# Did not meet TRUSTED criteria This build did not satisfy all of CITT's published criteria for the TRUSTED mark. The full criteria and this app's results are shown below. ## Trust Pillars - **Secure by Design**: Not met. Did not meet one criterion in this area. - **Data Minimization**: Strong. Strong result in this area. - **Manifest Mismatch**: Not met. Did not meet one criterion in this area. - **User Control**: Strong. Strong result in this area. - **Truly Local**: Not applicable. Does not apply to this app. - **Child-Safe**: Not applicable. Does not apply to this app. --- # Security & Privacy Scorecard ## PayPal ## What This Means for You Build 8.107.2 stores payment authentication keys inside hardware that cannot be read by any other process on the device, and links attribution and analytics services that may share behavioral data with third parties; runtime data flows were not tested. ## Recommendation: Solid Build 8.107.2 combines hardware-backed account protection with a broad third-party SDK footprint. Payment authentication keys are created inside the Secure Enclave and hardware-isolated from all other processes; biometric verification is configured as a prerequisite for releasing those keys. Info.plist is configured to disable HTTPS enforcement globally, meaning third-party SDK connections may reach unencrypted HTTP (not tested at runtime), and the build's privacy manifest declares no data collection while linking analytics and attribution SDKs. **Best For:** People who use PayPal for payments, money transfers, and financial account management and want hardware-backed login protection. ## Method and Limitations Static analysis only. CITT reviewed the code of this build without running the app, so runtime behavior was not observed. The findings below describe the analyzed build and may not reflect server-side controls or later versions. CITT makes no determination about compliance with any law or platform policy; it reports what the artifacts contain and cites the published guidance so a reader can compare. ## Key Findings **Data Security:** 0 findings **Network Security:** 2 findings (1 medium, 1 low) **Code Safety:** 3 findings (1 medium, 2 low) **Privacy:** 1 finding (1 low) ## Privacy Concerns ### What Leaves the Device - Contact information: the build contains a contact synchronization feature; whether contacts are sent to PayPal's servers was not tested at runtime. - Usage and attribution data: Adjust, Firebase Analytics, Adobe Experience Platform, and Sprig are linked, all designed to receive behavioral and usage data; off-device transmission was not tested. - Session monitoring data: Datadog RUM is linked and designed to receive session data; off-device transmission was not tested. - Install attribution signals: Apple AdServices and SKAdNetwork are linked for attribution measurement; off-device transmission was not tested. - Checkout and enrichment data: Rokt and Clearbit are linked; off-device transmission was not tested. ### What Stays on the Device - Payment authentication keys: the build creates and stores these inside the Secure Enclave, hardware-isolated storage that cannot be read or extracted by any other process. - Biometric verification: Face ID and Touch ID authentication is processed entirely on the device; no biometric data leaves the device. ### Third-Party Data Sharing **Third parties that may receive data from the app:** - Adjust - mobile attribution and marketing analytics - Firebase Analytics - app usage analytics - Firebase Crashlytics - crash reporting - Sprig (UserLeap) - in-app surveys and session monitoring - Datadog RUM - real user monitoring and performance analytics - Adobe Experience Platform - behavioral and customer analytics - Rokt - checkout advertising and offers - Clearbit - contact and business data enrichment - Plaid (LinkKit) - bank account linking and verification - Braintree - payment processing - Apple AdServices and SKAdNetwork - install attribution measurement - FraudForce - device-based fraud detection - Didomi - user consent management - Additional: Loggly (SolarWinds), KnotAPI, Atomic FI, Amazon Chime SDK, iZettle SDK, CardinalMobile, Honey (GiphyUISDK), TrustKit (Data Theorem), Thales TSHPaySDK, FaceTecSDK, Daon, MiSnap ## Understanding the Scores **Security:** 80/100 **Privacy:** 77/100 ### Security Breakdown - **Data Security:** 88/100. Build 8.107.2 creates payment authentication keys inside the Secure Enclave and configures biometric verification as a prerequisite for accessing those keys. No data storage weaknesses were identified in this analysis. - **Network Security:** 68/100. Info.plist is configured to disable HTTPS enforcement globally and for all in-app web content, removing transport security protections for third-party SDK connections. TrustKit is linked to provide domain verification for PayPal's own API connections. - **Code Safety:** 88/100. Build structure and hardware-backed authentication design reflect strong practices. JavaScript files injected into in-app browser sessions register 29 message handlers without page-origin checks, and deprecated networking API references remain present in linked frameworks. ### Privacy Breakdown - **Data Collection:** 76/100. Multiple analytics and attribution services are linked, including Adjust, Firebase Analytics, Adobe Experience Platform, and Sprig. The build's privacy manifest declares no data types are collected or tracked, a discrepancy with the linked SDK inventory. - **Data Sharing:** 82/100. Payment and financial data stays within PayPal's first-party infrastructure based on the keychain entitlements in the build. Third-party analytics, session monitoring, advertising, and enrichment services may receive behavioral data; runtime flows were not tested. - **User Control:** 86/100. iOS permission controls govern access to device data, and hardware-enforced biometric verification protects account access. Background location access is declared in the build alongside the foreground-only permission, using identical justification text for both. ## Positive Security Features - Build 8.107.2 creates payment authentication keys inside the Secure Enclave; these keys are hardware-isolated and cannot be read or extracted by any other process on the device. - Passkeys (FIDO2) support is present, enabling login without passwords and reducing exposure to account takeover through phishing. - The build configures biometric verification (Face ID and Touch ID) as a prerequisite before authentication keys are released from the keychain; this processing happens locally on the device. - TrustKit is linked, providing domain verification enforcement for PayPal's own API connections. - Modern encryption is confirmed in the build for financial data operations. - Key sharing between PayPal-owned apps (PayPal, Honey, Xoom) is enforced through Apple's Team ID system; only apps from the same developer team can read the shared items. - The keychain entitlements show that shared account data between PayPal-owned services does not extend to third-party app ecosystems. ## Areas for Improvement ### Disclosure observations Observations about disclosure, each stated against the published guidance so a reader can compare: 1. **Privacy manifest and linked SDK inventory** Apple's App Store privacy guidelines require developers to disclose data collected through third-party SDKs, including analytics and attribution libraries. Build 8.107.2 links Adjust, Firebase Analytics, Sprig, Adobe Experience Platform, Datadog RUM, and Rokt, all services designed to receive behavioral data. The build's privacy manifest declares no data types are collected or tracked. Whether runtime data flows align with the manifest declaration could not be determined from the binary; a reader comparing the linked SDK list to the declared manifest will find a discrepancy. 2. **Background location permission scope** The build declares a background location permission alongside the foreground-only location permission, using identical justification text for both. Apple's guidelines recommend requesting only the minimum location access required. Whether background location authorization is requested at runtime was not verified in this analysis. ### Security Enhancements 1. **In-app web content transport security** Info.plist disables HTTPS enforcement for all in-app web content. Enabling HTTPS enforcement with narrow per-domain exceptions for any required HTTP resources would reduce the exposure of in-app browser sessions to unencrypted content. 2. **In-app browser message handler origin verification** JavaScript files injected into in-app browser sessions register 29 message handlers that respond to calls from any page without checking the page origin. Adding origin verification before processing bridge messages would limit what a compromised or malicious page could trigger. 3. **Deprecated networking library references** Linked frameworks reference networking APIs that Apple deprecated and excluded from public headers in iOS 15+. Updating or replacing the third-party dependencies that introduce these references would remove reliance on unsupported code paths. ## Technical Context **App Type:** Financial payment platform, high sensitivity level **Classes Analyzed:** 0 **Third-Party Services:** 27 **Context Tags:** financial, sensitive_data, contacts, location, camera --- ## About This Analysis This security analysis was conducted by CITT (Can I Trust That), an independent security analysis service. The analysis is static code review of iOS applications, intended to help people make informed decisions about app security and privacy. ### App Details **Developer:** Not available **Version:** 8.107.2 (build 75) **Analysis Date:** 2026-08-13 **Package:** com.yourcompany.PPClient ### Analysis Limitations - Static analysis only (code review without running the app) - Based on iOS build 8.107.2 (build 75) analyzed on 2026-08-13 - May not reflect server-side security controls - Cannot detect all runtime behaviors