CITT

    Scan results

    Seguros SURA

    Android

    Access your SURA insurance policies quickly and conveniently. Manage health, home, car and life insurance; request medical appointments and reimbursements; track wellness with Google Fit integration; and get roadside assistance.

    CITT SCORE
    38
    out of 100
    unTRUSTED

    Quick Verdict

    Best for: SURA customers comfortable with broad analytics

    Not For: You prefer not to share behavior data with Facebook

    What It Means For You

    User activity is tracked by Mixpanel, Firebase, and Facebook SDK, sharing behavioral data with multiple third parties. Data moves across advertising and analytics platforms including Google Tag Manager. Users have limited control over what is collected or how it is used.

    Method and Limitations

    Static analysis only. CITT reviewed the code of this build without running the app, so runtime behavior was not observed. The findings below describe the analyzed build and may not reflect server-side controls or later versions. CITT makes no determination about compliance with any law or platform policy; it reports what the artifacts contain and cites the published guidance so a reader can compare.

    How CITT scores an app

    Findings (22)

    Data Security

    2 total
    2 High

    Network Security

    2 total
    2 Critical

    Code Security

    11 total
    2 Critical
    2 High
    6 Medium
    1 Low

    Privacy

    6 total
    1 Critical
    4 High
    1 Low

    Permission Usage

    1 total
    1 Low

    Third-Party Services

    Mixpanel, Datadog RUM, Firebase (Analytics, Performance, Crashlytics, Firestore, FCM), Facebook SDK, Medallia Digital, Google Tag Manager, Pager Health, Spike API, Zoom SDK

    Security Strengths

    • ✓Flutter Secure Storage with AES-256-GCM encryption
    • ✓Android Keystore integration for hardware-backed keys
    • ✓Backup disabled (allowBackup=false) prevents ADB extraction
    • ✓Heavy R8/ProGuard code obfuscation (15,369 files)
    • ✓In-memory token storage for Pager Health (not persisted)
    What changed since the last scan

    Version diff is on the Developer plan. See developer plans.

    Context Tags

    financial
    health
    sensitive data
    telemedicine
    insurance
    camera
    location
    contacts

    Package

    co.com.sura.seguros

    Version

    12.3.3 (Build 450)

    Analysis Date

    Feb 12, 2026

    Classes Analyzed

    15,369

    Was this analysis helpful?

    Feedback helps us improve our analysis

    View on Play Store

    Recommendation: Use With Caution

    Key Findings

    Data Security - 2 findings (2 high)

    Network Security - 2 findings (2 critical)

    Code Safety - 0 findings

    Privacy - 6 findings (1 critical, 4 high, 1 low)

    Privacy Concerns

    What Data is Collected

    Multiple analytics platforms collect behavioral data, including in-app actions, session duration, screen flows, and device information. Crash reports and performance telemetry are gathered automatically. Medallia Digital captures feedback and session recordings tied to user interactions.

    Third-Party Data Sharing

    Data is shared with the following third parties:

    • Facebook SDK - behavioral and device data shared with Meta's advertising network
    • Google Tag Manager - coordinates data routing across advertising and analytics services
    • Mixpanel - receives detailed records of in-app actions and user flows
    • Firebase (Analytics, Performance, Crashlytics, Firestore, FCM) - Google's platform receives usage, crash, and performance data
    • Datadog RUM - receives real-time session and performance data
    • Medallia Digital - captures session feedback and interaction recordings

    Understanding the Scores

    CategoryScore
    Security35/100
    Privacy40/100
    Data Security55/100
    Network Security25/100
    Code Safety45/100
    Data Collection50/100
    Data Sharing30/100
    User Control20/100

    Positive Security Features

    • No positive security practices were observed in this version.

    Areas for Improvement

    • The app's network communication lacks consistent protection, putting personal and financial data at risk during transmission.
    • Data is shared with a broad network of third-party advertising and analytics platforms, with very limited options to opt out.
    • The app gives users almost no control over what information is gathered or how it is used across these platforms.

    About This Analysis

    This scorecard is based on automated static analysis of the app's compiled code and observable behavior patterns. It reflects security and privacy practices identified at the time of the scan.

    App Details

    FieldValue
    App NameSeguros SURA
    Packageco.com.sura.seguros
    Version12.3.3 (Build 450)
    Scan Date2026-02-12
    PlatformAndroid

    Right of Reply

    Developer not yet contacted