Ground truth on what apps do with your data.

A man-in-the-middle proxy fakes a certificate the app can reject, and sits in the network path where the app can detect it. Veracta captures the app's own session keys from inside the app and decrypts the traffic host-side. There's no proxy to detect and no certificate to refuse, so it works on pinned, QUIC, bundled-crypto, and anti-tamper-protected apps that defeat proxies entirely.

Before each scan we plant unique, random, marker-free canary values for device IDs, GPS, email, phone, and clipboard. When one of those exact values, which exists nowhere else in the world, appears in an outbound request to a third party, that's proof the app collected it and sent it. We search plaintext plus roughly twenty hashed and encoded variants, and weight a plaintext match above a hashed one.

An app can behave completely differently for a user in Germany versus Brazil. Veracta proves the device's traffic actually exits the country you requested before any analysis runs, using a two-layer check measured on the device and corroborated from the host. A region mismatch is a hard abort, so a finding is never misattributed to the wrong country.

Every run produces a complete, organized evidence directory following FAIR data principles and W3C provenance metadata, with a SHA-256 checksum for every file. A regulator or court can be handed the decrypted request that proves a claim, not just a summary.

Wherever possible, we keep your information in the secure systems we run ourselves, for storage, processing, and monitoring. Your data is kept separate from every other customer’s, so customers cannot access each other’s information. When we test our security, we use test data, not real user or customer data, and keep it inside our controlled environment. Our most recent review found no issues from the OWASP Top 10:2025.