# Did not meet TRUSTED criteria This build did not satisfy all of CITT's published criteria for the TRUSTED mark. The full criteria and this app's results are shown below. ## Trust Pillars - **Secure by Design**: Strong. Strong result in this area. - **Data Minimization**: Strong. Strong result in this area. - **Manifest Mismatch**: Not met. Did not meet one criterion in this area. - **User Control**: Strong. Strong result in this area. - **Truly Local**: Not applicable. Does not apply to this app. - **Child-Safe**: Not applicable. Does not apply to this app. --- # Security & Privacy Scorecard ## WhatsApp ## What This Means for You Messages between users are protected by Signal Protocol end-to-end encryption, meaning only the communicating parties can read message content. MetaAI conversations in this build are processed by Meta's servers and are not covered by end-to-end encryption. ## Recommendation: Trustworthy CITT rates WhatsApp trustworthy: message content is protected by Signal Protocol end-to-end encryption so Meta cannot read it, iCloud backups use hardware-bound encryption that is inaccessible to Apple, and no third-party analytics or advertising SDKs are present in this build. MetaAI conversations are processed on Meta's servers without end-to-end encryption and may be retained on those servers. **Best For:** People who want their messages protected by end-to-end encryption and who communicate primarily within the Meta platform ecosystem. ## Method and Limitations Static analysis only. CITT reviewed the code of this build without running the app, so runtime behavior was not observed. The findings below describe the analyzed build and may not reflect server-side controls or later versions. CITT makes no determination about compliance with any law or platform policy; it reports what the artifacts contain and cites the published guidance so a reader can compare. ## Key Findings **Data Security:** 0 findings **Network Security:** 0 findings **Code Safety:** 3 findings (3 low) **Privacy:** 0 findings ## Privacy Concerns ### What Leaves the Device - Phone book contacts: the permission string in this build discloses that contact information may be sent to WhatsApp's servers for contact discovery - MetaAI conversation content: the MetaAI integration processes conversational content on Meta's servers; this content is not covered by WhatsApp's end-to-end encryption ### What Stays on the Device - Message content: end-to-end encrypted with keys held on the user's device; message content is not readable by Meta or WhatsApp - iCloud backup encryption keys: hardware-bound to the user's device; Apple cannot access backup contents - Chat Lock content: protected by Secure Enclave biometric-bound keys that cannot leave the device ### Third-Party Data Sharing **Third parties that may receive data from the app:** - Meta (WhatsApp parent company) - platform infrastructure, contact discovery, MetaAI processing - Ipification - SIM-based phone number verification at registration - Apple - stores encrypted iCloud backup data; encryption keys remain on the user's device ## Understanding the Scores **Security:** 91/100 **Privacy:** 80/100 ### Security Breakdown - **Data Security:** 92/100. Keychain items in this build are device-locked and cannot migrate to another device through backups. Chat Lock content is Secure Enclave-bound and inaccessible without the user's biometric. - **Network Security:** 87/100. Production API communications use HTTPS with additional transport verification layers at the messaging and media layers. The build's App Transport Security configuration includes a global override across all bundle targets, which is noted as an area for improvement below. - **Code Safety:** 88/100. Three low-severity observations were identified in this build relating to internal infrastructure references in the binary's string table, in-app browser scripting scope, and payment-related link handling. ### Privacy Breakdown - **Data Collection:** 88/100. No advertising identifier APIs are linked in this build; attribution uses Apple's privacy-preserving SKAdNetwork only. No third-party analytics SDKs are linked in the binary. - **Data Sharing:** 94/100. Data sharing is limited to Meta's own infrastructure and a single SIM-verification partner. No data brokers or third-party advertising networks were identified in this build. - **User Control:** 92/100. Users retain custody of message encryption keys and iCloud backup encryption keys on their own device. Contact upload is disclosed in the permission prompt before access is granted. ## Positive Security Features - Signal Protocol symbols are confirmed in this binary, indicating end-to-end encryption is implemented for messages; message content is not readable by Meta or WhatsApp - iCloud backup encryption keys are hardware-bound to the user's device, making backup contents inaccessible to Apple - No third-party analytics or advertising SDKs are linked in this build; all telemetry routes through Meta's own infrastructure - No advertising identifier (IDFA) APIs are linked in the binary; attribution uses Apple's privacy-preserving SKAdNetwork - Chat Lock content is protected by Secure Enclave biometric-bound keys that cannot leave the device - All Keychain items in this build are device-locked and cannot migrate to another device through backups - Contacts, as disclosed in the permission string, flow to WhatsApp and Meta-owned infrastructure only; no third-party vendor endpoints were identified for contact data - Production messaging and media connections use HTTPS with additional transport verification layers ## Areas for Improvement ### Disclosure observations Observations about disclosure, each stated against the published guidance so a reader can compare: 1. **Privacy Manifest Advertising Purpose Declaration** Apple's App Store privacy guidelines encourage developers to declare their data-use purposes in a privacy manifest ([Apple developer documentation](https://developer.apple.com/documentation/bundleresources/privacy_manifest_files)). The privacy manifest in this build declares third-party advertising purposes in its required-reason API entries while the NSPrivacyTracking flag is set to false. Readers comparing these two values may find them inconsistent; whether this precisely reflects the current data practices could not be determined from the binary alone. 2. **Contact Upload Disclosure** The permission string in this build explicitly discloses that contact information may be uploaded to WhatsApp's servers for contact discovery. This disclosure is in line with Apple's requirement for clear permission descriptions. Users who prefer not to share their contact list can decline the contacts permission; core messaging functionality continues with manual number entry. ### Security Enhancements 1. **App Transport Security Scope** The build applies a global App Transport Security override across all bundle targets. Narrowing this to the specific domains that require it would reduce the potential surface for network-level risks. 2. **Default File Protection Level** App files in this build default to Class B protection, meaning they are accessible when the device is locked. Raising the default to Class C would ensure app files are inaccessible in a locked-device state. 3. **Debug Interfaces in Production** The production binary includes debug Bonjour service registrations and an internal automation interface. Removing these before submission would reduce the information available to someone who analyzes the binary. ## Technical Context **App Type:** Encrypted messaging, high sensitivity (contacts, messages, media, payments) **Classes Analyzed:** 3,400 **Third-Party Services:** 1 (Ipification) **Context Tags:** social, contacts, camera, sensitive_data, financial --- ## About This Analysis This security analysis was conducted by CITT (Can I Trust That), an independent security analysis service. The analysis is static code review of iOS applications, intended to help people make informed decisions about app security and privacy. ### App Details **Developer:** WhatsApp LLC (Meta Platforms) **Version:** 26.31.74 (Build 1035496826) **Analysis Date:** 2026-08-13 **Package:** net.whatsapp.WhatsApp ### Analysis Limitations - Static analysis only (code review without running the app) - Based on iOS build 26.31.74 (Build 1035496826) analyzed on 2026-08-13 - May not reflect server-side security controls - Cannot detect all runtime behaviors