'%3e%3cpath%20d='M138%2095.6436V147H0V0H138V51.3564H59.3526V95.6436H138Z'%20fill='white'/%3e%3cpath%20d='M208%200V147H150V0H208Z'%20fill='white'/%3e%3cpath%20d='M361%200V51.4292H321.377V147H261.731V51.4292H220V0H361Z'%20fill='white'/%3e%3cpath%20d='M512%200V51.4292H472.939V147H414.139V51.4292H373V0H512Z'%20fill='white'/%3e%3c/g%3e%3cdefs%3e%3cclipPath%20id='clip0_1_12'%3e%3crect%20width='512'%20height='147'%20fill='white'/%3e%3c/clipPath%3e%3c/defs%3e%3c/svg%3e)
Scan results
Fidelity Investments
AndroidAward-winning investment and trading app offering stocks, ETFs, mutual funds, cryptocurrencies, cash management, and bill pay. Features professional research tools, 2FA authentication, voice biometrics, and 24/7 support for active investors managing financial portfolios.
Quick Verdict
Best for: Fidelity customers comfortable with standard analytics
Not For: Users who access accounts on public or untrusted Wi-Fi
What It Means For You
In-app behavior and account activity are shared with multiple analytics and marketing platforms, including services that use user data to send targeted messages. User data travels with less protection than expected on untrusted networks. User devices are also profiled in the background by fraud and identity verification services.
Quick Verdict
Best for: Fidelity customers comfortable with standard analytics
Not For: Users who access accounts on public or untrusted Wi-Fi
What It Means For You
In-app behavior and account activity are shared with multiple analytics and marketing platforms, including services that use user data to send targeted messages. User data travels with less protection than expected on untrusted networks. User devices are also profiled in the background by fraud and identity verification services.
Method and Limitations
Static analysis only. CITT reviewed the code of this build without running the app, so runtime behavior was not observed. The findings below describe the analyzed build and may not reflect server-side controls or later versions. CITT makes no determination about compliance with any law or platform policy; it reports what the artifacts contain and cites the published guidance so a reader can compare.
Findings (17)
Data Security
3 totalNetwork Security
2 totalCode Security
6 totalPrivacy
4 totalThird-Party Risk
1 totalPermission Usage
1 totalThird-Party Services
Security Strengths
- ✓EncryptedSharedPreferences for authentication tokens with Android Keystore
- ✓Android KeyStore integration for cryptographic keys with hardware backing
- ✓Backup disabled (allowBackup=false)
- ✓Cleartext traffic disabled (usesCleartextTraffic=false)
- ✓FIDO authentication with biometric support
Version diff is on the Developer plan. See developer plans.
Context Tags
Package
com.fidelity.android
Version
4.25 (Build 28419105)
Analysis Date
Feb 14, 2026
Classes Analyzed
60,304
Was this analysis helpful?
Feedback helps us improve our analysis
Recommendation: Use With Caution
Key Findings
Data Security - 3 findings (1 high, 2 medium)
Network Security - 2 findings (1 critical, 1 medium)
Code Safety - 0 findings
Privacy - 4 findings (1 high, 2 medium, 1 low)
Privacy Concerns
What Data is Collected
The app collects behavioral and activity data generated during user sessions, including navigation patterns, feature usage, and in-app interactions. Device identifiers and technical attributes are gathered, allowing services to recognize user devices across sessions and apps. Location data may be collected when map features are in use.
Third-Party Data Sharing
User data is shared with the following external services:
- Firebase Analytics - Behavioral and usage analytics
- Firebase Crashlytics - Crash and stability reporting
- Firebase Cloud Messaging - Push notification delivery
- Google Maps - Location and mapping features
- MoEngage - Targeted messaging and marketing automation
- Branch.io - Marketing attribution and install tracking
- Qualtrics - In-app surveys and user feedback
- Socure DocV - Identity document scanning and verification
- Daon IdentityX - Biometric identity verification
- Adobe Experience Platform - Behavioral data and marketing analytics
- Segment - Data routing and behavioral analytics
- Datadog RUM - Real-time performance and session monitoring
- LaunchDarkly - Feature configuration management
- Mastercard Open Banking - Financial account connectivity
- ThreatMetrix - Device and behavioral fraud profiling
Understanding the Scores
| Category | Score |
|---|---|
| Security | 45/100 |
| Privacy | 55/100 |
| Data Security | 60/100 |
| Network Security | 35/100 |
| Code Safety | 60/100 |
| Data Collection | 65/100 |
| Data Sharing | 70/100 |
| User Control | 60/100 |
Positive Security Features
No notable positive security practices were identified in this version of the app.
Areas for Improvement
- The app's network connections provide less protection than expected, meaning user data may not be fully protected when using public Wi-Fi or other untrusted networks.
- User activity and device data are shared with a large number of third-party platforms, including multiple behavioral profiling and marketing services, beyond what core account management typically requires.
- Background device profiling by fraud and identity verification services occurs without visible notice in the app, limiting user awareness of how device data is being used.
About This Analysis
This scorecard reflects findings from automated static analysis of the app's code and configuration. Scores are based on observed data handling practices and security behaviors.
App Details
- App Name: Fidelity Investments
- Package ID: com.fidelity.android
- Version: 4.25 (Build 28419105)
- Scan Date: 2026-02-14
Right of Reply
Developer not yet contacted