CITT

    Scan results

    Signal Private Messenger

    Android

    Signal is a messaging app with privacy at its core. It is free and easy to use, with strong end-to-end encryption that keeps your communication completely private. Send texts, voice messages, photos, videos, GIFs, and files for free.

    CITT SCORE
    100
    out of 100
    TRUSTED

    Quick Verdict

    Best for: Anyone wanting truly private messaging

    What It Means For You

    Messages are end-to-end encrypted and Signal does not collect contacts, messages, or usage data. Payments use Stripe, maps use Google Maps, and GIFs use GIPHY, so those features involve third-party services. Push notifications are delivered via Firebase Cloud Messaging, which does not see message content.

    Method and Limitations

    Static analysis only. CITT reviewed the code of this build without running the app, so runtime behavior was not observed. The findings below describe the analyzed build and may not reflect server-side controls or later versions. CITT makes no determination about compliance with any law or platform policy; it reports what the artifacts contain and cites the published guidance so a reader can compare.

    How CITT scores an app

    Findings (3)

    Code Security

    2 total
    2 Info

    Privacy

    1 total
    1 Info

    Third-Party Services

    Stripe, Google Maps, GIPHY, Firebase Cloud Messaging

    Security Strengths

    • ✓End-to-end encryption with Signal Protocol
    • ✓SQLCipher database encryption with AES-256
    • ✓Hardware-backed key storage using Android Keystore
    • ✓Zero analytics or tracking SDKs
    • ✓Zero JavaScript interfaces in WebViews
    What changed since the last scan

    Version diff is on the Developer plan. See developer plans.

    Context Tags

    communication
    encrypted messaging
    privacy focused
    open source
    contacts

    Package

    org.thoughtcrime.securesms

    Version

    7.71.2 (Build 164101)

    Analysis Date

    Feb 2, 2026

    Classes Analyzed

    20,641

    Was this analysis helpful?

    Feedback helps us improve our analysis

    View on Play Store

    Recommendation: Very Secure

    Key Findings

    Data Security - 0 findings

    Network Security - 0 findings

    Code Safety - 0 findings

    Privacy - 1 finding (1 info)

    Privacy Concerns

    What Data is Collected

    Signal identifies accounts by phone number only. Messages, contacts, and usage patterns are not collected or stored on Signal's servers.

    Third-Party Data Sharing

    Certain optional features in the app connect to third-party services:

    • Stripe processes payments if the user uses Signal's payment features.
    • Google Maps handles location sharing within conversations.
    • GIPHY powers GIF search within conversations.
    • Firebase Cloud Messaging delivers push notifications without exposing message content to the notification service.

    Each service receives only the information required to perform its specific function.

    Understanding the Scores

    CategoryScore
    Security100/100
    Privacy100/100
    Data Security100/100
    Network Security100/100
    Code Safety100/100
    Data Collection100/100
    Data Sharing100/100
    User Control100/100

    Positive Security Features

    • Messages and calls are protected by end-to-end encryption, readable only by the communicating parties.
    • Signal does not collect or store contacts, message history, or usage patterns on its servers.
    • Push notifications are delivered through Firebase Cloud Messaging without that service gaining access to message content.

    Areas for Improvement

    • Using the payments feature routes data through Stripe, a third-party payment processor. Users who want to keep financial activity entirely private should consider whether to use this feature.
    • Sharing location within conversations connects to Google Maps. Users should be mindful of when they choose to share location data with contacts.
    • GIF searches are processed by GIPHY, which may log the terms searched. Regular use of GIF search sends those search terms to a third party.

    About This Analysis

    This scorecard is generated through automated static analysis of the app's code and configuration. Scores reflect the security and privacy practices observed at the time of the scan.

    App Details

    • App Name: Signal Private Messenger
    • Package ID: org.thoughtcrime.securesms
    • Version: 7.71.2 (Build 164101)
    • Scan Date: 2026-02-02

    Right of Reply

    Developer not yet contacted