CITT

    Scan results

    Coinbase: Buy Crypto & Stocks

    Android

    Coinbase is the most trusted platform to securely buy, sell, trade, store, and stake crypto. The first publicly traded crypto exchange in the U.S. and S&P 500 listed company offering Bitcoin, Ethereum, and 100+ cryptocurrencies with advanced trading tools and security features.

    CITT SCORE
    88
    out of 100
    TRUSTED

    Quick Verdict

    Best for: Active crypto traders comfortable with standard analytics

    What It Means For You

    Activity and device data is shared with Facebook, AppsFlyer, Firebase, and several fraud-detection and payment partners. Identity verification involves third-party processors like Onfido and Persona, meaning user ID documents pass through external services. Financial behavior is monitored by multiple risk and analytics platforms as part of how the app operates.

    Method and Limitations

    Static analysis only. CITT reviewed the code of this build without running the app, so runtime behavior was not observed. The findings below describe the analyzed build and may not reflect server-side controls or later versions. CITT makes no determination about compliance with any law or platform policy; it reports what the artifacts contain and cites the published guidance so a reader can compare.

    How CITT scores an app

    Findings (10)

    Data Security

    2 total
    1 Medium
    1 Low

    Code Security

    3 total
    2 Medium
    1 Low

    Privacy

    4 total
    2 High
    2 Medium

    Third-Party Risk

    1 total
    1 Low

    Third-Party Services

    Sentry, AppsFlyer, Onfido, Persona, Sardine MDS, Samsung Pay SDK, Facebook SDK, Firebase Analytics, Stripe, Braintree, Plaid, Bugsnag, Sprig, Riskified, Payfone

    Security Strengths

    • ✓Hardware-backed encryption using AndroidKeyStore with AES-256-GCM
    • ✓100% HTTPS enforcement across all API endpoints with proper certificate validation
    • ✓Secure WebView configuration (file access disabled, SSL errors rejected, mixed content blocked)
    • ✓Certificate pinning implemented in Onfido SDK for identity verification
    • ✓Biometric authentication with 48-hour validity window
    What changed since the last scan

    Version diff is on the Developer plan. See developer plans.

    Context Tags

    financial
    sensitive data
    location
    camera
    ads
    third party heavy

    Package

    com.coinbase.android

    Version

    14.4.29 (140400290)

    Analysis Date

    Feb 14, 2026

    Classes Analyzed

    47,144

    Was this analysis helpful?

    Feedback helps us improve our analysis

    View on Play Store

    Recommendation: Trustworthy

    Key Findings

    Data Security - 2 findings (1 medium, 1 low)

    Network Security - 0 findings

    Code Safety - 0 findings

    Privacy - 4 findings (2 high, 2 medium)

    Privacy Concerns

    What Data is Collected

    • Identity data - full name, government-issued ID, and biometric image are collected for identity verification
    • Financial data - bank account details, transaction history, and trading activity
    • Behavioral data - how users navigate the app, which features are used, and how often users return
    • Device data - device type, operating system version, and unique device identifiers
    • Diagnostic data - collected automatically when the app encounters performance issues

    Third-Party Data Sharing

    User data is shared with the following external services:

    • Facebook - receives behavioral and usage data for advertising purposes
    • AppsFlyer - tracks how users arrived at the app and monitors in-app actions for attribution
    • Firebase (Google) - receives app usage and engagement analytics
    • Onfido and Persona - process identity documents and biometric data for verification; these are independent companies with their own data retention policies
    • Sardine, Riskified, and Payfone - receive behavioral and device signals to assess fraud risk
    • Stripe, Braintree, and Plaid - handle payment processing and bank account connections
    • Sprig - may collect in-app survey responses
    • Samsung Pay SDK - present for Samsung device payment integration

    Understanding the Scores

    CategoryScore
    Security100/100
    Privacy75/100
    Data Security85/100
    Network Security100/100
    Code Safety100/100
    Data Collection80/100
    Data Sharing85/100
    User Control80/100

    Positive Security Features

    • All communications between the app and Coinbase servers are protected in transit
    • The app code follows established safe development practices across the entire codebase
    • Local data storage on the device uses standard protection methods
    • The app's network communications meet the highest security standards for mobile applications

    Areas for Improvement

    • Advertising data sharing - activity data reaches Facebook and AppsFlyer, which use it for advertising targeting across other apps and services beyond Coinbase
    • Identity document handling - government ID and biometric data flow through Onfido and Persona, independent companies whose data retention practices operate under their own policies, separate from Coinbase's
    • Wide behavioral monitoring footprint - multiple fraud and analytics platforms simultaneously receive data about in-app actions, even during routine use

    About This Analysis

    This scorecard is based on static analysis of the application. Scores reflect the security and privacy posture of the version analyzed and may not reflect subsequent updates.

    App Details

    FieldValue
    App NameCoinbase: Buy BTC, ETH, SOL
    Package IDcom.coinbase.android
    Version14.4.29 (140400290)
    PlatformAndroid
    Scan DateFebruary 14, 2026

    Right of Reply

    Developer not yet contacted