CITT

    Scan results

    Aviva Journey

    Android

    Usage-based car insurance app that tracks driving behavior through smartphone sensors to calculate safety scores and insurance discounts. Earn rewards for safe driving habits including maintaining speed limits, smooth acceleration/braking, and minimizing phone use.

    CITT SCORE
    74
    out of 100
    TRUSTish

    Quick Verdict

    Best for: Aviva customers comfortable with driving telemetry

    Not For: You prefer not to share driving behaviour data

    What It Means For You

    Driving behaviour, trips, and diagnostic data are collected and shared with telematics and analytics services. Firebase and Mapbox receive usage and location telemetry. User data is used to assess how they drive, which may affect their insurance.

    Method and Limitations

    Static analysis only. CITT reviewed the code of this build without running the app, so runtime behavior was not observed. The findings below describe the analyzed build and may not reflect server-side controls or later versions. CITT makes no determination about compliance with any law or platform policy; it reports what the artifacts contain and cites the published guidance so a reader can compare.

    How CITT scores an app

    Findings (15)

    Data Security

    4 total
    2 Critical
    1 High
    1 Medium

    Network Security

    2 total
    1 Medium
    1 Low

    Code Security

    5 total
    2 High
    3 Medium

    Privacy

    4 total
    1 High
    2 Medium
    1 Info

    Third-Party Services

    Firebase Analytics, Firebase Performance, Firebase Crashlytics, Firebase Firestore, Firebase Auth, IMS Trip Detection SDK, IMS Diagnostic Telemetry, DriveSync OBD-II, Mapbox Maps, Mapbox Telemetry, Google Awareness API, Google Play Integrity API, RootBeer SDK

    Security Strengths

    • ✓Play Integrity API implemented for device integrity verification
    • ✓Debuggable flag disabled in production build
    • ✓Backup protection disabled (prevents cloud extraction)
    • ✓HTTPS enforced for all network traffic
    • ✓Modern Android secure defaults prevent file access vulnerabilities
    What changed since the last scan

    Version diff is on the Developer plan. See developer plans.

    Context Tags

    financial
    insurance
    location
    sensitive data
    vehicle
    tracking
    behavior profiling

    Package

    com.aviva.avivajourney

    Version

    4.6.0 (Build 329)

    Analysis Date

    Feb 2, 2026

    Classes Analyzed

    21,521

    Was this analysis helpful?

    Feedback helps us improve our analysis

    View on Play Store

    Recommendation: Acceptable

    Key Findings

    Data Security - 4 findings (2 critical, 1 high, 1 medium)

    Network Security - 2 findings (1 medium, 1 low)

    Code Safety - 0 findings

    Privacy - 4 findings (1 high, 2 medium, 1 info)

    Privacy Concerns

    What Data is Collected

    • Driving behaviour and trip records, including routes, speed, and driving patterns
    • Vehicle diagnostic data collected via OBD-II connection
    • Device location and movement throughout journeys
    • App usage and performance telemetry
    • Device identifiers

    Third-Party Data Sharing

    User data is shared with the following services:

    • Firebase (Google): Analytics, performance monitoring, crash reporting, and identity services
    • IMS: Trip detection and diagnostic telemetry for driving behaviour scoring
    • Mapbox: Map rendering and location telemetry
    • Google: Awareness and app integrity services
    • DriveSync: OBD-II vehicle diagnostic data collection

    Understanding the Scores

    CategoryScore
    Security78/100
    Privacy70/100
    Data Security65/100
    Network Security92/100
    Code Safety85/100
    Data Collection75/100
    Data Sharing88/100
    User Control82/100

    Positive Security Features

    • No specific positive security practices were identified in this version of the app.

    Areas for Improvement

    • The app could be clearer about how driving behaviour is scored and how those scores affect insurance premiums.
    • Some data is stored on the device in a way that other apps could potentially read if the device is not adequately protected.
    • Providing clearer in-app controls, including the ability to review or request deletion of driving history, would give users greater confidence in managing their data.

    About This Analysis

    This scorecard reflects the security and privacy practices observed in the app at the time of the scan. Scores are based on static analysis of the app's code and configuration.

    App Details

    • App: Aviva Journey
    • Package ID: com.aviva.avivajourney
    • Version: 4.6.0 (Build 329)
    • Platform: Android
    • Scan Date: 2026-02-02

    Right of Reply

    Developer not yet contacted