# Security & Privacy Scorecard

## Comdirect photoTAN

## What This Means for You

Test banking account numbers that follow real comdirect account patterns are bundled inside the app and can be read by anyone who extracts the app from a device backup.

## Recommendation: Use With Caution

Strong security controls protect your authentication data, and your data stays entirely within comdirect's own systems. However, mock banking customer IDs bundled in the app increase risk if the app file is extracted or backed up. Comdirect customers who understand this limitation can use the app safely for TAN generation.

**Best For:** Comdirect banking customers who want a dedicated TAN generator with strong authentication controls and no third-party data sharing.

## Key Findings

**Data Security** - 3 findings (2 medium, 1 low)

**Network Security** - 1 finding (1 info)

**Code Safety** - 0 findings

**Privacy** - 2 findings (2 info)

## Privacy Concerns

### What Data is Collected

- Account activity: screen views and authentication interactions linked to your account identifier
- Diagnostic data: operational error reports sent to comdirect's own servers
- Device information: device identifiers used for secure authentication binding

### Third-Party Data Sharing

**The following third parties may receive your data:**
- Google (Firebase) - push notification delivery only

## Understanding the Scores

**Security:** 91/100
**Privacy:** 99/100

### Security Breakdown

- **Data Security:** 88/100 - Test banking account identifiers are bundled in the production app; biometric setup preferences are stored without full protection
- **Network Security:** 100/100 - All network traffic uses enforced secure connections with no exceptions configured
- **Code Safety:** 100/100 - No dangerous code patterns detected across all analyzed binaries

### Privacy Breakdown

- **Data Collection:** 100/100 - Only collects data necessary for authentication and TAN generation
- **Data Sharing:** 100/100 - No data shared with advertising or analytics companies
- **User Control:** 100/100 - Privacy disclosures are complete and accurate

## Positive Security Features

- All network communications use secure connections with no exceptions
- Your authentication data is protected by hardware-backed device binding that ties it specifically to your device
- Biometric authentication keys are invalidated automatically if you re-enroll Face ID or Touch ID
- Local app data is stored in a strongly encrypted database
- Usage analytics and Firebase Analytics are fully disabled
- No advertising, tracking, or analytics companies receive your data
- No advertising identifier is accessed
- TAN codes are derived on-device with no network dependency for the core cryptographic operation
- Backend database access requires authentication - unauthenticated access is blocked at the server
- Privacy disclosures are complete and accurate, covering all required data types

## Areas for Improvement

### GDPR / CCPA Compliance

The app's privacy practices could be strengthened by:

1. **Removing Test Data from Production Builds**
   Mock banking account numbers and session data should be excluded from released app builds to avoid bundling identifiable account patterns in files that can be extracted from device backups.

2. **Protecting Biometric Setup Preferences**
   Authentication state settings should be stored in protected system storage rather than general app preferences, preventing manipulation if device storage is accessed directly.

### Security Enhancements

1. **Stronger File Protection at Rest**
   Enabling the highest level of iOS file protection would ensure that even temporary or cached files remain inaccessible while the device screen is locked, not just after the first unlock following a reboot.

2. **Request URL Logging Precision**
   Confirming that operational error reports use URL templates rather than fully constructed addresses would prevent account identifiers from appearing in server-side log pipelines.

## Technical Context

**App Type:** Financial - banking TAN generator, high sensitivity
**Classes Analyzed:** 149
**Third-Party Services:** 21 libraries identified (cryptographic, networking, and notification frameworks)
**Context Tags:** financial, sensitive_data

---

## About This Analysis

This security analysis was conducted by CITT (Can I Trust That), an independent security analysis service. We perform static code analysis on iOS applications to help users make informed decisions about app security and privacy.

### App Details

**Developer:** comdirect
**Version:** 9.11.0 (build 3654)
**Analysis Date:** 2026-04-11
**Package:** de.comdirect.phototan

### Analysis Limitations

- Static analysis only (code review without running the app)
- Based on iOS app version 9.11.0 analyzed on 2026-04-11
- May not reflect server-side security controls
- Cannot detect all runtime behaviors