CITT

    Scan results

    Culture Cloud

    Android

    Culture Cloud is an employee recognition platform from O.C. Tanner that enables organizations to give recognition, share eCards, manage points, submit nominations, and complete award presentations on mobile. Requires organizational setup to use.

    CITT SCORE
    50
    out of 100
    unTRUSTED

    Quick Verdict

    Best for: Employees required to use it for workplace recognition

    Not For: You prefer work apps that don't record your screen activity

    What It Means For You

    In-app behavior is recorded by FullStory, which can capture screen interactions and session replays. User activity is also tracked by Firebase and Google Analytics. Some data protections fall short of expectations, meaning sensitive information submitted may not be fully protected.

    Method and Limitations

    Static analysis only. CITT reviewed the code of this build without running the app, so runtime behavior was not observed. The findings below describe the analyzed build and may not reflect server-side controls or later versions. CITT makes no determination about compliance with any law or platform policy; it reports what the artifacts contain and cites the published guidance so a reader can compare.

    How CITT scores an app

    Findings (11)

    Data Security

    4 total
    2 Critical
    2 High

    Network Security

    1 total
    1 High

    Code Security

    4 total
    1 High
    3 Medium

    Privacy

    2 total
    2 Medium

    Third-Party Services

    FullStory, Firebase Analytics, Embrace SDK, Google Analytics, Tenor GIF API, Pluto, Stetho

    Security Strengths

    • ✓SQLCipher AES-256 database encryption
    • ✓OAuth 2.0 with PKCE implementation
    • ✓HTTPS-only communication
    • ✓No JavaScript interfaces in WebViews
    • ✓Parameterized SQL queries via Room
    • ✓Android backup disabled
    What changed since the last scan

    Version diff is on the Developer plan. See developer plans.

    Context Tags

    workplace
    employee data
    financial
    sensitive data
    analytics
    session recording
    social

    Package

    com.octanner.android.culturecloud

    Version

    1.26.1 (Build 1117)

    Analysis Date

    Feb 8, 2026

    Classes Analyzed

    16,035

    Was this analysis helpful?

    Feedback helps us improve our analysis

    View on Play Store

    Recommendation: Use With Caution

    Key Findings

    Data Security - 4 findings (2 critical, 2 high)

    Network Security - 1 finding (1 high)

    Code Safety - 0 findings

    Privacy - 2 findings (2 medium)

    Privacy Concerns

    What Data is Collected

    Culture Cloud collects behavioral and interaction data throughout user sessions. FullStory captures screen activity and session replays of in-app behavior. Firebase and Google Analytics collect usage patterns, device information, and engagement data. The Embrace SDK gathers performance and stability information from the device.

    Third-Party Data Sharing

    User data is shared with the following external services:

    • FullStory - Screen and session recording
    • Firebase Analytics - Usage and behavioral analytics
    • Google Analytics - Engagement and activity tracking
    • Embrace SDK - App performance monitoring
    • Tenor GIF API - GIF content delivery
    • Pluto - In-app diagnostic tooling
    • Stetho - In-app diagnostic tooling

    Understanding the Scores

    CategoryScore
    Security45/100
    Privacy55/100
    Data Security35/100
    Network Security65/100
    Code Safety50/100
    Data Collection60/100
    Data Sharing70/100
    User Control50/100

    Positive Security Features

    • No positive security features were identified in this version of the app.

    Areas for Improvement

    • Sensitive data entered in the app may not be stored with adequate protections, putting personal and workplace information at risk.
    • Session activity is recorded by third-party services without clear in-app notice, limiting user awareness and control over what is captured.
    • Some communications between the app and its servers lack adequate protection, and data may travel with less protection than expected.

    About This Analysis

    This scorecard is based on static analysis of the app's code and configuration. Results reflect the state of the app at the time of the scan.

    App Details

    • App: Culture Cloud
    • Package ID: com.octanner.android.culturecloud
    • Version: 1.26.1 (Build 1117)
    • Scan Date: 2026-02-08
    • Platform: Android

    Right of Reply

    Developer not yet contacted