Security and encryption
Our approach to security is documented, verifiable, and transparent.
MITRE ATT&CK Mobile coverage
Our features rely on multiple security checks mapped to the MITRE ATT&CK Mobile framework, a public knowledge base that describes attack techniques targeting phones.
Threat model
Trasimene targets documented threats from the MITRE ATT&CK Mobile framework: phishing and quishing, malicious applications, network interception (MITM), data leaks and spyware. The exact scope of detections depends on the capabilities offered by each platform (Android, iOS): we document what the application can, and cannot, detect, without promising 100% protection.
Standards compliance
OWASP Mobile Top 10, OWASP MASTG, NIST SP 800-63B, GDPR and ISO 25010 guide our choices. The server and the website are covered by automated tests: more than 1,700 tests for the website and more than 300 test files for the server as of October 2026. Our responsible disclosure policy is public (security.txt): every report receives an acknowledgement and a reply. What third parties have verified is gathered on the Proof and transparency page.
Encryption
AES-256-GCM for the vault, TLS 1.2 and 1.3 for communications between the app, the website and our servers, WireGuard for the VPN. The vault encryption keys are stored in Google Cloud Secret Manager, one key per account.
Key and secret management
The vault encryption keys (one per account, randomly generated) and infrastructure secrets are stored in Google Cloud Secret Manager, encrypted at rest by Google and automatically replicated to stay available. Access to them is restricted by Google Cloud IAM permissions to Trasimène's services and authorised staff, and every read of a vault key is logged; no key is ever sent to the phone. Vault content is encrypted with AES-256-GCM; no card data is stored by us.
Data residency
The website, the API and the data (accounts, results, encrypted vault) are hosted on Google Cloud, region europe-west1 (Belgium, EU). The VPN servers are machines rented from Google Cloud in 19 countries, 5 of them in the EU, set up and run by Trasimène. No data is sold. Providers and transfers outside the EU are detailed in our privacy policy.
Privacy
No data is sold and the app shows no ads. Trasimène collects the data the service needs. The app also sends usage measurements to Firebase Analytics and PostHog, which you can turn off in its settings (“Usage analytics”), and error reports to Sentry and Firebase Crashlytics. If you agree when creating your account on Android or on trasimene.com, creating the account and subscribing are reported to Meta, TikTok, Snapchat, LinkedIn and Google Analytics to measure our campaigns; without your consent, nothing is sent, and nothing ever leaves an iPhone. The details and how to withdraw your consent are in our privacy policy.
Responsible disclosure
Found a vulnerability? Write to us at contact@trasimene.com. Our response times, our commitment to good-faith researchers and our acknowledgements are published on the Proof and transparency page, referenced by our security.txt file (/.well-known/security.txt).