Nu Security & Privacy Scorecard

Nu

What This Means for You

Identity is verified using biometric scanning and third-party identity services, meaning facial data and documents are shared externally. App behavior and crash reports are sent to analytics and monitoring providers. Fraud detection tools analyze patterns in how the app is used to flag suspicious activity.

Recommendation: Use With Caution

Best For: Everyday banking with standard analytics and fraud tools

Avoid If: You prefer not to share biometric or identity data

Key Findings

Data Security - 4 findings (1 critical, 1 high, 2 medium)

Network Security - 2 findings (1 critical, 1 medium)

Code Safety - 0 findings

Privacy - 5 findings (2 high, 1 medium, 2 low)

Privacy Concerns

What Data is Collected

Nu collects biometric data (facial scans) and identity documents for account verification, behavioral patterns and usage data for fraud detection, crash and diagnostic reports, and device information.

Third-Party Data Sharing

User data is shared with the following services:

• AppsFlyer - Mobile attribution and marketing analytics
• Instabug - Crash reporting and in-app feedback
• Sentry - Error monitoring and performance tracking
• Plaid - Financial account linking and verification
• ThreatMetrix - Fraud detection and behavioral profiling
• Incode - Identity verification and document checking
• FaceTec - Facial biometric authentication
• Persona - Identity verification and compliance
• Branch.io - Attribution and app navigation
• Firebase - Analytics, crash reporting, and push notifications
• Gemalto - Digital identity and security services
• Zoop - Financial data and document verification
• AWS Amplify - Cloud infrastructure and data storage

Understanding the Scores

Positive Security Features

• Code safety scores well at 82/100, reflecting sound development practices in the app's codebase.
• Data sharing practices score 78/100, suggesting the app applies some filtering to what is forwarded to third parties.

Areas for Improvement

• Data transmitted to external services would benefit from stronger protections to reduce the risk of interception during network communication.
• The breadth of third-party services with access to sensitive financial and biometric data means user personal information is subject to multiple external privacy policies outside the developer's direct control.
• Clearer in-app controls over behavioral profiling and analytics data sharing would give users more agency over how their data is used.

About This Analysis

App Details

• App Name: Nu
• Package: com.nu.production
• Version: 9.40.38
• Scan Date: 2026-02-16
• Analysis Method: Automated static analysis