# Security & Privacy Scorecard

## Blacklane - Chauffeur Service

## What This Means for You

Your precise GPS location is sent to Braze, a marketing platform, for advertising analytics beyond coordinating your pickup, and the payment result screens pull their content from an external server where a network-level attack could alter what you see during checkout.

## Recommendation: Use With Caution

Strong connection security and a well-implemented sign-in system are undercut by two areas of concern: payment screens that load content remotely without verified navigation controls, and precise location data shared with a marketing platform under a permission prompt that only mentions ride pickups. Three medium-risk findings require awareness before trusting this app with your location and payment details.

**Best For:** Business travelers needing premium chauffeur service who accept standard app analytics and advertising tracking gated behind your explicit consent.

## Key Findings

**Data Security** - 1 finding (1 low)

**Network Security** - 2 findings (2 medium)

**Code Safety** - 3 findings (3 low)

**Privacy** - 3 findings (1 medium, 2 low)

## Privacy Concerns

### What Data is Collected

- Personal information: name, email, phone number, payment card details
- Location data: precise GPS coordinates, including in the background while the app is not open
- Device information: device identifier linked to your account for advertising
- Usage data: app interactions, booking history, in-app behavior, ride preferences

### Third-Party Data Sharing

**The following third parties may receive your data:**

- Braze - marketing analytics, receives precise GPS location linked to your identity
- AppsFlyer - advertising attribution, links your device ID to your account for ad measurement
- Facebook (Meta) - cross-app advertising tracking after you grant tracking permission
- Firebase (Google) - analytics, crash reporting, and app performance monitoring
- RudderStack - behavioral analytics and event tracking
- Datadog - app performance monitoring (activated only after you give consent)
- Intercom - in-app customer support messaging
- PayPal / Braintree / Payrails - payment processing

## Understanding the Scores

**Security:** 93/100
**Privacy:** 91/100

### Security Breakdown

- **Data Security:** 97/100 - Your sign-in information is stored securely on-device with protection tied to screen lock, and cleared when you log out. A minor concern from a third-party payment SDK using an outdated storage protection level.
- **Network Security:** 94/100 - All connections are encrypted using current standards with no exceptions. The app validates its server connections against bundled certificates for most traffic. Payment result pages load from an external content server where navigation controls could not be fully verified.
- **Code Safety:** 95/100 - Sign-in flows use the OS-provided secure browser, preventing the app from reading your passwords. A development testing stub and some test files were left in the production release, posing low practical risk.

### Privacy Breakdown

- **Data Collection:** 92/100 - Collects standard booking data alongside analytics and advertising data. Background location access is enabled and used by a marketing SDK beyond its stated pickup-coordination purpose.
- **Data Sharing:** 95/100 - Data shared with marketing and advertising partners, gated correctly behind Apple's tracking permission prompt. Braze analytics data is routed to EU servers, appropriate for a German company.
- **User Control:** 93/100 - Advertising tracking requires your explicit approval. Datadog analytics requires separate consent. The location permission prompt does not disclose marketing use.

## Positive Security Features

- All network connections enforce current encryption standards with no exceptions configured
- The app validates server identity using bundled certificates across its two main network clients
- Sign-in via Auth0, Apple, Facebook, and PayPal all use Apple's secure, isolated browser session, keeping your password away from the app itself
- Your sign-in session is stored with protection that requires the device to be unlocked, and all stored access is cleared when you log out
- Hardware-backed key storage with biometric gating is used for sensitive operations
- Advertising tracking for AppsFlyer and Facebook is correctly gated behind your explicit ATT consent and can be disabled via iOS Settings
- Marketing data is routed to Braze's EU-region servers, consistent with GDPR obligations

## Areas for Improvement

### GDPR / CCPA Compliance

The app's privacy practices could be strengthened by:

1. **Accurate Location Permission Disclosure**
   The location permission prompt says your location is used for Blacklane pickups. It does not disclose that your precise GPS coordinates are also sent to Braze for marketing analytics. Users deserve a complete picture before granting location access.

2. **Background Location Use Transparency**
   Background location collection is active even when the app is not open. This should be clearly explained to users in the permission request, including which third parties receive that background location data.

3. **Advertising Tracking Scope**
   AppsFlyer links your device identity to your account for advertising purposes across Chinese-region servers in addition to standard domains. This scope could be disclosed more prominently in the privacy policy.

### Security Enhancements

1. **Payment Screen Content Controls**
   The payment result screens (confirmation, error, cancel, pending) load their display content from an external content delivery server. Industry best practice recommends restricting the payment overlay so it cannot navigate away from that specific server, and serving content with a strict policy that limits what scripts can run.

2. **Remove Development Testing Artifacts**
   A testing stub compiled into the production app contains code that, under specific conditions, would send authentication data to an unencrypted local address and print session information to the device console. This code should be excluded from production builds.

3. **Remove Dormant Staging Domain**
   A decommissioned test domain is still listed as a trusted source in the production app's signed configuration. If that domain were ever re-registered by a third party, it could be used to route users to unexpected destinations. It should be removed from the production configuration.

## Technical Context

**App Type:** Premium transportation and ride booking (iOS)
**Third-Party Services:** 32 identified
**Context Tags:** transportation, location, payment, financial, ads, social

---

## About This Analysis

This security analysis was conducted by CITT (Can I Trust That), an independent security analysis service. We perform static code analysis on iOS applications to help users make informed decisions about app security and privacy.

### App Details

**Developer:** Blacklane
**Version:** 8.0.1 (Build 36795)
**Analysis Date:** 2026-04-14
**Package:** com.blacklane.iphone.passenger

### Analysis Limitations

- Static analysis only (code review without running the app)
- Based on IPA version 8.0.1 (Build 36795) analyzed on 2026-04-14
- May not reflect server-side security controls
- Cannot detect all runtime behaviors