'%3e%3cpath%20d='M138%2095.6436V147H0V0H138V51.3564H59.3526V95.6436H138Z'%20fill='white'/%3e%3cpath%20d='M208%200V147H150V0H208Z'%20fill='white'/%3e%3cpath%20d='M361%200V51.4292H321.377V147H261.731V51.4292H220V0H361Z'%20fill='white'/%3e%3cpath%20d='M512%200V51.4292H472.939V147H414.139V51.4292H373V0H512Z'%20fill='white'/%3e%3c/g%3e%3cdefs%3e%3cclipPath%20id='clip0_1_12'%3e%3crect%20width='512'%20height='147'%20fill='white'/%3e%3c/clipPath%3e%3c/defs%3e%3c/svg%3e)
Scan results
Mi Bancolombia
AndroidMi Bancolombia is the official banking app from Bancolombia S.A., Colombia's largest bank. It provides comprehensive financial services including transfers, payments, bill registration, credit card management, virtual investing, QR payments, and integrated shopping services. Features dark mode, inst
Quick Verdict
Best for: Bancolombia customers accepting behavioral monitoring
Not For: Users who expect minimal data sharing from their bank
What It Means For You
Typing patterns and in-app behavior are monitored by a third-party behavioral analytics company alongside standard banking activity. Usage data is shared with marketing attribution, A/B testing, and multiple analytics platforms across several providers. Users have very little ability to control or opt out of what is collected and shared.
Quick Verdict
Best for: Bancolombia customers accepting behavioral monitoring
Not For: Users who expect minimal data sharing from their bank
What It Means For You
Typing patterns and in-app behavior are monitored by a third-party behavioral analytics company alongside standard banking activity. Usage data is shared with marketing attribution, A/B testing, and multiple analytics platforms across several providers. Users have very little ability to control or opt out of what is collected and shared.
Method and Limitations
Static analysis only. CITT reviewed the code of this build without running the app, so runtime behavior was not observed. The findings below describe the analyzed build and may not reflect server-side controls or later versions. CITT makes no determination about compliance with any law or platform policy; it reports what the artifacts contain and cites the published guidance so a reader can compare.
Findings (16)
Data Security
4 totalNetwork Security
1 totalCode Security
3 totalPrivacy
6 totalThird-Party Risk
2 totalThird-Party Services
Security Strengths
- ✓Hardware-backed encryption (Android KeyStore with AES-256-GCM)
- ✓Biometric authentication properly implemented with key invalidation
- ✓Industry-leading RASP protection (Talsec for root/debug/tamper detection)
- ✓All file storage uses MODE_PRIVATE (no world-readable data)
- ✓HTTPS enforced for all network traffic
Version diff is on the Developer plan. See developer plans.
Context Tags
Package
co.com.bancolombia.personas.superapp
Version
1.79.3 (Build 458)
Analysis Date
Feb 3, 2026
Classes Analyzed
11,876
Was this analysis helpful?
Feedback helps us improve our analysis
Recommendation: Use With Caution
Key Findings
Data Security - 4 findings (1 high, 1 medium, 1 low, 1 info)
Network Security - 1 finding (1 high)
Code Safety - 0 findings
Privacy - 6 findings (4 high, 2 medium)
Privacy Concerns
What Data is Collected
Mi Bancolombia collects behavioral biometrics through BioCatch, which monitors typing rhythm, touch patterns, and device interaction habits to build a continuous profile of how the app is used. Firebase Analytics and Firebase Performance record in-app actions, session data, and performance metrics. AppsFlyer captures install source and attribution data. Huawei Mobile Services collects device identifiers and usage data on Huawei devices. Dynatrace and Medallia Digital observe user interactions and satisfaction signals.
Third-Party Data Sharing
Data is shared with the following third-party companies:
- Behavioral profiling: BioCatch
- Analytics and performance: Firebase Analytics, Firebase Performance, Dynatrace
- Marketing attribution: AppsFlyer
- A/B testing and optimization: VWO
- Customer feedback and experience: Medallia Digital
- Platform services: Huawei Mobile Services (HMS Core, Analytics, Maps, ScanKit, ML Kit)
- Device identity management: AppGate DIDM
- Security monitoring: Talsec RASP
- Utilities: EasySol
Understanding the Scores
| Category | Score |
|---|---|
| Security | 45/100 |
| Privacy | 30/100 |
| Data Security | 60/100 |
| Network Security | 55/100 |
| Code Safety | 50/100 |
| Data Collection | 25/100 |
| Data Sharing | 20/100 |
| User Control | 15/100 |
Positive Security Features
- No notable positive security practices were identified in this analysis.
Areas for Improvement
- Behavioral patterns, including typing rhythm and swipe behavior, are shared with a third-party profiling company. This level of data collection goes beyond what most financial apps require.
- Usage data flows to a large number of analytics, marketing, and attribution companies, providing limited transparency into where the information goes and how it is used.
- The app provides very little ability to limit or opt out of data collection during normal use, placing meaningful control outside users' reach.
About This Analysis
This scorecard is based on automated analysis of the app's compiled code and embedded configuration. Scores reflect observed data practices at the time of the scan and may not capture every behavior.
App Details
| Field | Value |
|---|---|
| App Name | Mi Bancolombia |
| Package ID | co.com.bancolombia.personas.superapp |
| Version | 1.79.3 (Build 458) |
| Scan Date | 2026-02-04 |
Right of Reply
Developer not yet contacted