# Security & Privacy Scorecard

## nl.afas.pocket2

## What This Means for You

Usage activity is shared with Mixpanel and Firebase for analytics and push notifications. The app can access contacts and calendar when those permissions are granted. Microsoft Intune integration means an organization may manage how the app operates on the device.

## Recommendation: Trustworthy

**Best For:** AFAS users comfortable with standard analytics

## Key Findings

**Data Security** - 3 findings (1 low, 2 info)

**Network Security** - 3 findings (3 info)

**Code Safety** - 0 findings

**Privacy** - 2 findings (1 low, 1 info)

## Privacy Concerns

### What Data is Collected

The app collects usage and behavioral data through Mixpanel and Firebase. Device identifiers are used to deliver push notifications. When permissions are granted, the app can read contacts and calendar events. Photos and files can also be accessed when those features are used.

### Third-Party Data Sharing

Behavioral and usage data is shared with Mixpanel for analytics. Firebase receives device and session data to support push notifications and core app services. If an organization has configured Microsoft Intune, enterprise policies may govern how the app operates and what activity data is visible to the IT department.

## Understanding the Scores

| Category | Score |
|---|---|
| Security | 91/100 |
| Privacy | 84/100 |
| Data Security | 94/100 |
| Network Security | 98/100 |
| Code Safety | 92/100 |
| Data Collection | 84/100 |
| Data Sharing | 92/100 |
| User Control | 89/100 |

## Positive Security Features

- Biometric authentication support lets users secure access using fingerprint or face recognition instead of a password
- Enterprise mobile management through Microsoft Intune allows organizations to enforce security policies on the app
- Network communication received near-perfect scores, indicating strong practices for protecting data in transit

## Areas for Improvement

- Usage and behavioral data is shared with Mixpanel and Firebase by default, and the app does not provide in-app controls to opt out of this analytics collection.
- Contact and calendar data becomes accessible once those permissions are granted; users who prefer to limit this can review and adjust permissions in device settings.
- The app includes Bluetooth access through multiple libraries; if Bluetooth features are not used, this represents a broader permission scope than may be necessary.

---

## About This Analysis

This scorecard is based on static analysis of the app's code and configuration. Scores reflect security and privacy practices observed in the version analyzed. Real-world behavior may vary based on server-side configuration and individual usage.

### App Details

| Field | Value |
|---|---|
| Package | nl.afas.pocket2 |
| Version | 2.33.6 (2330600) |
| Scan Date | 2026-04-09 |
| Platform | Android |