Kjartan Kvassness Jæger 2 min read App Defense Alliance: Google's Android security program is now tracked
Today we added the App Defense Alliance (ADA) to NenkinTracker. ADA is the Google-led security certification program for Android apps, run by TrustCB B.V. as the certification body. It is the 8th scheme in our catalog, and the first new one since EUCC.
Around 220 active ADA certifications are now ingested. Roughly 76% are Google LLC apps under the MASA (Mobile App Security Assessment) track; the rest are third-party Android apps from vendors who have taken their products through ADA evaluation.
Two layouts in one scheme
ADA publishes under two different layouts on the source portal, and we ingest both:
- Standard ADA (52 certifications). A formal layout with Issuer, Security Profile, and Assurance Level AL2. The modern ADA certificate format.
- Legacy MASA (168 certifications). The lighter Mobile App Security Assessment that predates the formal ADA layout. No formal Issuer or Assurance Level, but the same Compliance Report PDF. Legacy MASA is still actively used today: Health Connect was issued under it in October 2025, and Chrome Canary in February 2026.
Both tracks land in NenkinTracker as real, current certifications. Legacy MASA certs carry a “Legacy MASA” badge in the UI, so you can tell the lighter track apart from a Standard ADA certificate at a glance.
In NenkinTracker today
- 220 new Android-app certifications added to the catalog
- 52 Standard ADA and 168 Legacy MASA, distinguished with a badge
- Both the Certificate PDF and the Compliance Report PDF are version-tracked under the same change-detection pipeline as every other scheme
- Notable products now tracked: Google ADS, Google Authenticator, Google Cloud Console, Android Device Policy, Chrome Canary, Health Connect, Nest, Waymo, Mercari, imo, plus around 200 more
The Certificate PDF for Standard ADA certs sits behind a JavaScript-gated button on the source portal, so a plain HTTP fetch lands on the portal shell rather than the file. We worked around that with a reverse-engineered Livewire flow. For users, the effect is simple: ADA certificate PDFs are now in your follow-the-product workflows and version-change notifications, the same way the other seven schemes already were.
Start a free NenkinTracker account to follow Android apps you care about, or browse the source catalog at cert.appdefensealliance.org.
See also
- SESIP vs Common Criteria: a useful frame for understanding ADA’s place among lighter, purpose-built assessment schemes.
- EUCC: What the EU Cybersecurity Certification Scheme Means for Common Criteria: the previous new scheme we added.