The latest build, and what to verify before install.
A short reference for the Android build of the platform app. What to check before install, and what is published by the platform itself.
About the latest build version.
The platform distributes its Android app through the official app store. Where a direct APK download is available, the page below records how to verify the build, the version and the integrity of the file. The page is descriptive.
The official install path for Android users is the platform's listing in the Google Play store. A direct APK download is published by the platform for users on devices without the Play store. Where a direct APK is offered, the platform publishes a hash, a version number and a release date.
What to verify before install
- Confirm the download URL host matches the platform's primary domain.
- Confirm the file hash matches the hash published in the platform's release notes.
- Confirm the version number matches the latest version published by the platform.
- Confirm the file size matches the published release notes.
- Disable 'install from unknown sources' after install; re-enable only if a further APK is offered later.
What is unknown
The hash for the latest APK, the version number, the file size and the release date are not separately maintained by this publication. The reader must consult the platform's release notes for the current values. Once verified, the install proceeds through the device's standard APK install flow.
What to do after install
Open the app. Complete KYC. Connect the deposit rail. Confirm the responsible-play controls are present and visible from within the app. The post-install checklist in the install notes applies here as well.
Why the file hash matters.
The hash of an APK is a fingerprint that uniquely identifies its bytes. If the bytes change for any reason — accidental corruption, third-party modification, replay attack — the hash changes too. Comparing the actual file hash against the platform's published hash confirms the file has not been modified between publication and download.
How to compute the hash yourself
The hash can be computed on most desktop operating systems with a one-line command (sha256sum on Linux, shasum on macOS, Get-FileHash on Windows PowerShell). The platform's release notes include the hash in text form. The two values should match exactly.
What the hash does not check
The hash does not check whether the platform itself behaves correctly; that is a usability audit. The hash only confirms the file's bytes match what the platform published. The usability audit is in the reviews chapter.
Where APK integrity matters and where it does not.
The APK file is a portable Android application package. The file is a single archive that Android can install after the user has enabled "install from unknown sources". The integrity check confirms that the file's bytes match what the platform published. The integrity check does not confirm that the app behaves correctly; that is a usability audit.
Why the hash matters
The hash is a fingerprint that uniquely identifies the file's bytes. If the bytes change for any reason — accidental corruption, third-party modification, replay attack — the hash changes too. Comparing the actual file hash against the platform's published hash confirms the file has not been modified between publication and download.
How to compute the hash yourself
The hash can be computed on most desktop operating systems with a one-line command (sha256sum on Linux, shasum on macOS, Get-FileHash on Windows PowerShell). The platform's release notes include the hash in text form. The two values should match exactly.
What the hash does not check
The hash does not check whether the platform itself behaves correctly; that is a usability audit. The hash only confirms the file's bytes match what the platform published. The usability audit is in the reviews chapter.
Disable unknown sources after install
Most operating systems recommend disabling "install from unknown sources" after a single APK installation. The setting is in the device's Application or Security settings. Re-enabling it is required only when a further APK is offered.
The post-install checks
The post-install checks mirror the pre-install checks: confirm the in-app support link resolves to the platform's published domain, confirm the responsible-play controls are present, confirm the deposit rail matches the planned withdrawal rail. The full checklist is in the install notes.
How the Android security model applies to APK installs.
The Android security model relies on a permission grant per app. Each app that the user installs is granted a specific permission scope; the scope is the list of capabilities the app has on the device. The user can revoke individual permissions at any time in the device's Application settings.
Reading the permission scope
The scope is displayed at the install step and can be reviewed at any time in the device's Application settings. The reader who installs an APK should review the scope and decline any permission outside what the documented use case requires. The cleanest signal is a scope that exactly matches the documented use case.
Google Play Protect
Google Play Protect is a built-in malware scanner that runs on every APK install, including installs from the Play store. The reader should ensure Google Play Protect is enabled; the scanner provides a baseline protection against known malware signatures.
What the publication does
The publication describes the published scope for the platform's mobile app. The publication does not redistribute the APK; the APK is published by the platform. The reader who wants to install the APK should obtain it from the platform's published download URL.
Post-install checks
The post-install checks mirror the pre-install checks: confirm the in-app support link resolves to the platform's published domain, confirm the responsible-play controls are present, and confirm the deposit rail matches the planned withdrawal rail. The full checklist is in the install notes.
Where the platform's integrity guarantees come from.
The platform's integrity guarantees come from a combination of source publication, third-party audit and the regulatory framework. The reader who wants to verify the integrity can read the publication, audit the third-party report and consult the regulatory framework's notes on integrity.
Source publication
The platform publishes the latest build's source URL, the file hash and the file size in the release notes. The publication is the source of truth. The reader who verifies the publication confirms the platform's first-party integrity.
Third-party audit
The platform typically publishes a third-party audit of its random number source. The audit is signed by the audit firm and is referenced in the platform's Terms page. The reader who wants to verify the audit can read the firm's report.
Regulatory framework
The regulatory framework describes the integrity requirements for a regulated platform. The framework is the third source of integrity. The reader who wants to verify the framework can consult the regulator's notification.
Reading the three sources together
The reader who reads all three sources (platform publication, third-party audit, regulatory framework) has the strongest possible reading of the platform's integrity. The reader who reads only one or two sources has a partial reading; the partial reading is better than no reading but is not exhaustive.
What this publication is not
The publication is not the platform's integrity guarantee. The platform guarantees its own integrity; the publication describes the integrity sources. Where the platform's behaviour disagrees with the publication's description, the reader should consult the platform's own documentation.