CITT

    Scan results

    Cédula Digital Colombia

    Android

    Your digital citizenship card on your mobile device, legally valid, without the need to present the physical document. The application provides the highest level of authentication allowing you to download and activate your digital ID securely directly on your cell phone.

    CITT SCORE
    32
    out of 100
    unTRUSTED

    Quick Verdict

    Best for: Colombian residents who need an official digital ID

    Not For: Uncomfortable with biometric data sent to multiple vendors

    What It Means For You

    Biometric data is processed through third-party identity verification software from multiple vendors. App usage behavior is tracked by Localytics, a behavioral analytics service, alongside crash and performance data sent to Google Firebase. Users have limited control over how their data is handled once it leaves the app.

    Method and Limitations

    Static analysis only. CITT reviewed the code of this build without running the app, so runtime behavior was not observed. The findings below describe the analyzed build and may not reflect server-side controls or later versions. CITT makes no determination about compliance with any law or platform policy; it reports what the artifacts contain and cites the published guidance so a reader can compare.

    How CITT scores an app

    Findings (17)

    Data Security

    6 total
    2 Critical
    2 High
    2 Medium

    Network Security

    1 total
    1 Medium

    Code Security

    4 total
    1 Critical
    2 High
    1 Medium

    Privacy

    6 total
    2 Critical
    4 High

    Third-Party Services

    Localytics (Upland Software), Firebase Crashlytics, Firebase Performance Monitoring, Google Play Services, IDEMIA Mobile ID SDK, Morpho Biometric SDK, Microblink, SQLCipher, OkHttp, Retrofit, Nimbus JOSE+JWT

    Security Strengths

    • ✓SQLCipher encrypted databases with AES-256
    • ✓Android EncryptedSharedPreferences with AES256-SIV + AES256-GCM
    • ✓Android Keystore master key with StrongBox support
    • ✓Certificate pinning via OkHttp CertificatePinner
    • ✓Cleartext traffic disabled (HTTPS only)
    What changed since the last scan

    Version diff is on the Developer plan. See developer plans.

    Context Tags

    financial
    sensitive data
    government
    biometric
    identity verification
    national id
    critical infrastructure

    Package

    co.gov.registraduria.ceduladigital

    Version

    4.2.5 (Build 7080)

    Analysis Date

    Feb 5, 2026

    Classes Analyzed

    31,016

    Was this analysis helpful?

    Feedback helps us improve our analysis

    View on Play Store

    Recommendation: Use With Caution

    Key Findings

    Data Security - 6 findings (2 critical, 2 high, 2 medium)

    Network Security - 1 finding (1 medium)

    Code Safety - 0 findings

    Privacy - 6 findings (2 critical, 4 high)

    Privacy Concerns

    What Data is Collected

    Biometric information, including facial scans and document images, is captured and forwarded to multiple external identity verification services. In-app behavior, such as which screens are visited and how frequently the app is used, is collected by Localytics. Crash reports and performance data are automatically sent to Google Firebase whenever the app encounters an error or slowdown.

    Third-Party Data Sharing

    User data is shared with multiple external parties:

    • Localytics (Upland Software): Receives behavioral and usage data to analyze how users interact with the app.
    • Google Firebase (Crashlytics and Performance Monitoring): Receives crash reports and performance metrics from the device.
    • IDEMIA Mobile ID SDK and Morpho Biometric SDK: Process biometric data as part of identity verification.
    • Microblink: Processes images of identity documents during scanning.
    • Google Play Services: Receives standard device and usage signals.

    Understanding the Scores

    CategoryScore
    Security35/100
    Privacy30/100
    Data Security30/100
    Network Security85/100
    Code Safety45/100
    Data Collection40/100
    Data Sharing25/100
    User Control30/100

    Positive Security Features

    No notable security practices were identified in this version of the app that provide meaningful user-facing protections.

    Areas for Improvement

    • Biometric and behavioral data flows to several external vendors with no in-app controls allowing users to limit or withdraw from that sharing.
    • There is no visible way for users to review, delete, or restrict personal data already transmitted to third-party analytics and biometric processing services.
    • The Data Sharing score of 25/100 reflects that personal information reaches multiple outside parties, with limited transparency about how long it is retained or for what purposes it may be reused.

    About This Analysis

    Scores and findings in this report are based on technical analysis of the app version listed above. This scorecard helps users make an informed decision about whether to use this app.

    App Details

    FieldValue
    App NameCédula Digital Colombia
    Package IDco.gov.registraduria.ceduladigital
    Version4.2.5 (Build 7080)
    Scan Date2026-02-05
    PlatformAndroid

    Right of Reply

    Developer not yet contacted