Mobile App Scanning
Bringing Privado's set of web tools, such as data flows, consent management, and code scanning, to mobile apps.
Details
What's Privado?
Privado is a platform that automates privacy compliance and governance by scanning code to map data flows, identify risks, and embed privacy into your software development lifecycle.
What's Code-scan?
Privado's code engine automatically scans your codebase to identify data flows, detect privacy issues, and reveal how personal data is being used and processed throughout your applications.
Code-scan is a tool to automatically detect privacy issues in your code base. This works perfectly for web-applications, but this meant a big chunk of our market was not able to use Privado as our engine could not access Mobile Apps.
My role involved leading the end-to-end design for a proof of concept for a new suite of privacy tools for Privado to capture the mobile app market.
Timeline
2024 - 2 month
Goals
Bringing Privacy Tools to Mobile Teams
1
Understand how software teams develop mobile apps
2
Find ways to provide privacy teams visibility into mobile apps
Process
Understanding Mobile Development
Mobile apps are developed differently from conventional web apps, where updates are continuously pushed. Instead, mobile apps are versioned, packaged, and then deployed as applications.
Web
Mobile
Web app vs Mobile app development
Understanding Privacy Teams
Add Apps
->
Manual Tests
->
Observe Results
Conceptualising a Mobile App Tester
Flow-Map Creator
Birds Eye View of the mobile app
Manually create maps
Need to know App Architecture
Mobile App Simulator
Visualise Flow with App UI
Granular Single Flow Recorder
Requires 3rd Party Integration to simulate
Solution
Mobile Apps and Versioning
App new app in Privado
To start testing mobile applications, we need packaged app files. By scanning the APK and IPA files, we can identify the SDKs, permissions, Third Parties, and Data Elements utilised by the app.
Version Control for Mobile apps
Delta from previous app versions
But unlike the web, which has version control built in, mobile apps use packaged apps that need to be manually uploaded by the users. This requires manual versioning within Privado to detect changes in each app update.
Mobile App Tester
Privacy officers are not familiar with simulating and testing. To address this we set out to create a testing tool that removes the complexity of a traditional simulator and focuses on allowing them to record flows.
Test recorder
We had to use metaphors from a recorder to help them understand the test recording functions.
Record
Similar to a recorder, you can start and stop "recording" your steps.
Replay
Once recorded, you can "playback" your steps to verify the actions.
Restart
If you recorded the wrong step or made an error, restart anytime.
These metaphors simplified the interface, allowing users to interact with the mobile application and focus on recording the flow.
Overview Dashboard
Mobile app overview
A single app will have multiple policies applied based on geographic locations and applicable laws, such as GDPR and CCPA. Each policy will include several tests.
To assist privacy officers in understanding this complexity, we created an overview of all findings related to an app. Giving them a birds-eye view of the third parties sharing, data elements compromised and issues created by Privado Mobile App scan.
Reports for Stakeholder Buy-ins
Mobile app PDF report
We also created an exportable report that offers an overview of high-level data and findings for privacy officers to share with management and leadership. This aims to build confidence in investing resources in privacy.
Results
Completing the Privado Privacy Suite
The mobile app scan was the final missing piece in Privado's suite of privacy tools. With this project, we completed all privacy touchpoints: codebase, websites, and now mobile apps.
The product architecture enables our sales team to join sales calls with an APK file that has already been scanned and analyzed, highlighting any privacy issues. This demonstrates value even before customers purchase Privado.
The mobile app has solidified Privado's position as a privacy center within organizations and has helped us acquire 5 new enterprise customers within a single quarter in the mobile gaming, consumer apps, and e-commerce sectors.
my team
my manager and mentor