CITT

    Scan results

    Unergy

    Android

    Unergy is a solar energy investment app offering estimated annual returns up to 13%. Users can view project details, track real-time performance, manage earnings and balance, and withdraw or reinvest profits using blockchain-backed insurance and recording.

    CITT SCORE
    40
    out of 100
    unTRUSTED

    Quick Verdict

    Best for: Energy users comfortable with identity verification

    Not For: You prefer not to share biometric or identity data

    What It Means For You

    Identity is verified through Incode and Metamap, which collect biometric and document data. In-app behavior is recorded by UXCam and sent to Firebase, Sentry, and Statsig for analytics and crash tracking. Sensitive data stored on the device has limited protections, meaning user data may not be fully protected if the device is lost or compromised.

    Method and Limitations

    Static analysis only. CITT reviewed the code of this build without running the app, so runtime behavior was not observed. The findings below describe the analyzed build and may not reflect server-side controls or later versions. CITT makes no determination about compliance with any law or platform policy; it reports what the artifacts contain and cites the published guidance so a reader can compare.

    How CITT scores an app

    Findings (14)

    Data Security

    2 total
    1 Critical
    1 Low

    Network Security

    4 total
    2 High
    2 Medium

    Code Security

    5 total
    1 Critical
    2 High
    1 Medium
    1 Low

    Privacy

    2 total
    1 Critical
    1 Medium

    Third-Party Risk

    1 total
    1 High

    Third-Party Services

    Incode, Metamap, UXCam, Firebase, Sentry, Statsig, OpenTok, Google Play Services

    Security Strengths

    • ✓Strong encryption for app credentials (AES-256-GCM with Android Keystore)
    • ✓Incode SDK implements SSL pinning and end-to-end encryption
    • ✓Backup disabled (allowBackup=false)
    • ✓Internal storage with MODE_PRIVATE
    • ✓Extensive ProGuard/R8 obfuscation applied
    What changed since the last scan

    Version diff is on the Developer plan. See developer plans.

    Context Tags

    financial
    biometric
    sensitive data
    identity verification
    session recording
    gdpr violation
    ccpa violation
    bipa violation

    Package

    com.unergy.unergy_mobile

    Version

    9.8.12

    Analysis Date

    Feb 6, 2026

    Classes Analyzed

    13,448

    Was this analysis helpful?

    Feedback helps us improve our analysis

    View on Play Store

    Recommendation: Use With Caution

    Key Findings

    Data Security - 2 findings (1 critical, 1 low)

    Network Security - 4 findings (2 high, 2 medium)

    Code Safety - 0 findings

    Privacy - 2 findings (1 critical, 1 medium)

    Privacy Concerns

    What Data is Collected

    Unergy collects biometric and identity document data through Incode and Metamap for identity verification. In-app behavior, including screen-level activity, is recorded by UXCam. Crash reports and performance data are collected by Sentry and Firebase.

    Third-Party Data Sharing

    Data is shared with the following third parties:

    • Incode - Identity verification and biometric data processing
    • Metamap - Identity document verification
    • UXCam - In-app behavior recording and session replay
    • Firebase - Analytics and app performance tracking
    • Sentry - Crash and error reporting
    • Statsig - Feature management and analytics
    • OpenTok - Video communication services
    • Google Play Services - Core platform services

    Understanding the Scores

    CategoryScore
    Security45/100
    Privacy35/100
    Data Security30/100
    Network Security75/100
    Code Safety50/100
    Data Collection40/100
    Data Sharing55/100
    User Control60/100

    Positive Security Features

    No notable positive security practices were identified in this version of the app.

    Areas for Improvement

    • Sensitive data stored on the device should be protected more robustly, reducing the impact if the device is lost or stolen.
    • The scope of behavioral and identity data collected is broad. Clearer in-app controls for managing what is retained would provide more meaningful privacy choices.
    • Some server communications could be configured more securely to better protect user data while it travels between the device and Unergy's systems.

    About This Analysis

    This scorecard is generated from automated static analysis of the app's code and configuration. It reflects the state of the app as of the scan date and may not account for changes introduced in later versions.

    App Details

    • App Name: Unergy
    • Package ID: com.unergy.unergy_mobile
    • Version: 9.8.12
    • Platform: Android
    • Scan Date: 2026-02-06

    Right of Reply

    Developer not yet contacted