# Security & Privacy Scorecard

## SAP for Me

## What This Means for You

Your enterprise support data is encrypted on your device and sent only over secured connections, with built-in controls that let you decide whether your search activity is shared with analytics services.

## Recommendation: Very Secure

Secures your enterprise support data with encrypted storage and HTTPS, plus robust permission controls. Built for SAP customers who need mobile access to sensitive systems.

**Best For:** Enterprise SAP customers who need mobile support case management and accept Adobe analytics under TrustArc consent

## Key Findings

**Data Security** - 1 finding (1 low)

**Network Security** - 1 finding (1 low)

**Code Safety** - 2 findings (1 medium, 1 low)

**Privacy** - 2 findings (1 medium, 1 low)

## Privacy Concerns

### What Data is Collected

- Account and profile information: sent to Adobe Experience Platform and Firebase Analytics for usage analytics
- Search queries: terms you type in the SAP support portal may be sent to Adobe Experience Platform when analytics is active
- App usage data: app events and session information are sent to Firebase Analytics
- Crash reports: device state and app details at the time of a crash may be sent to Firebase Crashlytics
- Calendar events: accessed on your device when you choose to save SAP events to your local calendar

### Third-Party Data Sharing

**The following third parties may receive your data:**
- Adobe Experience Platform - analytics including search queries typed in the support portal
- Firebase Analytics (Google) - app usage analytics
- Firebase Crashlytics (Google) - crash reporting
- TrustArc - consent preference management
- Qualtrics - in-app surveys when you participate
- ServiceNow - enterprise chat and support ticket integration

## Understanding the Scores

**Security:** 94/100
**Privacy:** 90/100

### Security Breakdown

- **Data Security:** 97/100 - Strong protection for sensitive information stored on your device. Account data is encrypted locally and session information is secured throughout.
- **Network Security:** 97/100 - All communication travels over secured connections with no exceptions. Enterprise-grade transport protection is applied throughout the app.
- **Code Safety:** 93/100 - Well-structured application built on established security libraries with consistent, proper access controls for device features.

### Privacy Breakdown

- **Data Collection:** 90/100 - The app requests only what is needed for enterprise support functions, with consent controls actively governing analytics activity.
- **Data Sharing:** 95/100 - Data sharing is scoped to analytics partners and enterprise integrations, with TrustArc consent management applied to Adobe services.
- **User Control:** 91/100 - Meaningful consent controls are provided through TrustArc, giving you the ability to manage whether analytics data is shared.

## Positive Security Features

- All sensitive data stored on your device is encrypted using protections anchored to your device's hardware security
- Session information is kept in encrypted storage and cannot be extracted through device backup tools
- Backup of app data is blocked, preventing account information from being copied off your device
- Logging out completely clears all session data, account information, and browser cookies stored by the app
- All communication with SAP and partner services uses secured connections throughout
- Enterprise certificate-based login is supported for organizations requiring it
- Web content within the app is restricted to an approved list of SAP and partner domains, limiting where the built-in browser can be directed

## Areas for Improvement

### GDPR / CCPA Compliance

The app's privacy practices could be strengthened by:

1. **Analytics Consent on First Launch**
   Adobe analytics activity may begin before the in-app consent dialog is shown to a new user. Ensuring analytics remain inactive until after consent is explicitly given would align with privacy regulations that require affirmative consent before tracking begins.

2. **Search Query Handling**
   Search terms entered in the SAP support portal are forwarded to Adobe Experience Platform when analytics are active. For enterprise users whose queries may contain sensitive operational details, providing a separate option to opt out of search query forwarding would reduce the risk of inadvertent data exposure.

### Security Enhancements

1. **Production QA Tool Removal**
   A QA debugging tool for Adobe analytics is included in the production app. While connecting it requires a user to follow a specific pairing link, removing QA tooling from production builds is industry best practice.

2. **Onboarding Link Security**
   The Terms of Service and Privacy Policy links on the onboarding screen initially use unencrypted connections before being redirected to secured ones. Updating these links to use secured connections from the start would eliminate any window for tampering during that initial request.

## Technical Context

**App Type:** Enterprise mobile portal for SAP product portfolio and support case management
**Classes Analyzed:** 42,879
**Third-Party Services:** 27 services identified
**Context Tags:** enterprise, sensitive_data, camera, location

---

## About This Analysis

This security analysis was conducted by CITT (Can I Trust That), an independent security analysis service. We perform static code analysis on Android applications to help users make informed decisions about app security and privacy.

### App Details

**Developer:** SAP SE
**Version:** 1.19.1 (versionCode 2801)
**Analysis Date:** June 13, 2026
**Package:** com.sap.forme.android

### Analysis Limitations

- Static analysis only (code review without running the app)
- Based on APK version 1.19.1 analyzed on June 13, 2026
- May not reflect server-side security controls
- Cannot detect all runtime behaviors