Veracta installs any Google Play app on a real device in the country you choose, decrypts the app's own encrypted traffic, and proves exactly which personal data it collects and who it sends it to. Certificate pinning, QUIC, and anti-tamper don't stop it.
Built for the people who need proof, not claims
The data-safety label is self-reported, the developer fills it out, and nobody checks it against what the app actually does at runtime. The truth is hidden behind encryption and changes by region.
The developer fills out the data-safety form. Nothing verifies it against the app's real runtime behavior.
Code that's fetched, decrypted, or triggered by a server flag never appears in a decompile. It only runs live.
Modern apps use TLS 1.3 and QUIC, pin certificates, and bundle their own crypto. A proxy sees ciphertext, or is refused.
An app can behave one way in Germany and another in Brazil. You can't see it without testing from inside each region.
CHIMERA, the analysis engine, instruments the running app across four independent surfaces. Any single surface has a blind spot. Together they give full coverage, from the first network handshake at process birth.
Hooks the app's crypto to emit its own session keys, then decrypts the raw capture host-side. Full URLs, headers, bodies across TLS, QUIC, and HTTP/3.
Attaches at process birth and hooks Java + native crypto. Sees identifier reads, location, and clipboard at time zero.
A Lua-driven host that attaches after launch and targets any class the app loads. Flexible, per-app instrumentation.
Listens on the Chrome DevTools Protocol inside in-app WebViews: the JavaScript truth a Java client never sees.
CHIMERA captures the app's own session keys from inside the app, then decrypts the recorded packets host-side. There is no proxy in the path to detect, and no certificate for the app to reject.
Keys come from inside the app, not a fake certificate the app would reject.
No proxy sits in the network path, so there's nothing for the app to detect.
Not just classic TLS, but the protocols modern apps actually use.
Hooks synchronously before the protection arms, so it sees an unmodified process.
We plant unique, marker-free canaries on the device (fake IDs, GPS, email, phone, clipboard), then search every decrypted request for those exact values in plaintext and ~20 hashed and encoded forms. A capability is not an exfiltration.
A canary that exists nowhere else in the world appears in an outbound request to a third party. That is proof the app collected it and sent it.
A canary appears alongside a JavaScript initiator, a cross-frame origin, a native egress, or a JavaScript bridge call.
The API was called, but no canary was seen leaving. Timing alone never upgrades a finding. False positives are filtered out.
Corroborated at every layer, from application code to the native engine to the on-the-wire sync, and located precisely where the capability was gated. The investigation distinguished what reaches the vendor (profile metadata) from what stays on device (the raw biometric), with proof drawn from decrypted traffic, under a strict no-real-user, no-transmit safety discipline.
Veracta is built for investigating apps you don't control, where the developer won't cooperate and the output has to stand up to scrutiny. Each audience uses the same decrypted, region-verified evidence for a different job.
Verify an app's real behavior against its declared data practices, in the jurisdiction where its users live, without waiting on the developer's cooperation.
Check whether a submitted app's runtime behavior matches its data-safety label, at scale, and catch what static review and self-reported forms miss.
Vet the mobile software your organization ships or depends on. See exactly which third-party SDKs send data, where it goes, and whether it should.
Turn a suspicion into an exhibit. Every finding traces to the decrypted request that proves it, with a SHA-256 checksum and full provenance.
Self-serve, no developer access required. Run a scan, get evidence-scored findings, and report what an app does with the proof to back it up.
Confirm your partners and SDKs collect only what they're contracted to. Catch unexpected identifier sharing and cookie-sync chains on the wire.
The free tier runs on cloud emulators in one region, with full self-serve evaluation. Paid scans run on real phones, in multiple regions at once, and cover apps that refuse to run anywhere but real hardware.
Submit a Play Store URL and a country. Get back decrypted, evidence-scored proof, free.