# Security & Privacy Scorecard

## Samsung SmartThings

## What This Means for You

Your health data, step counts, and smart home device activity are sent to Samsung in the background without clear disclosure, and portions of the app's network security are disabled, leaving some connections to Samsung service portals and third-party weather and air quality APIs without transport protection.

## Recommendation: Significant Privacy & Security Concerns

Multiple medium-severity issues include weak protection settings for smart home authentication data, silent health data transmission to Samsung, and globally disabled network security across the app. Consider these risks carefully before granting the app access to your health data, smart home devices, and location.

**Best For:** Samsung ecosystem users who want centralized SmartThings control and are comfortable with Samsung analytics and health data collection via Family Care features.

## Key Findings

**Data Security** - 6 findings (2 medium, 1 low, 3 info)

**Network Security** - 3 findings (1 medium, 2 info)

**Code Safety** - 4 findings (1 medium, 2 low, 1 info)

**Privacy** - 9 findings (4 medium, 5 info)

## Privacy Concerns

### What Data is Collected

- Health and fitness data: daily step counts, sleep reports, Samsung Health data transmitted in the background via HealthKit background delivery
- Account and device information: Samsung account ID, mobile device ID, screen-on time, location
- Smart home device data: camera and hub diagnostics, device event histories, network topology (SSIDs, IP addresses) accessible via iTunes file sharing
- Usage and behavioral data: in-app analytics with user tracking explicitly enabled in the production build

### Third-Party Data Sharing

**The following third parties may receive your data:**

- Samsung Analytics - first-party analytics tracking app usage and user behavior; no privacy manifest declared
- Microsoft AppCenter - crash reporting and diagnostics; enhanced logging restricted to US/CA locales only
- LaunchDarkly - feature flag service configured with full personal information attribute support (name, email, country) for targeting; data sent to US-based servers

## Understanding the Scores

**Security:** 90/100
**Privacy:** 86/100

### Security Breakdown

- **Data Security:** 91/100 - Local databases use strong encryption; some storage protection settings could be strengthened
- **Network Security:** 93/100 - Primary Samsung API connections are well-protected; transport security is globally relaxed for several third-party and Samsung service domains
- **Code Safety:** 94/100 - Generally strong code practices; debug UI screens are compiled into the production build and a file download function passes caller-supplied filenames without visible validation

### Privacy Breakdown

- **Data Collection:** 87/100 - Health data collection via HealthKit background delivery occurs with only a vague permission description; analytics tracking is enabled in production
- **Data Sharing:** 93/100 - Data sharing is primarily within the Samsung ecosystem; LaunchDarkly is configured to accept personal information attributes for feature targeting
- **User Control:** 87/100 - No app-level privacy manifest and no AppTrackingTransparency integration make it difficult for users to review or limit data collection

## Positive Security Features

- Certificate validation implemented for primary Samsung API endpoints, helping protect your smart home account from network interception
- Local databases encrypted using SQLCipher AES-256 in both the main app and the Apple Watch extension
- Realm databases initialized with an encryption key, adding a second layer of at-rest data protection
- iOS secure storage used for account credentials, following the correct iOS pattern for sensitive data
- App links scoped exclusively to Samsung-controlled domains, reducing the risk of unauthorized deep-link hijacking
- Crash reporting logging restricted to US and Canada locales only, limiting diagnostic data collection by region

## Areas for Improvement

### GDPR / CCPA Compliance

The app's privacy practices could be strengthened by:

1. **Adding an App-Level Privacy Manifest**
   Apple requires apps that collect user data or use analytics to include a privacy manifest at the app level. Adding one would allow users and regulators to review exactly what data the app collects and why.

2. **Clarifying the HealthKit Permission Description**
   The current health data permission message ("SmartThings needs to access your health data") does not describe what data is collected or where it goes. Updating it to specifically mention step counts, sleep data, and transmission to Samsung would give users meaningful informed consent.

3. **Implementing AppTrackingTransparency for Cross-Service Tracking**
   If SmartThings usage is linked with activity across other Samsung services, Apple's policy requires requesting user permission before initiating that tracking. Integrating the AppTrackingTransparency framework would bring the app into compliance.

4. **Reviewing LaunchDarkly User Context Attributes**
   LaunchDarkly is configured to accept personal information attributes for feature targeting. Limiting the context to non-identifying attributes (such as a device tier or locale) would reduce the personal data sent to third-party servers on each app launch.

### Security Enhancements

1. **Restricting iTunes File Sharing**
   Disabling iTunes/Finder file sharing, or limiting the Documents folder contents, would prevent smart home camera logs and hub diagnostics from being extracted by anyone with physical access to the device and a USB cable.

2. **Strengthening Storage Access Protection**
   Updating the storage protection settings so that files remain inaccessible while the device is locked would reduce exposure of smart home configuration data on a lost or unattended device.

3. **Removing Debug Screens from Production Builds**
   Environment-selection and debug drawer screens are compiled into the production app. Excluding these from store builds would eliminate the risk of them being reached through undiscovered gestures or URL schemes.

## Technical Context

**App Type:** Smart home IoT control hub - manages security cameras, smart locks, thermostats, and connected appliances; high sensitivity due to device control and health data access
**Classes Analyzed:** 0 (iOS binary; static headers, symbols, and configuration files analyzed)
**Third-Party Services:** 20 identified
**Context Tags:** smart_home, iot, health, camera, location, samsung_ecosystem, analytics

---

## About This Analysis

This security analysis was conducted by CITT (Can I Trust That), an independent security analysis service. We perform static code analysis on iOS applications to help users make informed decisions about app security and privacy.

### App Details

**Developer:** Samsung
**Version:** 1.7.45 (Build 22)
**Analysis Date:** 2026-04-17
**Package:** com.samsung.oneconnect4ios

### Analysis Limitations

- Static analysis only (code review without running the app)
- Based on IPA version 1.7.45 (Build 22) analyzed on 2026-04-17
- May not reflect server-side security controls
- Cannot detect all runtime behaviors