# Did not meet TRUSTED criteria This build did not satisfy all of CITT's published criteria for the TRUSTED mark. The full criteria and this app's results are shown below. ## Trust Pillars - **Secure by Design**: Not met. Did not meet one criterion in this area. - **Data Minimization**: Not met. Did not meet one criterion in this area. - **Manifest Mismatch**: Critical issue. Has a high-severity open item in this area, detailed below. - **User Control**: Strong. Strong result in this area. - **Truly Local**: Not applicable. Does not apply to this app. - **Child-Safe**: Not applicable. Does not apply to this app. --- # Security & Privacy Scorecard ## Urban VPN Premium ## What This Means for You The Play Store listing for this build declares "No data shared with third parties," while the binary bundles Google Analytics, OneSignal, and a Bright Data geolocation integration. Code paths in this build are configured to route behavioral data, push identifiers, and the device's real pre-VPN IP address to those services; runtime data flows were not independently observed. ## Recommendation: Elevated Risk CITT rates this build Elevated Risk (41/100). The primary concern is a gap between the "no data sharing" Play Store declaration and the third-party integrations bundled in the binary. VPN account data and session information are stored in a form that a device backup or physical access could retrieve without additional protection. The network encryption score (94/100) is a genuine strength, but the privacy gaps make this build a poor fit for users whose primary reason for choosing Urban VPN Premium is the privacy assurances advertised. **Best For:** Users looking for a straightforward IP masking service for routine browsing, where server availability and speed are the primary priorities. ## Method and Limitations Static analysis only. CITT reviewed the code of this build without running the app, so runtime behavior was not observed. The findings below describe the analyzed build and may not reflect server-side controls or later versions. CITT makes no determination about compliance with any law or platform policy; it reports what the artifacts contain and cites the published guidance so a reader can compare. ## Key Findings **Data Security** - 2 findings (1 high, 1 medium) **Network Security** - 2 findings (2 low) **Code Safety** - 5 findings (3 medium, 2 low) **Privacy** - 3 findings (1 high, 1 medium, 1 low) ## Privacy Concerns ### What Leaves the Device - Behavioral events and usage data: may be forwarded to Google Analytics (Google App Measurement) for app activity measurement, based on the integration present in this build. Runtime behavior was not confirmed. - Push notification identifiers (device and subscription IDs): may be sent to OneSignal for push notification delivery, based on the OneSignal integration in this build. Runtime behavior was not confirmed. - Real pre-VPN IP address: may be sent to a Bright Data geolocation endpoint (via a legacy GeoSurf integration) to determine the device's location before the VPN connects, based on code found in this build. Runtime behavior was not confirmed. - Advertising attribution signals: may be forwarded to Google's AdServices infrastructure on devices running Android 12 or later when the attribution permission is granted. Runtime behavior was not confirmed. ### What Stays on the Device No code path in this build was identified that logs or forwards VPN tunnel content or browsing activity to Urban VPN's servers. Runtime behavior was not confirmed, and server-side handling could not be assessed from the binary alone. ### Third-Party Data Sharing **Third parties that may receive data from the app:** - Google Analytics (Google App Measurement) - app behavior and usage measurement - OneSignal - push notification delivery and device registration - Bright Data (via GeoSurf endpoint) - geolocation lookup using the device's real IP address before the VPN connects - Google AdServices - advertising attribution on Android 12+ devices ## Understanding the Scores **Security:** 70/100 **Privacy:** 28/100 ### Security Breakdown - **Data Security:** 62/100. VPN account data and connection settings are stored locally without additional encryption protection, and the backup configuration in this build does not exclude those files from cloud or USB device backups. Firebase authentication session data uses Android's hardware-backed secure key storage. - **Network Security:** 94/100. Network connections to Urban VPN servers in this build use encrypted HTTPS, and no cleartext traffic exceptions were identified in the analyzed build. - **Code Safety:** 78/100. The VPN certificate decryption code in this build derives its key entirely from publicly known, predictable values and uses a fixed initialization sequence, reducing the protection that encryption would otherwise provide for server-sent certificate data. These are code-level design choices in the analyzed build; runtime impact could not be confirmed. ### Privacy Breakdown - **Data Collection:** 24/100. The binary bundles Google Analytics, OneSignal, and advertising attribution integrations that may forward behavioral data and device identifiers to third parties. These integrations are not reflected in the Play Store Data Safety label, which declares "No data shared with third parties" as of 2026-08-11. - **Data Sharing:** 28/100. Three external services (Google Analytics, OneSignal, Bright Data) and Google AdServices may receive data from this build. The Play Store label as retrieved on 2026-08-11 does not disclose these relationships. - **User Control:** 38/100. The Play Store listing indicates data deletion can be requested. VPN account data stored without additional protection may be accessible via a device backup. No in-app controls for the third-party data integrations were identified in this build. ## Positive Security Features - Network connections between this build and Urban VPN servers use encrypted HTTPS, and no cleartext traffic exceptions were identified in the analyzed binary. - Firebase authentication session data is protected using Android's hardware-backed secure key storage in this build. - Google Advertising ID forwarding within the Firebase Analytics integration is explicitly suppressed via manifest configuration in this build. ## Areas for Improvement ### Disclosure observations 1. **Third-party data sharing and the Play Store label** Google's Play Store policy (Data Safety section, developer guidance at support.google.com/googleplay?p=data-safety) requires disclosure of data shared with third parties. The Data Safety label retrieved on 2026-08-11 declares "No data shared with third parties." The binary bundles Google App Measurement, OneSignal, and a Bright Data geolocation integration, code paths for which are configured to route data to those companies. Whether the current label satisfies policy requirements is for the developer and Google to determine; the binary contents and the label as published are in tension. 2. **Advertising-infrastructure permissions on a paid, no-ads app** The manifest in this build declares permissions for Google Advertising ID access and Google's AdServices attribution reporting. Urban VPN Premium is marketed as a paid VPN with no advertising. The developer's privacy policy may clarify the intended purpose of these permissions; that could not be determined from the binary alone. ### Security Enhancements 1. **Protect VPN account data in device backups** Adding exclusion rules to the backup configuration (backup_rules.xml and data_extraction_rules.xml) would prevent VPN account information and session data from being included in cloud or USB device backups. 2. **Use device-specific secrets in VPN certificate key derivation** The current key derivation for VPN certificate decryption in this build relies entirely on public, predictable values. Incorporating a device-specific or user-specific secret would make this protection meaningful against someone who has obtained a copy of the APK. 3. **Validate dynamically resolved API hostnames** The backup API hostname resolution mechanism in this build rewrites the destination of authenticated requests based on a value from a DNS query, without confirming the result stays within the expected domain. Adding a domain-allowlist check would reduce exposure in a DNS manipulation scenario. ## Technical Context **App Type:** VPN / Privacy tool (Productivity category) **Classes Analyzed:** 11,543 **Third-Party Services:** 21 **Context Tags:** vpn, privacy, paid_app, analytics, ads, network_security --- ## About This Analysis This security analysis was conducted by CITT (Can I Trust That), an independent security analysis service. The analysis is static code review of Android applications, intended to help people make informed decisions about app security and privacy. ### App Details **Developer:** B.I SCIENCE (2009) LTD (Urban VPN) **Version:** 3.5.0 (versionCode 58) **Analysis Date:** 2026-08-12 **Package:** com.urbanvpn.premium.android ### Analysis Limitations - Static analysis only (code review without running the app) - Based on APK version 3.5.0 analyzed on 2026-08-12 - May not reflect server-side security controls - Cannot detect all runtime behaviors