Revolut: Send, spend and save Security & Privacy Scorecard

Revolut: Spend, Save, Trade

Package: com.revolut.revolut
Version: 10.124 (Build 30225)
Scan Date: 2026-04-02

What This Means for You

In-app activity is shared with advertising and analytics companies, including Facebook and AppsFlyer, to track marketing campaigns. Identity verification relies on multiple third-party services that process personal documents and biometric data. Financial transactions and account data are protected with strong security practices.

Recommendation: Trustworthy

Best For: Day-to-day banking and international transfers
Avoid If: You don't want activity shared with ad networks

Key Findings

Data Security - 5 findings (1 low, 4 info)

Network Security - 3 findings (3 info)

Code Safety - 0 findings

Privacy - 4 findings (1 high, 1 medium, 2 info)

Privacy Concerns

What Data is Collected

Revolut collects financial transaction data, account details, identity documents for verification, biometric data for identity checks, device identifiers, and behavioral usage data. Account activity and usage patterns are recorded within the app.

Third-Party Data Sharing

User data is shared with the following third-party services:

• Facebook SDK - Receives in-app activity data for advertising and marketing attribution
• AppsFlyer - Tracks installs and in-app events for marketing campaign measurement
• Branch.io - Tracks referral links and install attribution
• Onfido - Processes identity documents and biometric data for verification
• SeonSDK - Collects device signals for fraud detection
• TwilioVoice - Handles voice communications for in-app calls
• Firebase (Crashlytics, Messaging, Remote Config, A/B Testing) - App stability reporting, push notifications, and remote feature configuration
• ItrustEkycLibrary / TrustdockAPI / AuthadaAuthenticationLibrary - Additional identity verification processors that receive personal and biometric data

Understanding the Scores

Positive Security Features

• All network traffic is encrypted, with transport security enforced through TrustKit for all server connections
• The app binary includes code hardening via iXGuard to protect against tampering
• Authentication follows modern OAuth security standards via AppAuthCore
• Secure time synchronization through Kronos reduces exposure to timing-based issues

Areas for Improvement

• User activity is tracked by advertising networks (Facebook SDK and AppsFlyer) even when marketing features are not in active use, giving those companies visibility into financial app usage.
• Identity verification involves multiple third parties that receive personal documents and biometric data, each with their own data retention and sharing practices.
• The data collected for analytics and attribution creates detailed profiles of in-app behavior that are shared beyond the app itself.

About This Analysis

Scores are based on static analysis of the published app binary. Results reflect security and privacy characteristics at the time of the scan. Practices may change with future updates.

App Details