# Did not meet TRUSTED criteria This build did not satisfy all of CITT's published criteria for the TRUSTED mark. The full criteria and this app's results are shown below. ## Trust Pillars - **Secure by Design**: Strong. Strong result in this area. - **Data Minimization**: Not met. Did not meet one criterion in this area. - **Manifest Mismatch**: Not met. Did not meet one criterion in this area. - **User Control**: Strong. Strong result in this area. - **Truly Local**: Not applicable. Does not apply to this app. - **Child-Safe**: Not applicable. Does not apply to this app. --- # Security & Privacy Scorecard ## Urban VPN ## What This Means for You Six advertising and analytics frameworks are bundled alongside the VPN engine in this build, and VPN usage events including connection timing and server selection may be reported to those third-party services; off-device transmission was not observed at runtime. ## Recommendation: Elevated Risk CITT rates this build Elevated Risk. Six analytics and advertising frameworks are integrated alongside the VPN engine, with VPN usage events instrumented in ways that may support external reporting, though runtime data flows were not observed. The core code safety and data security implementations score well; the low privacy scores reflect the breadth of third-party data sharing present in the binary, which may be a material consideration for users who install a VPN to reduce external data exposure. **Best For:** Casual users who want VPN access for basic region switching and general browsing. ## Method and Limitations Static analysis only. CITT reviewed the code of this build without running the app, so runtime behavior was not observed. The findings below describe the analyzed build and may not reflect server-side controls or later versions. CITT makes no determination about compliance with any law or platform policy; it reports what the artifacts contain and cites the published guidance so a reader can compare. ## Key Findings **Data Security:** 0 findings **Network Security:** 0 findings **Code Safety:** 1 finding (1 low) **Privacy:** 1 finding (1 medium) ## Privacy Concerns ### What Leaves the Device - VPN usage events (connection timing, server selection, protocol choices, subscription actions): the binary links Firebase Analytics and Mixpanel and contains VPN-specific event strings, indicating these events may be reported to those services; runtime transmission was not observed. - Advertising attribution signals: the binary links GoogleAdsOnDeviceConversion and SKAdNetwork frameworks and contains Google advertising service URLs, indicating attribution data may be shared with advertising measurement services; runtime transmission was not observed. ### What Stays on the Device - WireGuard session keys remain in memory and are not written to disk, keeping them on the device rather than in persistent storage. ### Third-Party Data Sharing **Third parties that may receive data from the app:** - Google (Firebase Analytics, Firebase Crashlytics, Firebase Performance Monitoring, GoogleAdsOnDeviceConversion) - usage analytics, crash reporting, and advertising attribution - Mixpanel - product analytics - OneSignal - push notification delivery - Branch.io - attribution and app linking - Singular (via SKAdNetwork / app-analytics-services.com) - ad campaign attribution ## Understanding the Scores **Security:** 82/100 **Privacy:** 28/100 ### Security Breakdown - **Data Security:** 87/100. Strong handling of stored data. WireGuard session keys remain in memory and are not persisted to disk, and App Groups are scoped to the developer's own Team ID. - **Network Security:** 78/100. The build links WireGuard and OpenVPN with a current OpenSSL library, providing solid VPN protocol coverage. Ensuring all in-app network connections meet the system's security requirements could raise this score further. - **Code Safety:** 90/100. Strong code safety profile. No browser bridge or JavaScript execution surface is present in the binary, and device attestation via DeviceCheck is integrated. ### Privacy Breakdown - **Data Collection:** 20/100. The binary links six analytics and advertising frameworks alongside the VPN engine, with VPN connection event strings compiled in suggesting broad usage-pattern instrumentation; off-device data flows were not confirmed by runtime testing. - **Data Sharing:** 25/100. The binary references URLs and frameworks for multiple advertising and analytics services, indicating usage data may reach several third parties. - **User Control:** 35/100. A server-side analytics control mechanism is present via Firebase Remote Config. Whether a user-facing consent gate governs the default state of analytics sharing could not be determined from static analysis. ## Positive Security Features - WireGuard session keys are kept in memory only and are not written to disk - No browser bridge or JavaScript execution surface is present in the binary - App Groups are scoped to the developer's own Team ID, meaning third-party frameworks are not included in the shared container entitlement - The binary links OpenSSL 3.6.3, a current version - The AdSupport framework is not linked in this build, meaning IDFA-based advertising identifiers are not available to the binary - A server-side analytics control mechanism is present via Firebase Remote Config - The build links WireGuard and OpenVPN, two current VPN protocols ## Areas for Improvement ### Disclosure Observations 1. **Analytics and Advertising SDK Disclosure** Apple's App Store privacy label guidelines (https://developer.apple.com/app-store/app-privacy-details/) require disclosure of data types shared with third parties. The binary links Firebase Analytics, Mixpanel, OneSignal, Branch.io, GoogleAdsOnDeviceConversion, and SKAdNetwork frameworks alongside VPN connection event strings. Whether the current App Store privacy label for this build fully accounts for all data flows associated with these integrations could not be determined from the binary alone. 2. **App Privacy Manifest** Adding an app privacy manifest (PrivacyInfo.xcprivacy) could make the App Store privacy label more complete for the analytics and advertising SDK dependencies bundled in this build. ### Security Enhancements 1. **Local Storage Encryption** The binary links SQLite for local data storage. Enabling encryption for locally stored VPN configuration data would reduce exposure if a device backup is accessed by an unintended party. 2. **URL Scheme Input Handling** The binary registers the urbanvpn:// scheme. Confirming that the URL handler applies strict parameter validation would guard against other apps on the same device passing unexpected inputs. 3. **Analytics Default State** Industry practice for privacy-sensitive applications recommends that analytics data sharing be off by default or require explicit user consent before the first reporting event. Whether such a gate is present in this build could not be confirmed from static analysis. ## Technical Context **App Type:** VPN and network privacy tool **Classes Analyzed:** 183 **Third-Party Services:** 17 third-party dependencies identified **Context Tags:** vpn, security, privacy, ads, analytics --- ## About This Analysis This security analysis was conducted by CITT (Can I Trust That), an independent security analysis service. The analysis is static code review of iOS applications, intended to help people make informed decisions about app security and privacy. ### App Details **Developer:** Not available **Version:** 4.3.4 (Build 309) **Analysis Date:** 2026-08-13 **Package:** com.ios.urban-vpn-cyber-security ### Analysis Limitations - Static analysis only (code review without running the app) - Based on iOS app version 4.3.4 (Build 309) analyzed on 2026-08-13 - May not reflect server-side security controls - Cannot detect all runtime behaviors