CITT

    Scan results

    Nu

    Android

    Nu is Latin America's largest digital financial services platform with 105M+ customers. Offers credit cards, loans, investments, insurance, PIX transfers, and cashback across Brazil, Mexico, and Colombia with 24/7 support.

    CITT SCORE
    70
    out of 100
    TRUSTish

    Quick Verdict

    Best for: Everyday banking with standard analytics and fraud tools

    Not For: You prefer not to share biometric or identity data

    What It Means For You

    Identity is verified using biometric scanning and third-party identity services, meaning facial data and documents are shared externally. App behavior and crash reports are sent to analytics and monitoring providers. Fraud detection tools analyze patterns in how the app is used to flag suspicious activity.

    Method and Limitations

    Static analysis only. CITT reviewed the code of this build without running the app, so runtime behavior was not observed. The findings below describe the analyzed build and may not reflect server-side controls or later versions. CITT makes no determination about compliance with any law or platform policy; it reports what the artifacts contain and cites the published guidance so a reader can compare.

    How CITT scores an app

    Findings (15)

    Data Security

    4 total
    1 Critical
    1 High
    2 Medium

    Network Security

    2 total
    1 Critical
    1 Medium

    Code Security

    4 total
    2 Medium
    2 Low

    Privacy

    5 total
    2 High
    1 Medium
    2 Low

    Third-Party Services

    AppsFlyer, Instabug, Sentry, Plaid, ThreatMetrix, Incode, FaceTec, Persona, Branch.io, Firebase, Gemalto, Zoop, AWS Amplify

    Security Strengths

    • ✓Flutter Secure Storage with hardware-backed Android KeyStore (AES-256)
    • ✓Comprehensive HTTPS enforcement across all API endpoints
    • ✓allowBackup=false prevents cloud backup exposure
    • ✓No JavaScript interfaces in WebViews (eliminates RCE vectors)
    • ✓No server-side secrets exposed (zero API keys, AWS credentials, or database passwords)
    What changed since the last scan

    Version diff is on the Developer plan. See developer plans.

    Context Tags

    financial
    sensitive data
    location
    camera
    contacts
    ads

    Package

    com.nu.production

    Version

    9.40.38

    Analysis Date

    Feb 16, 2026

    Classes Analyzed

    16,975

    Was this analysis helpful?

    Feedback helps us improve our analysis

    View on Play Store

    Recommendation: Use With Caution

    Key Findings

    Data Security - 4 findings (1 critical, 1 high, 2 medium)

    Network Security - 2 findings (1 critical, 1 medium)

    Code Safety - 0 findings

    Privacy - 5 findings (2 high, 1 medium, 2 low)

    Privacy Concerns

    What Data is Collected

    Nu collects biometric data (facial scans) and identity documents for account verification, behavioral patterns and usage data for fraud detection, crash and diagnostic reports, and device information.

    Third-Party Data Sharing

    User data is shared with the following services:

    • AppsFlyer - Mobile attribution and marketing analytics
    • Instabug - Crash reporting and in-app feedback
    • Sentry - Error monitoring and performance tracking
    • Plaid - Financial account linking and verification
    • ThreatMetrix - Fraud detection and behavioral profiling
    • Incode - Identity verification and document checking
    • FaceTec - Facial biometric authentication
    • Persona - Identity verification and compliance
    • Branch.io - Attribution and app navigation
    • Firebase - Analytics, crash reporting, and push notifications
    • Gemalto - Digital identity and security services
    • Zoop - Financial data and document verification
    • AWS Amplify - Cloud infrastructure and data storage

    Understanding the Scores

    CategoryScore
    Security68/100
    Privacy72/100
    Data Security65/100
    Network Security60/100
    Code Safety82/100
    Data Collection75/100
    Data Sharing78/100
    User Control70/100

    Positive Security Features

    • Code safety scores well at 82/100, reflecting sound development practices in the app's codebase.
    • Data sharing practices score 78/100, suggesting the app applies some filtering to what is forwarded to third parties.

    Areas for Improvement

    • Data transmitted to external services would benefit from stronger protections to reduce the risk of interception during network communication.
    • The breadth of third-party services with access to sensitive financial and biometric data means user personal information is subject to multiple external privacy policies outside the developer's direct control.
    • Clearer in-app controls over behavioral profiling and analytics data sharing would give users more agency over how their data is used.

    About This Analysis

    App Details

    • App Name: Nu
    • Package: com.nu.production
    • Version: 9.40.38
    • Scan Date: 2026-02-16
    • Analysis Method: Automated static analysis

    Right of Reply

    Developer not yet contacted