My Vodafone Romania Security & Privacy Scorecard

My Vodafone Romania

What This Means for You

Your billing and payment communications use security settings that accept certificates installed by corporate IT systems or network proxies, and a portion of app data is encrypted with a key that is identical across every installation worldwide. On a personal phone, the app works as expected; on a work device managed by your employer, these settings create meaningful risk.

Recommendation: Acceptable

Suitable for personal-device use by Vodafone Romania customers managing their contract, bills, and data usage. An encryption key built into the app is shared across all installations, and authentication channels accept user-installed certificates, which elevates risk on employer-managed or proxy-intercepted devices. Standard account and billing management on an unmanaged personal phone carries acceptable risk.

Best For: Vodafone Romania customers managing their account and bills on a personal device

Key Findings

Data Security - 1 finding (1 high)

Network Security - 2 findings (1 high, 1 medium)

Code Safety - 2 findings (1 medium, 1 low)

Privacy - 4 findings (2 medium, 1 low, 1 info)

Privacy Concerns

What Data is Collected

• Account and billing information: shared with Vodafone's servers to manage your contract, invoices, and payments
• Location data: collected and may be shared with analytics partners
• Contact information: accessed on your device to support multi-number account management
• Call log and phone identity: accessed on your device to display your usage history
• Per-app network statistics: a ranked list of which apps on your device use the most mobile and Wi-Fi data is sent to VFG NetPerform (net-perform.com), a third-party measurement service
• App usage and behavior: shared with advertising attribution and analytics services during your sessions

Third-Party Data Sharing

The following third parties may receive your data:

• Adjust - mobile advertising attribution and analytics
• Firebase Analytics (Google) - app usage and performance analytics
• Huawei HiAnalytics - usage analytics on Huawei devices
• Facebook - advertising measurement and analytics
• Tealium - analytics event orchestration and routing to other destinations
• VFG NetPerform (net-perform.com) - receives a ranked list of which apps on your phone consume the most network data
• Medallia Digital - customer satisfaction surveys, including audio capture during survey sessions

Understanding the Scores

Security: 72/100
Privacy: 83/100

Security Breakdown

• Data Security: 60/100 - A fixed encryption key built into the app is shared across all installations worldwide, weakening the protection it provides for certain app data in transit within the app.
• Network Security: 70/100 - Authentication and billing channels are configured to accept user-installed certificates, which can allow proxy software on managed or intercepted devices to inspect those communications. Unencrypted connections are permitted to several service domains.
• Code Safety: 89/100 - Strong overall code practices, with secure hardware-backed key storage and encrypted local storage actively used across the app.

Privacy Breakdown

• Data Collection: 82/100 - The app collects account, billing, location, and usage data consistent with carrier app expectations, though per-app network statistics sent to a third-party service go beyond typical billing functionality.
• Data Sharing: 84/100 - Your data is shared with several analytics and attribution partners. The analytics routing layer can be updated without an app update, meaning data destinations may change between Play Store releases.
• User Control: 85/100 - You can request data deletion, the app supports GDPR erasure requests via the Adjust SDK, and account data management is available within the app.

Positive Security Features

• Login is protected with enhanced server identity verification on the initial authentication gateway
• Authorization tokens use hardware-backed secure key storage on the device
• Encrypted local storage is available for sensitive data through Android's secure storage system
• Barcode scanning is processed entirely on-device with no data sent externally

Areas for Improvement

GDPR / CCPA Compliance

The app's privacy practices could be strengthened by:

1. NetPerform Data Disclosure
   Users should be clearly informed before the app accesses and transmits a ranked list of which other apps on their device consume network data to a third-party service. This disclosure is not clearly presented during permission requests.

2. Microphone Access Scope
   Three independent audio capture components are included in the production build, all activated by a single permission. Limiting audio access to documented user-facing features and clearly scoping each component to its stated purpose would improve transparency.

Security Enhancements

1. Encryption Key Management
   Replacing the fixed encryption key with device-unique or dynamically generated keys would ensure that the encryption protecting certain app data cannot be bypassed by anyone with a copy of the app.

2. Authentication Channel Security
   Restricting billing and payment authentication channels to system-trusted certificates only would prevent proxy software used in managed enterprise environments from inspecting or modifying sensitive API traffic.

Technical Context

App Type: Account management and billing, financial sensitivity
Classes Analyzed: 1,200
Third-Party Services: 17
Context Tags: financial, sensitive_data, location

---

About This Analysis

This security analysis was conducted by CITT (Can I Trust That), an independent security analysis service. We perform static code analysis on Android applications to help users make informed decisions about app security and privacy.

App Details

Developer: Vodafone România
Version: 7.11.2 (versionCode 7110203)
Analysis Date: 2026-06-13
Package: ro.vodafone.mcare.android

Analysis Limitations

• Static analysis only (code review without running the app)
• Based on APK version 7.11.2 analyzed on 2026-06-13
• May not reflect server-side security controls
• Cannot detect all runtime behaviors