# Security & Privacy Scorecard

## VanMoof

**Version:** 25.7 (Build 907009900)  
**Scan Date:** 2026-03-04

## What This Means for You

Ride data, app usage, and crash reports are shared with Firebase Analytics and Crashlytics. Location is processed through Google Maps and Magic Lane for navigation features. Auth0 handles account login, so identity details pass through Okta's infrastructure.

## Recommendation: Trustworthy

**Best For:** VanMoof riders comfortable with standard analytics

## Key Findings

**Data Security** - 2 findings (1 medium, 1 low)

**Network Security** - 0 findings

**Code Safety** - 0 findings

**Privacy** - 3 findings (2 medium, 1 low)

## Privacy Concerns

### What Data is Collected

- Ride and trip activity
- App usage patterns and behavioral analytics
- Crash reports and diagnostic data
- Location data for mapping and navigation
- Account and identity information

### Third-Party Data Sharing

- **Firebase Analytics and Crashlytics** (Google): app usage, ride activity, and crash diagnostics
- **Google Maps SDK and Google Play Services**: location and routing data
- **Magic Lane SDK**: map and navigation data
- **Auth0 (Okta)**: account login and identity details

## Understanding the Scores

| Category | Score |
|----------|-------|
| Security | 92/100 |
| Privacy | 85/100 |
| Data Security | 92/100 |
| Network Security | 100/100 |
| Code Safety | 90/100 |
| Data Collection | 88/100 |
| Data Sharing | 90/100 |
| User Control | 88/100 |

## Positive Security Features

- Local data is stored in an encrypted database, protecting saved information if the device is lost or stolen.
- Authentication is handled through Auth0, a dedicated identity provider, rather than a custom-built login system.
- All network communication uses modern transport security practices, resulting in a perfect network security score.

## Areas for Improvement

- Some locally stored data could benefit from additional protection layers to further limit what is accessible on the device.
- Analytics collection runs across multiple platforms simultaneously, giving several companies parallel visibility into riding patterns.
- Account details pass through multiple third-party services during login, expanding the number of parties that handle identity information.

---

## About This Analysis

This scorecard is based on automated static analysis of the app's code and configuration. Scores reflect the security and privacy practices observed at the time of scanning.

### App Details

- **App:** VanMoof
- **Package ID:** nl.samsonit.vanmoofapp
- **Version:** 25.7 (Build 907009900)
- **Scan Date:** 2026-03-04
- **Analysis by:** canITrustThat