Scan results

Recommendation: Very Secure

CITT assesses this build as very secure for business banking. Network connections to Revolut's servers are protected against interception, financial databases are encrypted on the device, authentication session data is stored in hardware-backed secure storage with biometric binding, and authorization data is restricted to Revolut-owned domains.

Key Findings

Data Security: 0 findings

Network Security: 2 findings (2 low)

Code Safety: 5 findings (5 low)

Privacy: 0 findings

Privacy Concerns

What Leaves the Device

• Business account identity: linked to AppsFlyer's advertising attribution platform for attribution and behavioral analytics purposes
• Advertising identifier: included in internal analytics events shared with analytics and attribution services
• Usage analytics, performance data, and crash reports: shared with Firebase Analytics, Firebase Performance, and Firebase Crashlytics
• Device system properties (device model, operating system version, hardware configuration details): may be returned to hCaptcha's servers during bot detection validation, as the build's code is designed to support; runtime behavior was not observed
• Identity verification information: submitted to Onfido for KYC and identity verification
• Navigation link attribution data: shared with Branch.io
• Device fraud detection signals: submitted to Revolut's own servers via the SEON fraud detection SDK during onboarding (not shared with the SEON vendor directly)

What Stays on the Device

• Encrypted financial database content: stored in encrypted databases on the device and not shared with advertising or third-party analytics services
• Authentication session data and cryptographic keys: stored in hardware-backed secure storage; the underlying key material is designed to remain within the secure hardware

Third-Party Data Sharing

Third parties that may receive data from the app:

• AppsFlyer - advertising attribution and behavioral analytics
• Firebase Analytics (Google) - usage analytics
• Firebase Crashlytics (Google) - crash reporting
• Firebase Performance (Google) - performance monitoring
• Firebase Messaging (Google) - push notification delivery
• Firebase App Check (Google) - app integrity verification
• Firebase Remote Config (Google) - remote feature configuration
• hCaptcha - bot detection and fraud prevention
• Google Ad Manager (Google) - advertising
• Google Play Integrity (Google) - device integrity verification
• Onfido - identity verification and KYC
• Google ML Kit (Google) - document and biometric processing
• Branch.io - navigation link attribution
• MeshConnect Link - financial account connectivity
• Google Pay / Tap and Pay (Google) - payment processing
• youTransactor uCube - card reader operations

Understanding the Scores

Security: 93/100
Privacy: 88/100

Security Breakdown

• Data Security: 93/100. Financial databases are encrypted on the device and authentication session data is stored in hardware-backed secure storage with biometric binding.
• Network Security: 95/100. Network connections to Revolut's servers are protected against interception and all unencrypted traffic is blocked globally with no exceptions.
• Code Safety: 91/100. The build includes commercial code protection with emulator, tamper, and unofficial-install detection alongside layered device integrity checks.

Privacy Breakdown

• Data Collection: 89/100. Standard usage analytics, crash reports, and device identifiers are shared with analytics and attribution services; financial transaction data stays on the device or is processed via Revolut's own servers.
• Data Sharing: 88/100. Authorization data is scoped to Revolut-owned domains by design and is not included in requests to third-party analytics or attribution services, though business account identity is linked to AppsFlyer's attribution platform.
• User Control: 89/100. Automatic device backup is disabled, preventing banking data from reaching Google cloud storage, and fraud detection signals are routed through Revolut's own servers rather than to the fraud detection vendor directly.

Positive Security Features

• Network connections to Revolut's servers are protected against interception, including when a device trusts a rogue certificate authority.
• All unencrypted network traffic is blocked globally with no exceptions.
• In-app browser views cancel loading when connection errors occur rather than proceeding past them.
• Authentication session data is stored in hardware-backed secure storage with biometric binding.
• All financial databases are encrypted on the device.
• Cryptographic keys are stored in hardware-backed secure storage with biometric binding and dedicated security chip support.
• Authorization data is scoped to Revolut-owned domains by design and is not included in requests to third-party analytics or attribution services.
• Automatic device backup is disabled, preventing banking data from reaching Google cloud storage.
• The build includes commercial code protection with emulator, tamper, and unofficial-install detection.
• A layered device integrity check identifies compromised device states including unlocked bootloaders and modified firmware.
• The SEON fraud detection SDK is integrated such that device fingerprint data is routed to Revolut's own servers rather than to the vendor's servers directly.

Areas for Improvement

Disclosure observations

Observations about disclosure, each stated against the published guidance so a reader can compare:

1. Business account identity linked to advertising attribution
   The build links a verified business account identifier to AppsFlyer's attribution platform. AppsFlyer's Privacy for Advertisers documentation describes data minimization options including limiting the fields associated with a user profile; whether this association was disclosed in the privacy notice in effect for this build could not be determined from the binary.

2. Advertising identifier in business banking analytics
   The build includes an advertising identifier in internal analytics events. Google's Advertising ID policy permits use of this identifier for analytics purposes; whether its inclusion in analytics events from a business banking account is disclosed in the privacy notice for account holders could not be determined from the binary.

3. Scope of fraud detection signals during onboarding
   The SEON fraud detection SDK gathers hardware-persistent device identifiers, the list of accessibility apps installed on the device, clipboard data, and the connected Wi-Fi network name during KYC onboarding. These signals are routed to Revolut's own servers. Whether the full scope of these signals is disclosed to users at the point of collection could not be determined from the binary.

Security Enhancements

1. Screen capture protection controlled by remote configuration
   The build registers Firebase Remote Config flags that can disable screen capture protection for banking screens. Migrating this control to a client-side-only mechanism would eliminate the dependency on third-party infrastructure availability for this security feature.

2. Custom navigation scheme without link verification
   The build registers revolut-business:// as a navigation link handler without the verification mechanism used for HTTPS links. Any other app installed on the device may register the same scheme and intercept link requests intended for Revolut Business; migrating internal navigation to verified HTTPS links would address this.

3. Staging-environment link domains in the production build
   The build registers Branch.io staging-environment domains (revolut-business.test-app.link and revolut-business-alternate.test-app.link) as verified link handlers in the production release. Links from Branch.io's staging infrastructure may invoke live production banking flows; removing these staging-environment entries from the production build would address this.

4. Alpha-stage HTTP library in a production financial app
   assets/libraries.json lists an alpha-stage release of the Fuel HTTP library (3.0.0-alpha04) as a production runtime dependency. Alpha software carries no defined security response policy, making patch timelines unpredictable. Payment card industry guidance (PCI DSS section 6.3.3) recommends that all components be maintained free from known security gaps; migrating to the stable 2.x release series would align with this guidance.

5. Payment card protocol traces in production log files
   assets/logback.xml configures the card reader logger at DEBUG level, routing payment card protocol traces to rolling log files stored on the device. Reducing the log level to WARN or INFO in the production build, and auditing on-device log content against payment card industry log management guidance, would limit the protocol data available to an attacker with physical access to the device.

Technical Context

App Type: Business banking and payment processing, high-sensitivity financial application
Classes Analyzed: 92,591
Third-Party Services: 21
Context Tags: financial, business, sensitive_data, analytics, biometric, kyc

About This Analysis

This security analysis was conducted by CITT (Can I Trust That), an independent security analysis service. The analysis is static code review of Android applications, intended to help people make informed decisions about app security and privacy.

App Details

Developer: Revolut Ltd
Version: 6.3.1 (versionCode: 616003111)
Analysis Date: 2026-08-13
Package: com.revolut.business

Analysis Limitations

• Static analysis only (code review without running the app)
• Based on APK version 6.3.1 analyzed on 2026-08-13
• May not reflect server-side security controls
• Cannot detect all runtime behaviors