# Security & Privacy Scorecard

## Triodos Impact Portfolio

## What This Means for You

Your investment data is protected by phishing-resistant biometric login and stored securely on your device, but a built-in software update mechanism is present without the tamper-proofing needed to prevent unauthorized code from reaching your device if it were ever activated.

## Recommendation: Use With Caution

Strong authentication (FIDO2) and minimal tracking, but the OTA update framework lacks bundle integrity verification and a staging domain is configured in production entitlements. Suitable for Triodos customers with awareness of these medium-risk issues.

**Best For:** Triodos Impact Portfolio customers who want strong biometric login, no advertising tracking, and minimal data collection

## Key Findings

**Data Security** - 5 findings (4 low, 1 info)

**Network Security** - 5 findings (1 medium, 1 low, 3 info)

**Code Safety** - 3 findings (1 medium, 1 low, 1 info)

**Privacy** - 2 findings (2 info)

## Privacy Concerns

### What Data is Collected

- Device information: device identifier used for push notification delivery
- Biometric data: Face ID or Touch ID prompt for local authentication (processed on-device only, not transmitted)
- Usage data: app interactions within the investment portfolio interface
- Financial data: investment portfolio holdings and transaction data (transmitted to Triodos servers)

### Third-Party Data Sharing

**The following third parties may receive your data:**
- Firebase (Google) - Receives your device identifier solely for delivering push notifications; analytics and behavioral tracking are explicitly disabled
- Alamofire - Open-source networking library used for secure HTTPS communication with Triodos servers; no data leaves to external parties via this library
- Capacitor - Open-source app framework; no external data transmission

No advertising, attribution, or behavioral analytics companies receive your data.

## Understanding the Scores

**Security:** 88/100
**Privacy:** 100/100

### Security Breakdown

- **Data Security:** 90/100 - Credentials are stored in the device-secured storage area; some session data and app logic files use a lower protection level that allows access while the device is running
- **Network Security:** 92/100 - All connections use encrypted HTTPS with no exceptions; a staging server domain is authorized in the production app configuration
- **Code Safety:** 91/100 - Strong biometric and passkey authentication implemented; software update framework is present without bundle integrity verification enabled

### Privacy Breakdown

- **Data Collection:** 100/100 - Only collects what is essential to operate an investment management app; no advertising identifiers or behavioral profiling
- **Data Sharing:** 100/100 - No data shared with advertising, analytics, or attribution companies
- **User Control:** 100/100 - No background data collection; no clipboard access; minimal permission requests

## Positive Security Features

- Phishing-resistant biometric login (Face ID/Touch ID) with passkey support properly bound to the Triodos production domain
- Sensitive account data stored in the device's secure storage area, isolated to this app and not backed up to iCloud
- All network connections require encrypted HTTPS with no insecure exceptions permitted
- Network library configured to properly verify server identity on all connections
- Firebase Analytics explicitly disabled - Firebase is used only for push notification delivery
- No advertising, tracking, attribution, or behavioral analytics SDKs present
- Production builds refuse to store sensitive data in less-secure locations - a hard safeguard
- No custom app-opening links registered - eliminates a common class of external attack

## Areas for Improvement

### GDPR / CCPA Compliance

The app's privacy practices could be strengthened by:

1. **Raising File Protection Level**
   Application files, including cached app logic, are protected at a level that allows access while the device is powered on and unlocked. Enabling the highest iOS file protection level would ensure these files are inaccessible when the screen is locked.

2. **Removing Staging Environment References from Production Build**
   The production app includes references to a test server environment and internal backend service names. Removing these from the production release would reduce the information available to anyone examining the app package.

### Security Enhancements

1. **Enable Bundle Integrity Verification for Software Updates**
   The app includes a software update framework capable of delivering new application code over the internet. This framework supports a bundle-signing feature that would verify updates have not been tampered with before installation - this feature is not currently enabled, though automatic updates are also currently disabled.

2. **Restrict Staging Server Authorization**
   The production app's configuration authorizes a staging server for passkey and password autofill. Limiting this authorization to the production domain only would remove a potential boundary between test and production environments.

3. **Restrict In-App Browser Navigation**
   External links opened within the app's built-in browser do not check whether the destination is on an approved list of domains. Adding a domain allow-list would prevent users from being navigated to unintended sites within the Triodos app interface.

## Technical Context

**App Type:** Financial investment management - high sensitivity
**Classes Analyzed:** 23
**Third-Party Services:** 12 (framework and infrastructure components; no advertising or tracking SDKs)
**Context Tags:** financial, sensitive_data, investment

---

## About This Analysis

This security analysis was conducted by CITT (Can I Trust That), an independent security analysis service. We perform static code analysis on iOS applications to help users make informed decisions about app security and privacy.

### App Details

**Developer:** Triodos Bank
**Version:** 2.0.0 (Build 1)
**Analysis Date:** 2026-04-17
**Package:** de.triodos.impactportfolio

### Analysis Limitations

- Static analysis only (code review without running the app)
- Based on IPA version 2.0.0 analyzed on 2026-04-17
- May not reflect server-side security controls
- Cannot detect all runtime behaviors