Aviva Journey Security & Privacy Scorecard
Android
Driving behaviour, trips, and diagnostic data are collected and shared with telematics and analytics services. Firebase and Mapbox receive usage and location telemetry. User data is used to assess how they drive, which may affect their insurance.
Best for
Aviva customers comfortable with driving telemetry
Avoid if
You prefer not to share driving behaviour data
Findings
- 3 critical
- 4 high
- 7 medium
- 2 low
- 0 info
0 issues identified across security and privacy analysis.
Top security issues
- Unencrypted Location Database
- Unencrypted Driving Behavior Data
- IMS SDK API Key Exposed in Plaintext
Top privacy issues
- Unencrypted Vehicle Identifiers (VIN)
- Missing Data Retention Policy
- Firebase Performance Logging All API URLs
Full analysis
Aviva Journey
Version: 4.6.0 (Build 329)
Scan Date: 2026-02-02
What This Means for You
Driving behaviour, trips, and diagnostic data are collected and shared with telematics and analytics services. Firebase and Mapbox receive usage and location telemetry. User data is used to assess how they drive, which may affect their insurance.
Recommendation: Acceptable
Best For: Aviva customers comfortable with driving telemetry
Avoid If: You prefer not to share driving behaviour data
Key Findings
Data Security - 4 findings (2 critical, 1 high, 1 medium)
Network Security - 2 findings (1 medium, 1 low)
Code Safety - 0 findings
Privacy - 4 findings (1 high, 2 medium, 1 info)
Privacy Concerns
What Data is Collected
- Driving behaviour and trip records, including routes, speed, and driving patterns
- Vehicle diagnostic data collected via OBD-II connection
- Device location and movement throughout journeys
- App usage and performance telemetry
- Device identifiers
Third-Party Data Sharing
User data is shared with the following services:
- Firebase (Google): Analytics, performance monitoring, crash reporting, and identity services
- IMS: Trip detection and diagnostic telemetry for driving behaviour scoring
- Mapbox: Map rendering and location telemetry
- Google: Awareness and app integrity services
- DriveSync: OBD-II vehicle diagnostic data collection
Understanding the Scores
| Category | Score |
|---|---|
| Security | 78/100 |
| Privacy | 70/100 |
| Data Security | 65/100 |
| Network Security | 92/100 |
| Code Safety | 85/100 |
| Data Collection | 75/100 |
| Data Sharing | 88/100 |
| User Control | 82/100 |
Positive Security Features
- No specific positive security practices were identified in this version of the app.
Areas for Improvement
- The app could be clearer about how driving behaviour is scored and how those scores affect insurance premiums.
- Some data is stored on the device in a way that other apps could potentially read if the device is not adequately protected.
- Providing clearer in-app controls, including the ability to review or request deletion of driving history, would give users greater confidence in managing their data.
About This Analysis
This scorecard reflects the security and privacy practices observed in the app at the time of the scan. Scores are based on static analysis of the app's code and configuration.
App Details
- App: Aviva Journey
- Package ID: com.aviva.avivajourney
- Version: 4.6.0 (Build 329)
- Platform: Android
- Scan Date: 2026-02-02
Versions & scan history
| Scan | Date | Overall score |
|---|---|---|
| #1 (current) | 74/100 |