CITT

    Scan results

    VanMoof

    Android

    Control your VanMoof electric bike from your phone. Lock/unlock wirelessly, monitor battery, track rides with live dashboards, and adjust bike settings like motor assistance and lights. Supports VanMoof S2-S6 and X2-X4 models.

    CITT SCORE
    88
    out of 100
    TRUSTED

    Quick Verdict

    Best for: VanMoof riders comfortable with standard analytics

    What It Means For You

    Ride data, app usage, and crash reports are shared with Firebase Analytics and Crashlytics. Location is processed through Google Maps and Magic Lane for navigation features. Auth0 handles account login, so identity details pass through Okta's infrastructure.

    Method and Limitations

    Static analysis only. CITT reviewed the code of this build without running the app, so runtime behavior was not observed. The findings below describe the analyzed build and may not reflect server-side controls or later versions. CITT makes no determination about compliance with any law or platform policy; it reports what the artifacts contain and cites the published guidance so a reader can compare.

    How CITT scores an app

    Findings (5)

    Data Security

    1 total
    1 Medium

    Code Security

    1 total
    1 Medium

    Privacy

    3 total
    2 Medium
    1 Low

    Third-Party Services

    Firebase Cloud Messaging, Firebase Crashlytics, Firebase Analytics, Firebase Remote Config, Firebase In-App Messaging, Google ML Kit, Google AR Core, Google Maps SDK, Google Play Services, Magic Lane SDK, Timber, Lottie, Auth0 (Okta), OkHttp, Retrofit, SQLCipher

    Security Strengths

    • ✓Encrypted SharedPreferences using Google Tink with AES-256-GCM
    • ✓SQLCipher database encryption with 256-bit AES
    • ✓Okta Authentication with encrypted token storage excluded from backups
    • ✓All API endpoints use HTTPS with proper certificate validation
    • ✓Room ORM prevents SQL injection through parameterized queries
    What changed since the last scan

    Version diff is on the Developer plan. See developer plans.

    Context Tags

    location
    ads
    sensitive data

    Package

    nl.samsonit.vanmoofapp

    Version

    25.7 (Build 907009900)

    Analysis Date

    Mar 4, 2026

    Classes Analyzed

    19,245

    Was this analysis helpful?

    Feedback helps us improve our analysis

    View on Play Store

    Recommendation: Trustworthy

    Key Findings

    Data Security - 2 findings (1 medium, 1 low)

    Network Security - 0 findings

    Code Safety - 0 findings

    Privacy - 3 findings (2 medium, 1 low)

    Privacy Concerns

    What Data is Collected

    • Ride and trip activity
    • App usage patterns and behavioral analytics
    • Crash reports and diagnostic data
    • Location data for mapping and navigation
    • Account and identity information

    Third-Party Data Sharing

    • Firebase Analytics and Crashlytics (Google): app usage, ride activity, and crash diagnostics
    • Google Maps SDK and Google Play Services: location and routing data
    • Magic Lane SDK: map and navigation data
    • Auth0 (Okta): account login and identity details

    Understanding the Scores

    CategoryScore
    Security92/100
    Privacy85/100
    Data Security92/100
    Network Security100/100
    Code Safety90/100
    Data Collection88/100
    Data Sharing90/100
    User Control88/100

    Positive Security Features

    • Local data is stored in an encrypted database, protecting saved information if the device is lost or stolen.
    • Authentication is handled through Auth0, a dedicated identity provider, rather than a custom-built login system.
    • All network communication uses modern transport security practices, resulting in a perfect network security score.

    Areas for Improvement

    • Some locally stored data could benefit from additional protection layers to further limit what is accessible on the device.
    • Analytics collection runs across multiple platforms simultaneously, giving several companies parallel visibility into riding patterns.
    • Account details pass through multiple third-party services during login, expanding the number of parties that handle identity information.

    About This Analysis

    This scorecard is based on automated static analysis of the app's code and configuration. Scores reflect the security and privacy practices observed at the time of scanning.

    App Details

    • App: VanMoof
    • Package ID: nl.samsonit.vanmoofapp
    • Version: 25.7 (Build 907009900)
    • Scan Date: 2026-03-04
    • Analysis by: canITrustThat

    Right of Reply

    Developer not yet contacted