# Did not meet TRUSTED criteria This build did not satisfy all of CITT's published criteria for the TRUSTED mark. The full criteria and this app's results are shown below. ## Trust Pillars - **Secure by Design**: Not met. Did not meet one criterion in this area. - **Data Minimization**: Not met. Did not meet one criterion in this area. - **Manifest Mismatch**: Not met. Did not meet one criterion in this area. - **User Control**: Strong. Strong result in this area. - **Truly Local**: Not applicable. Does not apply to this app. - **Child-Safe**: Not applicable. Does not apply to this app. --- # Security & Privacy Scorecard ## Avast One: Antivirus, Security ## What This Means for You Avast One bundles four advertising networks in a paid security subscription, with device advertising identifiers potentially shared with ad platforms before a consent choice is recorded. Call metadata including phone numbers and call outcomes may be sent to a third-party caller ID service not named in the Play Store's Data Safety disclosure. ## Recommendation: Elevated Risk The overall score of 44/100 reflects solid security fundamentals alongside a substantially lower privacy score of 30/100. Four advertising networks (Google AdMob, Facebook Audience Network, Unity Ads, and Vungle) are linked in a paid security product alongside three analytics services, and the build's configuration may allow these to initialize before a consent dialog is presented on first launch. The Photo Vault feature's encryption key setup uses an iteration count far below current published guidance, which may reduce the effort required to guess a PIN if key files are obtained from shared device storage; this was not tested at runtime. **Best For:** People who want an all-in-one antivirus, VPN, and call screening tool for Android. ## Method and Limitations Static analysis only. CITT reviewed the code of this build without running the app, so runtime behavior was not observed. The findings below describe the analyzed build and may not reflect server-side controls or later versions. CITT makes no determination about compliance with any law or platform policy; it reports what the artifacts contain and cites the published guidance so a reader can compare. ## Key Findings **Data Security:** 2 findings (1 medium, 1 low) **Network Security:** 3 findings (1 medium, 2 low) **Code Safety:** 5 findings (1 medium, 4 low) **Privacy:** 3 findings (3 medium) ## Privacy Concerns ### What Leaves the Device - Device advertising identifier and behavioral signals: shared with Google AdMob, Facebook Audience Network, Unity Ads, and Vungle for advertising - App usage and session data: sent to Firebase Analytics and Adobe Analytics - Install attribution data including advertising identifier: sent to Singular - Call metadata (phone numbers, call direction, call outcomes, and device identifier): sent to Hiya (hiyaapi.com) for caller ID and call screening - Crash and stability data: sent to Firebase Crashlytics ### What Stays on the Device - Installed app list: read for malware scanning and kept on the device, not shared with advertising networks or third-party services - Photo Vault content: encrypted files are stored locally and not routed off the device ### Third-Party Data Sharing **Third parties that may receive data from the app:** - Google AdMob - advertising - Facebook Audience Network - advertising - Unity Ads - advertising - Vungle / Liftoff - advertising - Firebase Analytics - usage analytics - Adobe Analytics - usage analytics - Singular - install attribution - Hiya - caller ID and call screening - Firebase Crashlytics - crash reporting - Auth0 - authentication ## Understanding the Scores **Security:** 78/100 **Privacy:** 30/100 ### Security Breakdown - **Data Security:** 78/100. Build 26.6.0 applies hardware-backed protection for authentication data and disables app backup, preventing data from being extracted via Android backup mechanisms. The Photo Vault feature's encryption key setup uses a low-iteration approach relative to current published guidance, which may reduce its resistance to offline guessing if key files are obtained from shared external storage. - **Network Security:** 85/100. Most connections in the build use encrypted transport, and specific domains used by the developer's own services are configured to require encryption. Two configuration files permit unencrypted connections globally, which may allow some bundled SDK traffic to use insecure channels; a typographical error in one configuration file means a domain-specific restriction for a detection endpoint does not take effect. - **Code Safety:** 85/100. The build's authentication flow uses hardware-backed key storage, and the app backup feature is disabled. Four development and testing components are present in the production manifest and may be reachable by other installed apps, though their practical impact is limited. ### Privacy Breakdown - **Data Collection:** 22/100. Three analytics services (Firebase Analytics, Adobe Analytics, and Singular) are configured to initialize at app launch, potentially before the consent dialog is shown. Advertising identifiers may be included in early data flows during that window; runtime behavior was not observed to confirm whether server-side controls apply. - **Data Sharing:** 26/100. The build links four advertising networks (Google AdMob, Facebook Audience Network, Unity Ads, and Vungle) that may pass device identifiers and behavioral signals to their respective platforms. The Hiya caller ID service is also configured to route call metadata, including phone numbers and call outcomes, to its own servers. - **User Control:** 36/100. The build includes a data deletion request mechanism per the Data Safety label. Analytics and advertising services are configured to initialize before a consent decision may be recorded, and call metadata sharing with Hiya is not named in the Data Safety label, which may limit informed decision-making about that data flow. ## Positive Security Features - App backup is disabled for this build, preventing data from being extracted via Android backup or device transfer. - Authentication data is protected by hardware-backed encryption, with the Android Keystore used to manage access. - The VPN connection validates against a fixed server identity for the SurFEasy endpoint, adding resistance to network interception of VPN traffic. - The installed app list is processed on the device for malware scanning and kept locally, not shared with advertising networks, analytics services, or other third parties. - Security diagnostic telemetry is directed to the developer's own infrastructure, not to advertising networks or data brokers. ## Areas for Improvement ### Disclosure Observations Observations about disclosure, each stated against published guidance so a reader can compare: 1. **Advertising partner identification in Data Safety label** Google's Data Safety policy requires apps to identify specific third-party organizations when data is shared for advertising purposes. The Play Store label retrieved on August 11, 2026 states the app "may share App activity, App info and performance, and Device or other IDs" with third parties but does not name Facebook, Unity, or Vungle as recipients. Code analysis confirms four advertising SDKs are linked in the build and may initialize automatically; whether a server-side gate prevents data from being shared before a user consent choice is recorded was not determinable from static analysis. 2. **Caller ID data sharing not named in Data Safety label** The Hiya caller ID SDK (v5.33.7) bundled in this build contains code paths that route call metadata, including phone numbers, call direction, and call outcomes, to hiyaapi.com. The Play Store Data Safety label retrieved on August 11, 2026 does not name Hiya or disclose call event data in its third-party sharing section. Whether Hiya's data upload path is gated on a user opt-in was not determinable from static analysis. ### Security Enhancements 1. **Photo Vault key configuration** The Photo Vault derives its encryption key using an iteration count far below what current published guidance recommends. Increasing this count to current guidance levels would substantially raise the effort required to guess a PIN offline, particularly given that key files are stored in shared external storage where other apps with storage permissions may access them. 2. **Photo Vault storage location** The Photo Vault stores encrypted files and key material in shared external storage. Moving vault data to app-private storage would prevent other installed apps from accessing those files. 3. **Development components in production manifest** Three AndroidX Test instrumentation activities and one Compose development component are declared as exported in the production manifest, making them reachable by other installed apps. Excluding development-only components from release builds reduces the exposed interface. 4. **Network configuration attribute correction** A typographical error in one network security configuration file causes a domain-specific restriction for a detection endpoint to have no effect. Correcting the attribute name to the properly spelled form would restore the intended behavior. ## Technical Context **App Type:** Mobile security and privacy suite **Classes Analyzed:** 132,302 **Third-Party Services:** 16 **Context Tags:** security, privacy, ads, sensitive_data --- ## About This Analysis This security analysis was conducted by CITT (Can I Trust That), an independent security analysis service. The analysis is static code review of Android applications, intended to help people make informed decisions about app security and privacy. ### App Details **Developer:** Avast Software s.r.o. **Version:** 26.6.0 (Build 260325387) **Analysis Date:** August 12, 2026 **Package:** com.avast.android.mobilesecurity ### Analysis Limitations - Static analysis only (code review without running the app) - Based on APK version 26.6.0 analyzed on August 12, 2026 - May not reflect server-side security controls - Cannot detect all runtime behaviors