CITT

    Scan results

    Kiwi Crédito

    Android

    Kiwi is a digital financial platform offering online personal loans with quick approval. Through the mobile app, users can apply for loans, check loan details, make payments, and manage credit. Available in Puerto Rico, Florida, and Utah.

    CITT SCORE
    58
    out of 100
    TRUSTish

    Quick Verdict

    Best for: Credit seekers comfortable with Google analytics

    What It Means For You

    Identity and financial details are handled by this app, and data security findings indicate that user information may not be fully protected in storage. Google services collect usage data about how users interact with the app. Identity verification is handled through a third-party provider that sees users' personal documents.

    Method and Limitations

    Static analysis only. CITT reviewed the code of this build without running the app, so runtime behavior was not observed. The findings below describe the analyzed build and may not reflect server-side controls or later versions. CITT makes no determination about compliance with any law or platform policy; it reports what the artifacts contain and cites the published guidance so a reader can compare.

    How CITT scores an app

    Findings (11)

    Data Security

    3 total
    1 Critical
    2 High

    Network Security

    3 total
    2 Medium
    1 Low

    Code Security

    2 total
    1 Medium
    1 Low

    Privacy

    3 total
    1 High
    1 Medium
    1 Low

    Third-Party Services

    Persona SDK, Google Play Services, Google ML Kit, Google Data Transport, React Native, OkHttp, Coil, Lottie

    Security Strengths

    • ✓Secure WebView configuration with file access disabled
    • ✓Backup protection enabled (allowBackup=false)
    • ✓HTTPS enforced for all traffic
    • ✓No SQL injection vulnerabilities detected
    • ✓Proper SSL error handling
    What changed since the last scan

    Version diff is on the Developer plan. See developer plans.

    Context Tags

    financial
    sensitive data
    camera
    biometric
    identity verification
    loans

    Package

    com.kiwwi.android

    Version

    1.9.0 (Build 131)

    Analysis Date

    Feb 6, 2026

    Classes Analyzed

    13,029

    Was this analysis helpful?

    Feedback helps us improve our analysis

    View on Play Store

    Recommendation: Use With Caution

    Key Findings

    Data Security - 3 findings (1 critical, 2 high)

    Network Security - 3 findings (2 medium, 1 low)

    Code Safety - 0 findings

    Privacy - 3 findings (1 high, 1 medium, 1 low)

    Privacy Concerns

    What Data is Collected

    Kiwi Crédito collects personal and financial information to process credit applications, including identity documents uploaded for verification. Google services embedded in the app track how users navigate and interact with it, including which screens are visited and actions taken.

    Third-Party Data Sharing

    User data is handled by several third-party providers:

    • Persona SDK - Processes users' identity documents and personal details for identity verification
    • Google Play Services - Provides platform features and collects usage information tied to the device
    • Google Data Transport - Routes analytics data from the device to Google's infrastructure
    • Google ML Kit - Supports on-device processing tasks within the app

    Understanding the Scores

    CategoryScore
    Security55/100
    Privacy62/100
    Data Security45/100
    Network Security82/100
    Code Safety85/100
    Data Collection70/100
    Data Sharing75/100
    User Control65/100

    Positive Security Features

    • Network communications use secure transport protocols, reflected in the above-average network security score

    Areas for Improvement

    • The way personal and financial information is stored on the device needs strengthening, so user data stays protected if the phone is lost or accessed by someone else
    • Controls over what data the app collects and keeps are limited, giving users less ability to manage their own information
    • The handling of identity documents involves a third-party provider, and the protections around how those documents are transmitted and retained could be more transparent

    About This Analysis

    This scorecard is based on automated static analysis of the app's code and configuration. Scores reflect observed security and privacy practices at the time of the scan.

    App Details

    • App Name: Kiwi Crédito
    • Package ID: com.kiwwi.android
    • Version: 1.9.0 (Build 131)
    • Scan Date: February 6, 2026
    • Platform: Android

    Right of Reply

    Developer not yet contacted