'%3e%3cpath%20d='M138%2095.6436V147H0V0H138V51.3564H59.3526V95.6436H138Z'%20fill='white'/%3e%3cpath%20d='M208%200V147H150V0H208Z'%20fill='white'/%3e%3cpath%20d='M361%200V51.4292H321.377V147H261.731V51.4292H220V0H361Z'%20fill='white'/%3e%3cpath%20d='M512%200V51.4292H472.939V147H414.139V51.4292H373V0H512Z'%20fill='white'/%3e%3c/g%3e%3cdefs%3e%3cclipPath%20id='clip0_1_12'%3e%3crect%20width='512'%20height='147'%20fill='white'/%3e%3c/clipPath%3e%3c/defs%3e%3c/svg%3e)
See what an app does with your data.
Scan at volume, export the findings, or commission a teardown from the analyst who wrote the published research.
Free
$0
Public scorecards, forever.
Check any app before you install it.
- Scan any public app, as many as you want
- TRUSTED verdict across every trust check
- Findings summary with severity breakdown
- See in plain language what leaves the device
- Public catalog access
- One free rescan a month
For researchers
Research
$299/month
Scan at volume and export the findings.
- 50 detailed scans per month
- Submit in bulk by API
- Technical report: deobfuscated code, file and line references, SDK inventory and observed behavior
- Export all findings as JSON
- Private scans. Results never published
- Direct APK / IPA / XAPK upload
- Custom prompts: ask any app a specific question and get a written answer
- AI chat over the findings: open a scan and ask follow-up questions about its results
- Cross-app query across every app you've scanned (coming soon)
Custom
Let's scope it.
Book a call
Corpus-scale screening and teardowns on commission.
- Scan beyond 50/month, up to whole-category sweeps
- Named-analyst teardowns, the same work behind the published research
- Screen the vendor and third-party apps your org depends on
- White-label and co-branded reports
- Turnaround committed in the contract
- Written findings suitable for regulatory or legal use
The verdict is never for sale.
Paying gets you volume, JSON exports, and commissioned teardowns. It never changes what an app scores.
Not a pattern scanner
| MobSF / QARK | CITT | |
|---|---|---|
| Analysis method | Regex / pattern matching | Reads the decompiled code |
| False positive rate | High (no context) | Low (reads the surrounding code) |
| What to fix first | Generic flag list | Risk-ranked by what it exposes |
| AI-powered | No | Yes, with adversarial review |
| Deobfuscation | Breaks most rules | Reads through it |
| Disclosure mapping | No | Findings mapped to GDPR, CCPA, and COPPA guidance |