Limitations

• Static analysis only (code review without running the app)
• Based on APK version 1.32.1 analyzed on 2026-06-30
• May not reflect server-side security controls
• Cannot detect all runtime behaviors