# Did not meet TRUSTED criteria This build did not satisfy all of CITT's published criteria for the TRUSTED mark. The full criteria and this app's results are shown below. ## Trust Pillars - **Secure by Design**: Strong. Strong result in this area. - **Data Minimization**: Strong. Strong result in this area. - **Manifest Mismatch**: Not met. Did not meet one criterion in this area. - **User Control**: Strong. Strong result in this area. - **Truly Local**: Not applicable. Does not apply to this app. - **Child-Safe**: Not applicable. Does not apply to this app. --- # Security & Privacy Scorecard ## MyNISSAN ## What This Means for You Vehicle commands and account data are routed through Nissan's own servers, while several analytics and performance monitoring services linked in this build may also receive app activity and device information. ## Recommendation: TRUSTED CITT assesses this build as Trustworthy. Sign-in sessions are isolated from third-party code in a sandboxed browser context, and vehicle commands route exclusively through Nissan's own infrastructure. A mobile threat defense component is present that can block in-app phishing links. Firebase Analytics is disabled in this build despite the SDK being bundled. **Best For:** Nissan owners who want to remotely manage their vehicle and track maintenance from their phone. ## Method and Limitations Static analysis only. CITT reviewed the code of this build without running the app, so runtime behavior was not observed. The findings below describe the analyzed build and may not reflect server-side controls or later versions. CITT makes no determination about compliance with any law or platform policy; it reports what the artifacts contain and cites the published guidance so a reader can compare. ## Key Findings **Data Security:** 1 finding (1 low) **Network Security:** 0 findings **Code Safety:** 0 findings **Privacy:** 0 findings ## Privacy Concerns ### What Leaves the Device Based on the analytics and monitoring SDKs linked in this build, the following data types may leave the device: - App activity and device performance: may be shared with Dynatrace and Adobe Experience Platform for monitoring and analytics - Referral and attribution data: may be shared with Branch.io - Crash reports: may be shared with Firebase Crashlytics - Location queries for map features: may be shared with Google Maps and Google Places - In-app feedback and ratings: may be shared with Apptentive - Customer support chat: may be shared with Salesforce ### What Stays on the Device - Sign-in information is stored in the iOS Keychain, isolated from third-party analytics and advertising SDKs. - Customer support chat history is stored with local encryption on the device. ### Third-Party Data Sharing **Third parties that may receive data from the app:** - Dynatrace - app performance monitoring and user analytics - Adobe Experience Platform - analytics - Branch.io - referral and attribution tracking - Firebase Crashlytics - crash reporting - Google Maps / Google Places - location-based mapping features - Apptentive - in-app feedback and customer ratings - Salesforce - customer support chat - AdSupport / SKAdNetwork / AdServices - advertising measurement ## Understanding the Scores **Security:** 90/100 **Privacy:** 85/100 ### Security Breakdown - **Data Security:** 89/100. Strong protection overall. The binary links a symbol that disables iOS file protection on at least one file; the specific file and its contents could not be characterized without full decompilation, so this is a capability-level observation only. - **Network Security:** 91/100. All confirmed server connections in the analyzed build use encrypted transport. - **Code Safety:** 94/100. Strong defensive posture, including a mobile threat defense component that can identify and block in-app phishing links. ### Privacy Breakdown - **Data Collection:** 84/100. Several analytics SDKs are linked in the binary, though Firebase Analytics is explicitly disabled in this build. - **Data Sharing:** 88/100. Vehicle commands and account interactions route through Nissan's own infrastructure. Analytics and monitoring services may also receive data as described above. - **User Control:** 84/100. Nissan's published privacy policy includes a data deletion request option. ## Positive Security Features - Firebase Analytics is disabled in this build despite the SDK being present in the bundle. - Customer support chat history is stored with encryption on the device. - App data is protected using Apple's CryptoKit framework for authenticated encryption. - Sign-in information is stored in the iOS Keychain with Face ID binding capability. - Account sign-in uses a sandboxed browser session that third-party SDKs cannot observe. - ZDefend (Zimperium) mobile threat defense is bundled and can block in-app phishing links. - All confirmed server connections in the analyzed build use encrypted transport. - Vehicle commands and account data are routed exclusively through Nissan's own first-party servers. ## Areas for Improvement ### Disclosure observations 1. **Analytics SDK disclosure** The binary links several analytics and performance monitoring SDKs, including Dynatrace, Adobe Experience Platform, Branch.io, and Google Tag Manager. Apple's App Store privacy label guidelines recommend that developers disclose all SDKs that handle user data. Whether all linked SDKs are reflected in the current App Store privacy label could not be determined from this static analysis alone. 2. **App privacy manifest** An app privacy manifest (PrivacyInfo.xcprivacy) was not identified in the analyzed bundle. Apple introduced this manifest to help developers document required reason APIs and third-party SDK data practices. Adding one could make the App Store privacy label more complete for the SDKs bundled in the app. ### Security Enhancements 1. **File protection level** The binary links a symbol that disables iOS data protection for at least one file, making that file readable outside of normal device-locked states. Configuring the highest appropriate protection level for each file would bring the app in line with Apple's iOS Data Protection guidance and reduce the exposure window for that file's contents. ## Technical Context **App Type:** Connected vehicle companion app - high sensitivity (remote vehicle control, location, account access) **Classes Analyzed:** 0 **Third-Party Services:** 17 **Context Tags:** automotive, vehicle data, location, remote commands, analytics, third-party risk --- ## About This Analysis This security analysis was conducted by CITT (Can I Trust That), an independent security analysis service. The analysis is static code review of iOS applications, intended to help people make informed decisions about app security and privacy. ### App Details **Developer:** Nissan North America, Inc. **Version:** 6.9.110 (Build 3) **Analysis Date:** 2026-08-30 **Package:** com.nissan.mynissan ### Analysis Limitations - Static analysis only (code review without running the app) - Based on IPA version 6.9.110 analyzed on 2026-08-30 - May not reflect server-side security controls - Cannot detect all runtime behaviors