CITT

    Scan results

    Satispay: Pay and invest

    Android

    Satispay is a financial app enabling payments, money transfers, and investment management. Join 6M+ users for in-store/online shopping, public bill payments, recurring transfers, savings management, and investment services. Regulated electronic money institution with biometric security, loyalty rewa

    CITT SCORE
    62
    out of 100
    TRUSTish

    Quick Verdict

    Best for: Everyday mobile payments with standard analytics

    Not For: Users who don't want payment patterns used for marketing

    What It Means For You

    In-app activity is tracked by AppsFlyer for attribution and by Braze, a marketing automation service, meaning payment behavior may be linked to targeted outreach. Firebase Analytics also records how users navigate the app. Three marketing and analytics companies receive data about how users interact with their account.

    Method and Limitations

    Static analysis only. CITT reviewed the code of this build without running the app, so runtime behavior was not observed. The findings below describe the analyzed build and may not reflect server-side controls or later versions. CITT makes no determination about compliance with any law or platform policy; it reports what the artifacts contain and cites the published guidance so a reader can compare.

    How CITT scores an app

    Findings (12)

    Data Security

    4 total
    2 Critical
    1 High
    1 Medium

    Network Security

    3 total
    1 Critical
    2 High

    Code Security

    4 total
    2 Critical
    1 Medium
    1 Low

    Third-Party Risk

    1 total
    1 Medium

    Third-Party Services

    Braze, AppsFlyer, Firebase Analytics, Zendesk, Botpress, Innovatrics DOT Face SDK, iText PDF, Google Maps, Google Nearby, Giphy, AWS WAF, Coil, Glide, Picasso

    Security Strengths

    • ✓Certificate pinning with custom CA
    • ✓AES-256-GCM authenticated encryption
    • ✓Hardware-backed keys on modern devices
    • ✓Mutual TLS authentication for sensitive operations
    • ✓AWS WAF integration for bot protection
    What changed since the last scan

    Version diff is on the Developer plan. See developer plans.

    Context Tags

    financial
    sensitive data
    payments
    banking
    location
    ads
    analytics
    biometric
    nfc

    Package

    com.satispay.customer

    Version

    4.24.6 (Build 9511)

    Analysis Date

    Feb 1, 2026

    Classes Analyzed

    48,325

    Was this analysis helpful?

    Feedback helps us improve our analysis

    View on Play Store

    Recommendation: Use With Caution

    Key Findings

    Data Security - 4 findings (2 critical, 1 high, 1 medium)

    Network Security - 3 findings (1 critical, 2 high)

    Code Safety - 0 findings

    Privacy - 0 findings

    Privacy Concerns

    What Data is Collected

    The app collects data on how users use and navigate it, including payment activity and account interactions. Location access is used for proximity-based payment features. Customer support conversations are routed through Zendesk, where user messages may be stored. Image and media content is loaded through third-party libraries integrated into the app.

    Third-Party Data Sharing

    Activity data is shared with the following third-party services:

    • AppsFlyer - Tracks how users arrived at the app and records user behavior after install
    • Braze - Receives data about in-app activity for marketing automation and targeted outreach
    • Firebase Analytics - Records how users navigate and interact with the app
    • Zendesk - Handles customer support conversations
    • Google Maps / Google Nearby - Used for location-based proximity payment features
    • Botpress - Supports in-app chat or automated support interactions

    Understanding the Scores

    CategoryScore
    Security25/100
    Privacy100/100
    Data Security30/100
    Network Security20/100
    Code Safety40/100
    Data Collection100/100
    Data Sharing100/100
    User Control100/100

    Positive Security Features

    • No notable positive security practices were identified in this version of the app.

    Areas for Improvement

    • Payment and account data stored on user devices could be better protected against unauthorized access.
    • Data traveling between user devices and the app's back-end systems does not fully meet current protection standards.
    • Reducing the number of third-party services that receive data about user payment behavior would provide stronger financial privacy.

    About This Analysis

    This scorecard reflects automated analysis of the app's code and configuration at the time of this scan. Scores and findings represent a point-in-time assessment and may not reflect subsequent updates to the app.

    App Details

    • App Name: Satispay: Pay and invest
    • Package: com.satispay.customer
    • Version: 4.24.6 (Build 9511)
    • Scan Date: 2026-02-01
    • Platform: Android

    Right of Reply

    Developer not yet contacted