# Security & Privacy Scorecard

## The AA (NZ)

## What This Means for You

Your account login and membership data is stored with strong hardware-backed protection on your device, though the app shipped with two development-era features still active in the production release that other installed apps could use to trigger unexpected login behavior.

## Recommendation: Use With Caution

The app's security foundation is strong, with HTTPS-only networking and hardware-backed protection for your login session. Two development artifacts remain in the production release - a test login callback and a network security override in a third-party plugin. The secure browser-based login flow and plugin-level scoping reduce the practical risk, making this a reasonable choice for AA members who keep their app updated.

**Best For:** NZ AA members managing roadside assistance, membership, and travel services who want a convenient mobile experience

## Key Findings

**Data Security** - 2 findings (1 low, 1 info)

**Network Security** - 1 finding (1 medium)

**Code Safety** - 4 findings (1 medium, 1 low, 2 info)

**Privacy** - 1 finding (1 info)

## Privacy Concerns

### What Data is Collected

- Personal information: membership details, name, email address
- Location data: used for roadside assistance requests and finding nearby AA services
- Device information: device identifiers for push notifications and analytics
- Usage data: app interactions, trip tracking data, journey costs, fuel usage

### Third-Party Data Sharing

**The following third parties may receive your data:**

- Firebase (Google) - app performance monitoring, crash reporting, and push notifications
- Google Maps - location data for finding AA services and navigation
- Auth0 - user login and session management
- Google Ads Identifier - advertising identifier for analytics purposes
- Google Tag Manager - campaign tracking configuration (currently no active tags configured)

## Understanding the Scores

**Security:** 92/100
**Privacy:** 98/100

### Security Breakdown

- **Data Security:** 97/100 - Strong on-device encryption for stored data, including hardware-backed login session protection and an encrypted local database
- **Network Security:** 93/100 - All connections use HTTPS by default; a dormant network security override is present in a third-party download plugin
- **Code Safety:** 93/100 - Release build is hardened with backup disabled and debug mode off; two development artifacts remain in the production configuration

### Privacy Breakdown

- **Data Collection:** 100/100 - Analytics and push notification collection are disabled at startup and only activated after user consent
- **Data Sharing:** 100/100 - Data sharing limited to services directly supporting app functionality
- **User Control:** 100/100 - Users can request data deletion; consent controls for analytics are implemented

## Positive Security Features

- App data backup is disabled, preventing extraction via connected computers or cloud backup
- All network connections use HTTPS with no cleartext traffic permitted
- Login uses a secure browser-based flow with built-in protection against interception
- Login session stored in the Android Keystore with hardware-backed protection
- Secure storage library used for sensitive app data, backed by Android hardware security
- Analytics and push notification collection disabled at startup, requiring explicit consent
- Local database protected with strong encryption
- In-app browser cross-origin file access protections enforced
- Release build is not set to debug mode
- App verifies it is installed from the Play Store and terminates unlicensed installs

## Areas for Improvement

### GDPR / CCPA Compliance

The app's privacy practices could be strengthened by:

1. **Remove the Test Login Callback**
   The production app contains a development-era login redirect that was not removed before release. Removing it would eliminate a surface through which other installed apps could trigger unexpected login states.

2. **Confirm Maps SDK Key Restrictions**
   The Google Maps SDK key embedded in the app should be confirmed as restricted to this app's signing certificate in Google Cloud Console to prevent potential misuse against the developer's billing account.

### Security Enhancements

1. **Add Release Guard to Network Override Feature**
   A network security override in the background downloader plugin is available without any release-mode restriction. Adding a debug-only condition would ensure it cannot be activated in production builds.

2. **Document Database Encryption Key Management**
   The app uses an encrypted local database, but the source of the encryption key could not be verified from the analyzed code. Confirming this uses hardware-backed key derivation would strengthen the security guarantee for users on all device types.

## Technical Context

**App Type:** Transportation and membership services, location-aware
**Classes Analyzed:** 12,769
**Third-Party Services:** 17 services identified
**Context Tags:** transportation, location, financial, analytics

---

## About This Analysis

This security analysis was conducted by CITT (Can I Trust That), an independent security analysis service. We perform static code analysis on Android applications to help users make informed decisions about app security and privacy.

### App Details

**Developer:** NZ Automobile Association
**Version:** 1.2.1 (Build 10200150)
**Analysis Date:** 2026-05-06
**Package:** nz.co.aa.mobile.android

### Analysis Limitations

- Static analysis only (code review without running the app)
- Based on APK version 1.2.1 analyzed on 2026-05-06
- May not reflect server-side security controls
- Cannot detect all runtime behaviors