# Security & Privacy Scorecard

## My Vodafone Romania

## What This Means for You

Your billing and payment communications use security settings that accept certificates installed by corporate IT systems or network proxies, and a portion of app data is encrypted with a key that is identical across every installation worldwide. On a personal phone, the app works as expected; on a work device managed by your employer, these settings create meaningful risk.

## Recommendation: Acceptable

Suitable for personal-device use by Vodafone Romania customers managing their contract, bills, and data usage. An encryption key built into the app is shared across all installations, and authentication channels accept user-installed certificates, which elevates risk on employer-managed or proxy-intercepted devices. Standard account and billing management on an unmanaged personal phone carries acceptable risk.

**Best For:** Vodafone Romania customers managing their account and bills on a personal device

## Key Findings

**Data Security** - 1 finding (1 high)

**Network Security** - 2 findings (1 high, 1 medium)

**Code Safety** - 2 findings (1 medium, 1 low)

**Privacy** - 4 findings (2 medium, 1 low, 1 info)

## Privacy Concerns

### What Data is Collected

- Account and billing information: shared with Vodafone's servers to manage your contract, invoices, and payments
- Location data: collected and may be shared with analytics partners
- Contact information: accessed on your device to support multi-number account management
- Call log and phone identity: accessed on your device to display your usage history
- Per-app network statistics: a ranked list of which apps on your device use the most mobile and Wi-Fi data is sent to VFG NetPerform (net-perform.com), a third-party measurement service
- App usage and behavior: shared with advertising attribution and analytics services during your sessions

### Third-Party Data Sharing

**The following third parties may receive your data:**
- Adjust - mobile advertising attribution and analytics
- Firebase Analytics (Google) - app usage and performance analytics
- Huawei HiAnalytics - usage analytics on Huawei devices
- Facebook - advertising measurement and analytics
- Tealium - analytics event orchestration and routing to other destinations
- VFG NetPerform (net-perform.com) - receives a ranked list of which apps on your phone consume the most network data
- Medallia Digital - customer satisfaction surveys, including audio capture during survey sessions

## Understanding the Scores

**Security:** 72/100
**Privacy:** 83/100

### Security Breakdown

- **Data Security:** 60/100 - A fixed encryption key built into the app is shared across all installations worldwide, weakening the protection it provides for certain app data in transit within the app.
- **Network Security:** 70/100 - Authentication and billing channels are configured to accept user-installed certificates, which can allow proxy software on managed or intercepted devices to inspect those communications. Unencrypted connections are permitted to several service domains.
- **Code Safety:** 89/100 - Strong overall code practices, with secure hardware-backed key storage and encrypted local storage actively used across the app.

### Privacy Breakdown

- **Data Collection:** 82/100 - The app collects account, billing, location, and usage data consistent with carrier app expectations, though per-app network statistics sent to a third-party service go beyond typical billing functionality.
- **Data Sharing:** 84/100 - Your data is shared with several analytics and attribution partners. The analytics routing layer can be updated without an app update, meaning data destinations may change between Play Store releases.
- **User Control:** 85/100 - You can request data deletion, the app supports GDPR erasure requests via the Adjust SDK, and account data management is available within the app.

## Positive Security Features

- Login is protected with enhanced server identity verification on the initial authentication gateway
- Authorization tokens use hardware-backed secure key storage on the device
- Encrypted local storage is available for sensitive data through Android's secure storage system
- Barcode scanning is processed entirely on-device with no data sent externally

## Areas for Improvement

### GDPR / CCPA Compliance

The app's privacy practices could be strengthened by:

1. **NetPerform Data Disclosure**
   Users should be clearly informed before the app accesses and transmits a ranked list of which other apps on their device consume network data to a third-party service. This disclosure is not clearly presented during permission requests.

2. **Microphone Access Scope**
   Three independent audio capture components are included in the production build, all activated by a single permission. Limiting audio access to documented user-facing features and clearly scoping each component to its stated purpose would improve transparency.

### Security Enhancements

1. **Encryption Key Management**
   Replacing the fixed encryption key with device-unique or dynamically generated keys would ensure that the encryption protecting certain app data cannot be bypassed by anyone with a copy of the app.

2. **Authentication Channel Security**
   Restricting billing and payment authentication channels to system-trusted certificates only would prevent proxy software used in managed enterprise environments from inspecting or modifying sensitive API traffic.

## Technical Context

**App Type:** Account management and billing, financial sensitivity
**Classes Analyzed:** 1,200
**Third-Party Services:** 17
**Context Tags:** financial, sensitive_data, location

---

## About This Analysis

This security analysis was conducted by CITT (Can I Trust That), an independent security analysis service. We perform static code analysis on Android applications to help users make informed decisions about app security and privacy.

### App Details

**Developer:** Vodafone România
**Version:** 7.11.2 (versionCode 7110203)
**Analysis Date:** 2026-06-13
**Package:** ro.vodafone.mcare.android

### Analysis Limitations

- Static analysis only (code review without running the app)
- Based on APK version 7.11.2 analyzed on 2026-06-13
- May not reflect server-side security controls
- Cannot detect all runtime behaviors