CITT

    Scan results

    Deutsche Bank

    Android

    Deutsche Bank's comprehensive mobile banking app offering account management, transfers, payments, investments, and financial planning tools. Supports 70+ banking services including real-time transfers, Google Pay, and cash deposits at 12,500+ partner locations.

    CITT SCORE
    80
    out of 100
    TRUSTED

    Quick Verdict

    Best for: Deutsche Bank customers comfortable with standard analytics

    What It Means For You

    Activity is shared with Adobe Marketing Cloud and analytics services. Push notifications are delivered via Firebase, and Google Maps and Pay are integrated. Users retain control over consent through Usercentrics, and data travels over strongly secured network connections.

    Method and Limitations

    Static analysis only. CITT reviewed the code of this build without running the app, so runtime behavior was not observed. The findings below describe the analyzed build and may not reflect server-side controls or later versions. CITT makes no determination about compliance with any law or platform policy; it reports what the artifacts contain and cites the published guidance so a reader can compare.

    How CITT scores an app

    Findings (13)

    Data Security

    5 total
    4 Medium
    1 Info

    Code Security

    4 total
    3 Medium
    1 Low

    Privacy

    3 total
    1 High
    2 Medium

    Third-Party Risk

    1 total
    1 Medium

    Third-Party Services

    Adobe Marketing Cloud, WebID Solutions, Gini Bank SDK, SealOne BestSign, Ahoy RTC, Usercentrics, Google Pay, Firebase Cloud Messaging, Google Maps, ML Kit, OkHttp, Bouncycastle, TrustKit, Dagger/Hilt

    Security Strengths

    • ✓Certificate pinning implemented (OkHttp + TrustKit + Bouncycastle)
    • ✓Android backup disabled
    • ✓Modern AndroidX libraries with current security patches
    • ✓Jetpack Compose UI framework
    • ✓Severe code obfuscation
    What changed since the last scan

    Version diff is on the Developer plan. See developer plans.

    Context Tags

    financial
    banking
    sensitive data
    biometric
    camera
    location
    nfc
    payments
    third party analytics

    Package

    com.db.pwcc.dbmobile

    Version

    3.30.1.40237

    Analysis Date

    Feb 12, 2025

    Classes Analyzed

    3,678

    Was this analysis helpful?

    Feedback helps us improve our analysis

    View on Play Store

    Recommendation: Trustworthy

    Key Findings

    Data Security - 5 findings (4 medium, 1 info)

    Network Security - 0 findings

    Code Safety - 0 findings

    Privacy - 3 findings (1 high, 2 medium)

    Privacy Concerns

    What Data is Collected

    Account activity, transaction history, and device identifiers are collected to operate the app. When in-app map features are used, user location is accessed via Google Maps. Adobe Marketing Cloud collects usage patterns and interactions to build a behavioral profile used for marketing communications.

    Third-Party Data Sharing

    Data is shared with the following third-party services:

    • Adobe Marketing Cloud - receives usage and behavioral data for advertising and analytics
    • Google Maps - accesses user location when map-based features are used
    • Google Pay - handles payment data for in-app payment flows
    • Firebase Cloud Messaging - delivers push notifications to the device on behalf of Deutsche Bank
    • WebID Solutions - processes user identity data during verification steps
    • Usercentrics - manages user consent choices across third-party data processing activities
    • Gini Bank SDK - processes images of user documents during document-scanning workflows
    • ML Kit - performs on-device text and document recognition when documents are scanned

    Understanding the Scores

    CategoryScore
    Security85/100
    Privacy75/100
    Data Security82/100
    Network Security100/100
    Code Safety88/100
    Data Collection78/100
    Data Sharing70/100
    User Control85/100

    Positive Security Features

    • All network communications achieve a perfect security score, meaning banking data is strongly protected during transmission
    • Usercentrics consent management gives users direct control over which third parties may process their data
    • TrustKit enforces strict policies governing how the app communicates over the network, protecting data from interception
    • SealOne BestSign provides a robust digital authorization layer for transaction signing

    Areas for Improvement

    • Behavioral and usage data is shared with Adobe Marketing Cloud for advertising. Visiting the in-app privacy or consent settings and withdrawing marketing consent can reduce this sharing.
    • Data sharing extends across multiple analytics and identity providers simultaneously. A clearer in-app summary showing exactly which data flows to which company would make it easier for users to stay informed.
    • Some data handling practices for information stored on device have room to be tightened, based on the medium-severity findings identified in the data security category.

    About This Analysis

    This scorecard is generated from automated static analysis of the app's code and configuration. Scores reflect the state of the app at the time of analysis and may not capture every privacy or security characteristic of the live service.

    App Details

    • App: Deutsche Bank
    • Package: com.db.pwcc.dbmobile
    • Version: 3.30.1.40237
    • Platform: Android
    • Scan Date: February 12, 2026

    Right of Reply

    Developer not yet contacted