Trust & Security
Built with care. Tested with intent.
Security is not a badge we earn once. Before changes are released, mittiPaw uses automated analysis, access-control checks, device testing and focused review. When those checks uncover something, we fix it and test again.
Mobile application security review
As part of our pre-release review, the Android release candidate was analyzed using MobSF, an established open-source mobile application security analysis framework.
The assessment was treated as a security engineering check — not as a certification.
- No release-blocking findings remained after review.
- No privacy-tracker signatures were detected in the scan.
- No known vulnerable dependencies were reported by the scan at the time it ran.
- Cleartext network traffic was explicitly disabled in the Android manifest.
- Android application backup was disabled for the hardened release build.
- Unused biometric permissions were removed before release.
Static-analysis results are a snapshot of a specific build and do not mean that software is free from all vulnerabilities.
We test beyond static analysis.
The release candidate was also exercised through authenticated flows on a physical Android device.
During that testing, we found an access-permission regression affecting saved care documents. We corrected the underlying permission configuration and re-ran the same release flow successfully.
The flows we validated on-device:
- Signed-in access
- Saving care documents
- Reloading after sign-out / sign-in
- Food lookup
- AI Health Brief
This reflects one round of device testing, not exhaustive coverage across every device or Android version.
Access follows the pet.
Signed-in identity is required to reach a pet's records. Pet-level access rules protect what's stored, and family access is scoped to the specific pet it was granted for — not to the app login as a whole. These checks are enforced at the data layer, not only on screen, so a request for a pet's records is checked against your account and permissions every time.
Encrypted in transit.
mittiPaw uses HTTPS/TLS for network communication, and cleartext Android traffic is explicitly disabled in the hardened release configuration.
Privacy by restraint.
No privacy-tracker signatures were detected in the MobSF release scan. mittiPaw does not use third-party advertising or analytics SDKs, and does not use crash-reporting SDKs, at this time.
For what we collect and why, see our Privacy Policy, and for how to remove your data, see Account deletion.
Security is never absolute.
No application or online service can promise perfect security. Our goal is to reduce risk through careful design, testing, access controls and continued review — and to respond responsibly when someone finds something we missed.
Found something we should know about?
If you believe you have found a security vulnerability in mittiPaw, please report it responsibly. We appreciate researchers and users who give us the opportunity to understand and address an issue before sharing it publicly.