# Security & Privacy Scorecard

## Booking.com

## What This Means for You

Your precise location and device identity are shared with a fraud analytics vendor (Riskified), and some of your in-app messages and travel data are cached without full encryption on your device - meaning they could be read if your phone is physically compromised.

## Recommendation: Acceptable with Awareness

Booking uses biometric security and HTTPS for primary endpoints, but some cached data (messages, GraphQL responses) lacks encryption. Users should know their precise location and device identity are shared with fraud analytics vendors.

**Best For:** Travelers who prioritize booking convenience and trust large established platforms with extensive third-party SDK integrations

## Key Findings

**Data Security** - 2 findings (2 medium)

**Network Security** - 5 findings (3 medium, 2 low)

**Code Safety** - 5 findings (1 medium, 3 low, 1 info)

**Privacy** - 6 findings (1 medium, 2 low, 3 info)

## Privacy Concerns

### What Data is Collected

- Personal information: name, email, account credentials, government ID documents (for identity verification flows)
- Device information: device ID, device fingerprint (via FingerprintPro and Riskified Beacon), advertising identifier
- Location data: precise GPS location (linked to your identity via Riskified fraud analytics)
- Usage data: booking history, browsing behavior, app interactions, search preferences
- Biometric data: facial comparison data (during identity verification via Au10tix)
- Payment information: payment method metadata, transaction history

### Third-Party Data Sharing

**The following third parties may receive your data:**

- Riskified - fraud scoring (receives your precise location and device identity linked to your account)
- FingerprintPro - device fingerprinting for fraud prevention
- TMXProfiling - fraud detection and risk scoring
- BehavioSec - behavioral biometrics for fraud detection
- Klarna - payment processing and embedded payment UI
- Adyen - payment processing (3D Secure authentication)
- Stripe - payment processing
- PayPal - payment processing
- Au10tix - identity document scanning and biometric verification
- AppsFlyer - mobile attribution and marketing analytics
- OneTrust - consent management platform
- Firebase Crashlytics - crash reporting and app stability
- Google AdMob - advertising
- Zendesk - customer support
- Embrace - app performance observability
- RevolutAuth - embedded Revolut payment authentication

## Understanding the Scores

**Security:** 88/100
**Privacy:** 87/100

### Security Breakdown

- **Data Security:** 89/100 - Primary API data is well protected, though some cached messages and GraphQL responses on-device lack full encryption
- **Network Security:** 89/100 - Core booking and payment flows use HTTPS exclusively; a small number of legacy and CDN exceptions remain
- **Code Safety:** 94/100 - Strong biometric and Secure Enclave protections; minor development artifacts remain in the production binary

### Privacy Breakdown

- **Data Collection:** 89/100 - Broad but expected data collection for a travel commerce platform; consent management is active via OneTrust
- **Data Sharing:** 90/100 - Data sharing with fraud analytics vendors (including linked precise location) warrants awareness
- **User Control:** 91/100 - OneTrust consent platform actively gates Firebase Analytics and ad signals; analytics opt-out is supported

## Positive Security Features

- Biometric-protected Secure Enclave key storage - login credentials are held in hardware-backed storage that cannot be extracted from the device
- Active upgrade campaign migrating existing users to stronger biometric-bound storage (V1 to V2 migration)
- OneTrust consent management actively disables Firebase Analytics, Facebook SDK, and Google Ads signals when users decline tracking
- All primary booking, authentication, and payment endpoints use HTTPS exclusively
- Dedicated consent-aware analytics architecture - analytics collection is off by default and gated on explicit user consent

## Areas for Improvement

### GDPR / CCPA Compliance

The app's privacy practices could be strengthened by:

1. **Riskified Precise Location Disclosure**
   Users are not prominently informed that a fraud analytics vendor receives their precise GPS location linked to their identity. Clearer disclosure of this practice in the privacy policy and consent flow would strengthen transparency.

2. **App Store Privacy Nutrition Label Completeness**
   The app's privacy manifest does not include declarations for first-party data collection and tracking status, which may leave the App Store privacy label incomplete. Completing these declarations would give users a more accurate picture before installing.

3. **Analytics Consent Signal Consistency**
   A configuration flag enabling data upload to server-side analytics containers appears active alongside consent flags that disable client-side analytics collection. Aligning these flags ensures users who decline analytics are fully opted out across all collection paths.

### Security Enhancements

1. **On-Device Cache Encryption**
   Conversation messages and travel data cached on-device use a weaker protection class that leaves them readable after the first device unlock. Applying stronger file protection to these caches would reduce exposure on physically compromised devices.

2. **Development Configuration Cleanup**
   Several development-only configurations (internal server hostnames, localhost telemetry endpoints, a test URL scheme) remain in the production binary. Removing these before App Store submission reduces the attack surface and improves build hygiene.

3. **Klarna Payment Bridge Message Validation**
   The embedded Klarna payment component's JavaScript bridge accepts cross-window messages without validating the sending origin. Adding origin validation to this bridge would prevent cross-frame interference with the payment flow.

## Technical Context

**App Type:** Travel commerce platform with payment processing, identity verification, and fraud detection - high sensitivity
**Classes Analyzed:** 29
**Third-Party Services:** 26 identified
**Context Tags:** travel, financial, location, sensitive_data, ads, biometric, identity_verification

---

## About This Analysis

This security analysis was conducted by CITT (Can I Trust That), an independent security analysis service. We perform static code analysis on iOS applications to help users make informed decisions about app security and privacy.

### App Details

**Developer:** Booking.com B.V.
**Version:** 65.4 (Build 65.4.2453304889)
**Analysis Date:** 2026-04-18
**Package:** com.booking.BookingApp

### Analysis Limitations

- Static analysis only (code review without running the app)
- Based on IPA version 65.4 analyzed on 2026-04-18
- May not reflect server-side security controls
- Cannot detect all runtime behaviors