Proof and transparency

As of October 2026, two things are established by others than us:

• The publisher. TRASIMENE SAS is registered in the French national business register under SIREN 103 240 560: a simplified joint-stock company created on 30 March 2026, headquartered at 61 rue de Lyon, 75012 Paris, chaired by Mohamed Essid. Apple identifies the same company by its DUNS number 286714569 on the App Store listing. Look it up: annuaire-entreprises.data.gouv.fr.
• The published apps. Every version of the app is examined by Apple before it goes live on the App Store, and by Google before it goes live on Google Play. The Android app was released on 9 July 2026, the iPhone app on 4 August 2026.

• App Store listing
• Google Play listing
• French national business register

An independent assessment appears on this page only with the name of the body, its date and its full report.

Trasimène works without a button to press. Your phone measures its settings, its network and, on Android, its apps; our servers compare these measurements with rules and with threat lists updated every day, then send back a green, red or grey result, explained in your language. On Android, the scan runs every 30 minutes by default. On iPhone, it runs when iOS allows it.

As of October 2026, the app performs up to 157 checks on Android and 48 on iPhone. Our checks follow the public MITRE ATT&CK Mobile framework, which describes the attack techniques aimed at phones (attack.mitre.org). Each alert says what was seen and what to do.

A grey result means the measurement could not take place: a permission is missing, the VPN is off, or the system does not allow it. A grey is never shown as a green.

When a rule is wrong, we fix it on the server. The fix takes effect within minutes and your phone receives it at its next scan, without an app update.

Our threat information comes from public, recognised sources: URLhaus, ThreatFox, MalwareBazaar and Feodo Tracker (abuse.ch), OpenPhish, Phishing.Database, CERT Polska, Google Safe Browsing, VirusTotal as a last resort (which receives a file's fingerprint or a site name, never the file), Have I Been Pwned for leaked addresses, the CISA list of exploited vulnerabilities and the NVD database. The full list, by use, is on the page How Trasimène works.

Recognised test files

The antivirus industry uses harmless test files to check that a protection reacts: the EICAR file, published by the European body of the same name, and the AMTSO files from the association of security vendors and testing labs, including an Android test app. Since 22 October 2026, our servers recognise the fingerprints of these files, in all their published forms, and treat them like any known threat. Download them from eicar.org and amtso.org.

• Trasimène focuses on what really exposes a phone: its settings, its network, its links and, on Android, its apps.
• When an app is a problem, Trasimène tells you which one, why, and how to uninstall it. The decision stays yours.
• The VPN flags the dangerous sites you contact, without cutting your connection for you. Name resolution is handed to Quad9, a Swiss service that sets aside on its side the malicious domains it knows.
• On iPhone, iOS isolates every app from the others: no app sees the list of other apps, their files, your SMS messages or their notifications. Trasimène works within that frame, with 48 checks: jailbreak, iOS version, profiles and remote management, network and Wi-Fi, QR code links, leaks of your email address.

• VPN. The content of your traffic is neither read nor recorded. Our servers keep the history of your VPN connections (server, address assigned in the tunnel, connection and disconnection times), deleted 72 hours after access ends, and the volume of data exchanged each month, kept for 13 months. For 48 hours, they also keep the sites from our threat and advertising lists that you contacted, with how many times, the most requested non-existent site names, and figures about your connections and the names requested (count, ports, duration, length), without any address or site name.
• Vault. Your passwords, notes and files are encrypted on our servers with AES-256-GCM, using a key unique to your account, held in a secrets manager with restricted access, where every read of a key is logged. That key is not derived from your password: you get your vault back by signing in on a new phone, with no recovery phrase to keep. Our servers decrypt the content to display it to you in the app. Capacity: 5 GB, up to 30 MB per file, 10,000 passwords and 10,000 notes. The key and the vault are destroyed 30 days after you delete your account.
• Check results. The result of each check (green, red or grey, with its explanation) is kept for 30 days, to show history and reports. The detail of an anomaly may name a site or an app; it disappears with the anomaly.
• Android apps. To assess your apps, our servers keep, for each one, its technical name, its file fingerprint, its publisher's signature and its origin, for 30 days after the last scan that saw it. The app files themselves never leave your phone.
• Usage measurement. The app sends usage measurements (screens opened, steps in the journey) to Firebase Analytics and PostHog, to improve the product. They are on at first and can be turned off in the app's settings, with the “Usage analytics” switch. Error reports go to Sentry and Firebase Crashlytics.

Your account data (email address, name, preferences) stays as long as your account exists. The detail of each data item, its retention and its legal basis is in the privacy policy.

Your data is sold to no one. The app shows no ads and embeds no tool from Meta, TikTok, Snapchat or LinkedIn. All security features are free, with no trial period and no time limit; only the VPN is paid: €3.99/month or €39.99/year.

To run the service, we entrust data to providers, each for one precise task:

• Hosting: Google Cloud, region europe-west1 (European Union), for the API, the website, the databases and the vault files; the vault keys are held in Google Cloud's secrets manager. The 19 VPN servers are Google Cloud machines, one per country, set up and run by Trasimène.
• Usage measurement, can be turned off: Firebase Analytics (Google) and PostHog (servers in the European Union).
• Error reports: Sentry (servers in the European Union for the apps and the website) and Firebase Crashlytics.
• Payment: Apple in the iPhone app, Google in the Android app; RevenueCat and Stripe on trasimene.com. We neither see nor store any card data.
• Email: Resend, for confirmation, alert and billing messages, and for the newsletter if you subscribed to it.
• Breach monitoring: Have I Been Pwned receives each email address you choose to monitor and tells us whether it appears in a known breach; checked when added, then every 24 hours.
• Link and file reputation: Google Safe Browsing and VirusTotal, which receive a link's address or a file's fingerprint, never the file.

Campaign measurement, with your consent: when you create an account with your email address on Android or on trasimene.com, an unticked box asks whether you will help us learn which campaigns bring real users. If you agree, creating the account and subscribing are reported to our advertising platforms (Meta, TikTok, Snapchat, LinkedIn) with a hashed version of your email address. Meta, TikTok and Snapchat also receive, at sign-up, your IP address and the technical description of your browser or phone (user-agent). Google Analytics receives an account identifier, never your address. Without your consent, nothing is sent, and nothing ever leaves an iPhone. You can withdraw your consent at any time in your account settings.

Our store declarations. The App Store privacy label and the Google Play Data safety section state, in the format each store requires, what the app collects and shares. We write them ourselves and review them with every change, so that they match our privacy policy and this page.

Each provider, transfers outside the European Union and your rights are detailed in the privacy policy.

Found a vulnerability in the app, the website or the API? Write to contact@trasimene.com. Our security.txt file, at /.well-known/security.txt, lists this contact and points to this policy.

We acknowledge receipt within 5 working days and give you a first assessment within 15 working days. We fix confirmed vulnerabilities as a priority and keep you informed until the fix is released.

We take no legal action against anyone acting in good faith: who does not read, alter or keep other users' data, who does not disrupt the service, and who gives us time to fix before publishing.

Acknowledgements

With their consent, every person who reported a confirmed vulnerability to us is named here, with the date.

• How Trasimène works
• Security and encryption
• Privacy Policy
• Company and press
• security.txt file