How does Trasimène work?

Facts, without judging them. As of October 2026:

• On Android, up to 157 checks in four groups: the system, apps, the network, and Trasimène's own protection;
• On iPhone, 48 checks in four groups: the system, the network, privacy, and Trasimène's own protection.

The app sends these measurements to our servers. It does not decide by itself whether something is serious.

Our servers. Each check has a rule, stored in our database. When a rule is wrong (a false alarm, for example), we fix it on the server: the fix takes effect within minutes, and your phone gets it at its next scan, with no app update.

The result is explained to you in your language, among 26 languages.

That the measurement could not happen: a permission is missing, the VPN is off, or the system does not allow it. A grey check is never shown as a green one: we would rather tell you we do not know than reassure you wrongly.

From public, recognised sources, as of October 2026:

• Dangerous sites, lists updated every day: URLhaus and ThreatFox (abuse.ch), OpenPhish, Phishing.Database, Block List Project, CERT Polska.
• Known malicious Android apps: fingerprints from MalwareBazaar and ThreatFox (abuse.ch), and VirusTotal as a last resort, which only receives the file's fingerprint, never the file.
• Links: our list of dangerous sites, then Google Safe Browsing, then VirusTotal.
• Data leaks: Have I Been Pwned, for the email addresses you monitor.
• Servers that control malware: Feodo Tracker (abuse.ch).
• Security flaws: the US agency CISA's list of exploited flaws, and the NVD database.
• Certificates and domain age: Cert Spotter, crt.sh and the RDAP directory.
• iOS versions: the public ipsw.me catalogue of versions released for each iPhone model.

A list of the world's most visited sites (Tranco) is used as a safeguard against false alarms.

• Android: a monitoring service runs in the background and starts a scan every 30 minutes by default. You can change this pace in the settings.
• iPhone: iOS decides when an app may work in the background, based on how you use your phone and your battery. Trasimène asks to run about every 30 minutes, with no guarantee.
• Data leaks: each monitored address is checked when you add it, then every 24 hours.

• On Android: the list of your apps (technical name, file fingerprint, publisher signature, origin and install date), the phone model, the measurements of each check, and, in your notifications, the website addresses and scam words spotted.
• What does not leave: the app files themselves, and the full text of your notifications and SMS messages.

For encryption, data hosting and key management, see Security and transparency.

After a full scan, you get at most one summary per day and per phone, if notifications are turned on. If your email address shows up in a new leak, you are told. You can also download a PDF report, created by our servers.

iOS shields each app from the others. That is good for your security, but no app can:

• see the list of other apps, or their files;
• see other apps' traffic;
• read your SMS messages;
• keep working in the background all the time.

With the Trasimène VPN, each site name requested inside the tunnel is compared with our lists, and the dangerous sites you contacted are flagged to you in the app. The VPN does not stop them itself: name resolution is handed to Quad9, a Swiss service that sets aside on its side the malicious domains it knows. Seven iPhone checks need this tunnel; without it, they stay grey.

• It does not remove apps for you: it tells you which one and how.
• It has no anti-theft feature and no protection against unwanted calls.
• As of October 2026, the VPN flags the dangerous sites you contacted, but does not stop them itself; Quad9 sets aside on its side the malicious domains it knows. Neither one stops ads or trackers.
• It does not promise 100% protection.