Brex Security & Privacy Scorecard
Android
In-app sessions, including screen interactions, can be recorded by Datadog and LogRocket for analytics purposes. User activity is also tracked via Segment and Firebase, which collect behavioral data across app usage. Financial actions go through Plaid and Persona, which access account and identity details to verify transactions.
Best for
Brex cardholders managing business spend
Avoid if
You prefer apps without session recording
Findings
- 1 critical
- 2 high
- 5 medium
- 2 low
- 2 info
1 issue identified across security and privacy analysis.
Top security issues
- SSL/TLS Certificate Validation Bypass in ReactNativeBlobUtil
- Hardcoded AES Encryption Key in MiSnap SDK
- Deep Link Validation Delegated to JavaScript Layer
Top privacy issues
- Session Replay Enabled in Financial Application
- Device Fingerprinting via MediaDrm API
- PII Collection in Analytics Events
Full analysis
Brex
What This Means for You
In-app sessions, including screen interactions, can be recorded by Datadog and LogRocket for analytics purposes. User activity is also tracked via Segment and Firebase, which collect behavioral data across app usage. Financial actions go through Plaid and Persona, which access account and identity details to verify transactions.
Recommendation: Use With Caution
Best For: Brex cardholders managing business spend
Avoid If: You prefer apps without session recording
Key Findings
Data Security - 3 findings (2 medium, 1 low)
Network Security - 1 finding (1 critical)
Code Safety - 0 findings
Privacy - 4 findings (1 high, 2 medium, 1 info)
Privacy Concerns
What Data is Collected
The app collects behavioral and interaction data through Segment and Firebase. Session recordings, including screen interactions, are captured by Datadog Session Replay and LogRocket. Identity and financial account details are accessed through Plaid and Persona during transaction flows. Usage patterns and support interactions are collected through Freshchat and Qualtrics Digital.
Third-Party Data Sharing
Data is shared with the following third-party services:
- Datadog RUM - performance and session monitoring
- Datadog Session Replay - screen interaction recording
- LogRocket - session replay and behavioral analytics
- Segment Analytics - behavioral data routing
- Firebase - usage analytics
- Plaid Link SDK - financial account access
- Persona Identity - identity verification
- Freshchat - in-app customer support
- Qualtrics Digital - user feedback collection
- Google ML Kit - on-device processing
- Google Maps - location features
- Apollo GraphQL - data communication layer
Understanding the Scores
| Category | Score |
|---|---|
| Security | 62/100 |
| Privacy | 68/100 |
| Data Security | 78/100 |
| Network Security | 60/100 |
| Code Safety | 85/100 |
| Data Collection | 80/100 |
| Data Sharing | 100/100 |
| User Control | 88/100 |
Positive Security Features
No standout positive security features were identified for this version of the app.
Areas for Improvement
- A critical finding in network communication handling could affect how well user data is protected when sent between the app and its servers.
- Session recording tools capture screen interactions, which may include sensitive financial information entered during use.
- Several data handling practices indicate room for stronger data protection.
About This Analysis
This scorecard reflects an independent analysis of the app as published.
App Details
- App: Brex
- Package ID: com.brex.mobile
- Version: 61.0.0 (versionCode: 65010)
- Scan Date: 2026-03-20
Versions & scan history
| Scan | Date | Overall score |
|---|---|---|
| #1 (current) | 65/100 |