cred.ai Security & Privacy Scorecard

Cred.ai

Neobank app for credit building with instant approval, cash advances, and credit score tracking. Requires identity verification and linked bank account.

What This Means for You

A private signing key is shipped inside the app where it can be extracted from any installed copy, and your advertising ID is sent to attribution services tied to your financial account without the standard iOS consent prompt.

Recommendation: Acceptable

This credit-building neobank earns strong marks for network security and data sharing controls. However, a private signing key is distributed inside the app where it can be extracted from any installed copy, and your advertising ID is sent to attribution services without the iOS permission prompt that gives you a choice. These issues are worth keeping in mind for a financial app that handles identity verification and bank account access.

Best For: Users who want a credit-building neobank and are comfortable with analytics activity linked to their account.

Key Findings

Data Security - 6 findings (1 critical, 4 low, 1 info)

Network Security - 2 findings (1 medium, 1 info)

Code Safety - 6 findings (1 medium, 2 low, 3 info)

Privacy - 3 findings (1 medium, 1 low, 1 info)

Privacy Concerns

What Data is Collected

• Identity information (name, government ID, date of birth): shared with identity verification providers as part of account opening
• Bank account details: shared with Plaid to link and verify your bank account
• Advertising ID: sent to AppsFlyer and joined to your financial account ID in outbound requests
• Financial behavior (enrollment, funding events, product interactions): sent to analytics services and linked to your identity
• Contact information (email, phone number): collected for account management and communication

Third-Party Data Sharing

The following third parties may receive your data:

• AppsFlyer - advertising attribution, receives your device advertising ID linked to your account
• Plaid LinkKit - bank account connection and verification
• FraudForce (iovation/TransUnion) - identity fraud detection during account opening
• Daon (DaonFaceSDK) - biometric face verification during identity check
• Mitek (MiSnapSDK) - document scanning for identity verification
• Segment - app usage analytics
• Firebase Crashlytics - crash and error reporting
• Zendesk - customer support

Understanding the Scores

Security: 67/100
Privacy: 85/100

Security Breakdown

• Data Security: 53/100 - Some keys used to secure app functionality are stored inside the app itself rather than on a server, where they can be extracted from any installed copy. The app also references weaker data protection settings for some stored files, which may allow access before you unlock your device.
• Network Security: 90/100 - All connections use encrypted HTTPS with no cleartext exceptions configured. The app enforces strict transport security standards across all network communication.
• Code Safety: 90/100 - External content opens in an isolated browsing session that cannot access your authenticated financial data. The app correctly separates third-party sites from your account session.

Privacy Breakdown

• Data Collection: 85/100 - The app collects identity, banking, and behavioral data necessary to operate the credit-building service. Your in-app activity is also linked to your identity and used for the developer's own advertising purposes.
• Data Sharing: 92/100 - Third-party data flows are limited and largely tied to core financial services. Identity verification and bank linking go through established financial data partners.
• User Control: 87/100 - Standard account controls are in place. The app currently skips the iOS permission prompt before sending your advertising ID to attribution services, reducing your ability to opt out.

Positive Security Features

• All network connections use encrypted transport with no cleartext exceptions configured
• External websites and help content open in an isolated browser session, keeping your authenticated account data separate
• Stored account data remains within this app alone, with no cross-app sharing configured
• Firebase Analytics is disabled, limiting data sent to Google analytics infrastructure
• Financial pages use secure Universal Links, a more controlled approach than generic custom URL schemes

Areas for Improvement

GDPR / CCPA Compliance

The app's privacy practices could be strengthened by:

1. Advertising Tracking Consent
   The standard iOS permission prompt for advertising tracking is absent. Adding this step would give you a clear choice about whether your advertising ID is sent to attribution services before any data leaves your device.

2. Financial Behavior Linked to Advertising
   Your in-app activity is linked to your identity and used for the developer's own advertising purposes. Providing a clear opt-out for this data use would better align with user expectations for a financial app.

Security Enhancements

1. Server-Side Key Management
   A private signing key is distributed inside the app where it can be extracted from any installed copy. Storing this key on a server rather than in the app bundle would prevent it from being accessible to anyone who obtains the app file.

2. Stronger File and Keychain Protection
   Some stored data may be accessible before you unlock your device. Using the strongest available iOS protection settings would ensure your financial information stays locked until you authenticate.

Technical Context

App Type: Financial services (neobank, credit building, sensitive data)
Classes Analyzed: 0
Third-Party Services: 19
Context Tags: financial, sensitive_data, location, ads

---

About This Analysis

This security analysis was conducted by CITT (Can I Trust That), an independent security analysis service. We perform static code analysis on iOS applications to help users make informed decisions about app security and privacy.

App Details

Developer: Not available
Version: 1.9.22 (build 20251123100)
Analysis Date: 2026-06-17
Package: ai.cred.robocred

Analysis Limitations

• Static analysis only (code review without running the app)
• Based on IPA version 1.9.22 analyzed on 2026-06-17
• May not reflect server-side security controls
• Cannot detect all runtime behaviors