CITT

    Scan results

    DaviPlata

    Android

    DaviPlata is a digital wallet and money management app by Banco Davivienda offering instant transfers, payments, bill payments, QR code transactions, and a free digital debit card. Manage your finances securely without accounts at other banks.

    CITT SCORE
    30
    out of 100
    unTRUSTED

    Quick Verdict

    Best for: DaviPlata customers comfortable with analytics

    What It Means For You

    Activity, device details, and usage patterns are shared with advertising and analytics companies including Google Ads, Braze, AppsFlyer, and Firebase. The protections around financial data and network communications may not fully meet modern standards for a banking application, and user data may not be fully protected.

    Method and Limitations

    Static analysis only. CITT reviewed the code of this build without running the app, so runtime behavior was not observed. The findings below describe the analyzed build and may not reflect server-side controls or later versions. CITT makes no determination about compliance with any law or platform policy; it reports what the artifacts contain and cites the published guidance so a reader can compare.

    How CITT scores an app

    Findings (19)

    Data Security

    3 total
    2 Critical
    1 High

    Network Security

    3 total
    1 Critical
    1 High
    1 Medium

    Code Security

    7 total
    2 Critical
    1 High
    4 Medium

    Privacy

    6 total
    4 High
    2 Medium

    Third-Party Services

    Valid SDK, Incode, RSA Mobile SDK, TransmitSecurity, Antelop, Google Play Integrity, Braze, Firebase Analytics, AppsFlyer, Dynatrace, Instana, Statsig, Google Ads

    Security Strengths

    • ✓Root detection implemented
    • ✓Android Keystore used for Valid SDK encryption
    • ✓Backup disabled (allowBackup=false)
    • ✓Multiple fraud prevention SDKs for defense in depth
    • ✓Biometric authentication support
    What changed since the last scan

    Version diff is on the Developer plan. See developer plans.

    Context Tags

    financial
    sensitive data
    location
    contacts
    camera
    ads
    biometric

    Package

    com.davivienda.daviplataapp

    Version

    Android7.1.0 (Build 1501)

    Analysis Date

    Feb 4, 2026

    Classes Analyzed

    35,136

    Was this analysis helpful?

    Feedback helps us improve our analysis

    View on Play Store

    Recommendation: Use With Caution

    Key Findings

    Data Security - 3 findings (2 critical, 1 high)

    Network Security - 3 findings (1 critical, 1 high, 1 medium)

    Code Safety - 0 findings

    Privacy - 6 findings (4 high, 2 medium)

    Privacy Concerns

    What Data is Collected

    DaviPlata collects device identifiers, behavioral patterns, and usage activity. This includes information about how users navigate the app, device technical details, and in-app actions over time.

    Third-Party Data Sharing

    User data is shared with the following third-party companies:

    • Google Ads - Advertising targeting
    • Braze - Marketing and user engagement
    • AppsFlyer - Attribution and analytics
    • Firebase Analytics - Usage analytics
    • Dynatrace - Performance monitoring
    • Instana - Application monitoring
    • Statsig - Feature experimentation
    • Incode - Identity verification
    • TransmitSecurity - Authentication services
    • Antelop - Security services
    • Valid SDK - Banking security services
    • Google Play Integrity - Device integrity checks

    Understanding the Scores

    AreaScore
    Security25/100
    Privacy35/100
    Data Security20/100
    Network Security15/100
    Code Safety30/100
    Data Collection40/100
    Data Sharing35/100
    User Control45/100

    Positive Security Features

    • No standout positive security practices were identified in this version of the app.

    Areas for Improvement

    • The protections around how financial data is stored and handled need significant strengthening to meet modern standards for a banking application.
    • The app's network communications provide less protection than expected for a banking application, and user account information may not be fully protected in transit.
    • The number of advertising and analytics companies with access to user usage data is high relative to what is needed for the app's core financial functions.

    About This Analysis

    This scorecard is generated through automated static analysis of the app's code and configuration. Scores reflect the security and privacy posture observed at the time of the scan.

    App Details

    • App Name: DaviPlata
    • Package ID: com.davivienda.daviplataapp
    • Version: Android7.1.0 (Build 1501)
    • Scan Date: 2026-02-04

    Right of Reply

    Developer not yet contacted