The AA (NZ) Security & Privacy Scorecard

Android

94
Overall trust score
Very Secure
92
Security
98
Privacy

Analytics data is sent to Firebase and Google, with collection disabled by default until consent is given. User location is accessed via Geolocator for relevant services. Auth tokens are stored in encrypted on-device storage, and the local database is encrypted with SQLCipher.

Best for

NZ drivers managing membership and roadside needs

Findings

  • 0 critical
  • 0 high
  • 2 medium
  • 2 low
  • 4 info

1 issue identified across security and privacy analysis.

Top security issues

  • TLS certificate validation bypass callable in production via background_downloader plugin with no debug guard
  • Auth0 test OAuth redirect scheme left in production manifest enabling callback handler manipulation by co-installed apps
  • Google Tag Manager preview activity exported with custom URI scheme, triggerable by any co-installed app

Top privacy issues

  • flutter_inappwebview stores WebView HTTP Basic Auth credentials in plaintext SQLite if permanentPersistence is enabled
  • Google Maps API key embedded without confirmed Cloud Console restrictions, risking billing abuse by third parties
  • SQLCipher encryption key origin unverifiable — if hardcoded in Dart, encrypted database provides no protection on rooted devices

Full analysis

The AA (NZ)

What This Means for You

Your account login and membership data is stored with strong hardware-backed protection on your device, though the app shipped with two development-era features still active in the production release that other installed apps could use to trigger unexpected login behavior.

Recommendation: Use With Caution

The app's security foundation is strong, with HTTPS-only networking and hardware-backed protection for your login session. Two development artifacts remain in the production release - a test login callback and a network security override in a third-party plugin. The secure browser-based login flow and plugin-level scoping reduce the practical risk, making this a reasonable choice for AA members who keep their app updated.

Best For: NZ AA members managing roadside assistance, membership, and travel services who want a convenient mobile experience

Key Findings

Data Security - 2 findings (1 low, 1 info)

Network Security - 1 finding (1 medium)

Code Safety - 4 findings (1 medium, 1 low, 2 info)

Privacy - 1 finding (1 info)

Privacy Concerns

What Data is Collected

  • Personal information: membership details, name, email address
  • Location data: used for roadside assistance requests and finding nearby AA services
  • Device information: device identifiers for push notifications and analytics
  • Usage data: app interactions, trip tracking data, journey costs, fuel usage

Third-Party Data Sharing

The following third parties may receive your data:

  • Firebase (Google) - app performance monitoring, crash reporting, and push notifications
  • Google Maps - location data for finding AA services and navigation
  • Auth0 - user login and session management
  • Google Ads Identifier - advertising identifier for analytics purposes
  • Google Tag Manager - campaign tracking configuration (currently no active tags configured)

Understanding the Scores

Security: 92/100
Privacy: 98/100

Security Breakdown

  • Data Security: 97/100 - Strong on-device encryption for stored data, including hardware-backed login session protection and an encrypted local database
  • Network Security: 93/100 - All connections use HTTPS by default; a dormant network security override is present in a third-party download plugin
  • Code Safety: 93/100 - Release build is hardened with backup disabled and debug mode off; two development artifacts remain in the production configuration

Privacy Breakdown

  • Data Collection: 100/100 - Analytics and push notification collection are disabled at startup and only activated after user consent
  • Data Sharing: 100/100 - Data sharing limited to services directly supporting app functionality
  • User Control: 100/100 - Users can request data deletion; consent controls for analytics are implemented

Positive Security Features

  • App data backup is disabled, preventing extraction via connected computers or cloud backup
  • All network connections use HTTPS with no cleartext traffic permitted
  • Login uses a secure browser-based flow with built-in protection against interception
  • Login session stored in the Android Keystore with hardware-backed protection
  • Secure storage library used for sensitive app data, backed by Android hardware security
  • Analytics and push notification collection disabled at startup, requiring explicit consent
  • Local database protected with strong encryption
  • In-app browser cross-origin file access protections enforced
  • Release build is not set to debug mode
  • App verifies it is installed from the Play Store and terminates unlicensed installs

Areas for Improvement

GDPR / CCPA Compliance

The app's privacy practices could be strengthened by:

  1. Remove the Test Login Callback
    The production app contains a development-era login redirect that was not removed before release. Removing it would eliminate a surface through which other installed apps could trigger unexpected login states.

  2. Confirm Maps SDK Key Restrictions
    The Google Maps SDK key embedded in the app should be confirmed as restricted to this app's signing certificate in Google Cloud Console to prevent potential misuse against the developer's billing account.

Security Enhancements

  1. Add Release Guard to Network Override Feature
    A network security override in the background downloader plugin is available without any release-mode restriction. Adding a debug-only condition would ensure it cannot be activated in production builds.

  2. Document Database Encryption Key Management
    The app uses an encrypted local database, but the source of the encryption key could not be verified from the analyzed code. Confirming this uses hardware-backed key derivation would strengthen the security guarantee for users on all device types.

Technical Context

App Type: Transportation and membership services, location-aware
Classes Analyzed: 12,769
Third-Party Services: 17 services identified
Context Tags: transportation, location, financial, analytics

About This Analysis

This security analysis was conducted by CITT (Can I Trust That), an independent security analysis service. We perform static code analysis on Android applications to help users make informed decisions about app security and privacy.

App Details

Developer: NZ Automobile Association
Version: 1.2.1 (Build 10200150)
Analysis Date: 2026-05-06
Package: nz.co.aa.mobile.android

Analysis Limitations

  • Static analysis only (code review without running the app)
  • Based on APK version 1.2.1 analyzed on 2026-05-06
  • May not reflect server-side security controls
  • Cannot detect all runtime behaviors

Versions & scan history

ScanDateOverall score
#1 (current) 94/100