AFAS Pocket Security & Privacy Scorecard

Android

86
Overall trust score
Trustworthy
91
Security
84
Privacy

Usage activity is shared with Mixpanel and Firebase for analytics and push notifications. The app can access contacts and calendar when those permissions are granted. Microsoft Intune integration means an organization may manage how the app operates on the device.

Best for

AFAS users comfortable with standard analytics

Findings

  • 0 critical
  • 0 high
  • 1 medium
  • 4 low
  • 10 info

1 issue identified across security and privacy analysis.

Top security issues

  • Comfortkey BLE SDK hardcoded shared AES-256 fleet key ('Celsius Benelux BV Amersfoort NL') enables building access control bypass via APK reverse engineering with only BLE proximity required
  • PushHandlerActivity exported with undeclared custom permission allows pre-installed malicious app to inject push bundles and trigger 2FA flow paths without authorization
  • AndroidKeyStore AES-256 keys storing TOTP seeds, auth tokens, and session credentials provisioned without user authentication binding, leaving them accessible on rooted devices

Top privacy issues

  • Mixpanel SDK v8.2.5 auto-collects employee device telemetry (carrier, Bluetooth state, IP geolocation) with opt-out disabled by default and Play Store declares 'No data collected' — direct GDPR/regulatory contradiction
  • Corporate employee UPN (email) and Entra Object ID forwarded to Flutter layer via MAMInfo channel, with unverifiable risk of linkage to Mixpanel behavioral analytics profiles at a US third party
  • BLE permissions (BLUETOOTH_SCAN, BLUETOOTH_ADVERTISE, BLUETOOTH_CONNECT) held across all enterprise deployments regardless of whether Comfortkey building hardware is installed

Full analysis

What This Means for You

Usage activity is shared with Mixpanel and Firebase for analytics and push notifications. The app can access contacts and calendar when those permissions are granted. Microsoft Intune integration means an organization may manage how the app operates on the device.

Recommendation: Trustworthy

Best For: AFAS users comfortable with standard analytics

Key Findings

Data Security - 3 findings (1 low, 2 info)

Network Security - 3 findings (3 info)

Code Safety - 0 findings

Privacy - 2 findings (1 low, 1 info)

Privacy Concerns

What Data is Collected

The app collects usage and behavioral data through Mixpanel and Firebase. Device identifiers are used to deliver push notifications. When permissions are granted, the app can read contacts and calendar events. Photos and files can also be accessed when those features are used.

Third-Party Data Sharing

Behavioral and usage data is shared with Mixpanel for analytics. Firebase receives device and session data to support push notifications and core app services. If an organization has configured Microsoft Intune, enterprise policies may govern how the app operates and what activity data is visible to the IT department.

Understanding the Scores

Category Score
Security 91/100
Privacy 84/100
Data Security 94/100
Network Security 98/100
Code Safety 92/100
Data Collection 84/100
Data Sharing 92/100
User Control 89/100

Positive Security Features

  • Biometric authentication support lets users secure access using fingerprint or face recognition instead of a password
  • Enterprise mobile management through Microsoft Intune allows organizations to enforce security policies on the app
  • Network communication received near-perfect scores, indicating strong practices for protecting data in transit

Areas for Improvement

  • Usage and behavioral data is shared with Mixpanel and Firebase by default, and the app does not provide in-app controls to opt out of this analytics collection.
  • Contact and calendar data becomes accessible once those permissions are granted; users who prefer to limit this can review and adjust permissions in device settings.
  • The app includes Bluetooth access through multiple libraries; if Bluetooth features are not used, this represents a broader permission scope than may be necessary.

About This Analysis

This scorecard is based on static analysis of the app's code and configuration. Scores reflect security and privacy practices observed in the version analyzed. Real-world behavior may vary based on server-side configuration and individual usage.

App Details

Field Value
Package nl.afas.pocket2
Version 2.33.6 (2330600)
Scan Date 2026-04-09
Platform Android

Versions & scan history

ScanDateOverall score
#1 (current) 86/100