EVO Security & Privacy Scorecard

EVO

What This Means for You

Your government ID data and account information may be left without encryption if the app's security protections fail twice in a row, and a debugging tool active in this production release writes your account details to system logs.

Recommendation: Acceptable

Acceptable for Moldovan citizens needing digital government services on standard, up-to-date Android devices. The app's encryption may fall back to unprotected storage if the device security chip fails twice consecutively, and a diagnostic tool included in the production build can be activated with a 7-tap sequence to capture network traffic. For most users on healthy devices, the strong encryption defaults provide solid protection for your national ID and health data.

Best For: Moldovan citizens who need digital government services and use standard, up-to-date Android devices

Key Findings

Data Security - 3 findings (1 high, 2 medium)

Network Security - 2 findings (2 medium)

Code Safety - 3 findings (2 medium, 1 low)

Privacy - 1 finding (1 info)

Privacy Concerns

What Data is Collected

• Personal information: Your national ID, driver's license, and government account details are accessed on your device
• Health information: Your health prescriptions and records are accessed on your device
• Device information: Your device's advertising identifier is shared with Google via the analytics SDK
• Usage data: App interactions and crash reports are sent to Google (Firebase Analytics and Crashlytics)
• Location data: Location may be accessed for public service features (permission is requested)

Third-Party Data Sharing

The following third parties may receive your data:

• Google (Firebase Analytics) - Usage analytics and advertising identifier
• Google (Firebase Crashlytics) - Crash reports and device diagnostics
• Google (Firebase Messaging) - Push notification delivery

Understanding the Scores

Security: 70/100
Privacy: 87/100

Security Breakdown

• Data Security: 57/100 - The app uses strong encrypted databases by default, but fallback paths may store your government ID data without protection when the device security chip encounters repeated failures. A production logging feature also writes full API traffic details, including account data, to system logs.
• Network Security: 82/100 - Most network communications are well-protected. The government sign-in screen has some hardening opportunities in how it handles the OAuth login flow and its scripting configuration.
• Code Safety: 82/100 - The app is well-structured overall, but a diagnostic tool bundled in the production build can be unlocked with a simple tap sequence, and a web screen used for business details allows broader file access than necessary.

Privacy Breakdown

• Data Collection: 88/100 - Government ID documents and health information are processed locally on your device. Usage analytics and crash reports are sent to Google.
• Data Sharing: 90/100 - Data sharing is limited primarily to Google's Firebase services for analytics, crash reporting, and push notifications.
• User Control: 95/100 - The app gives you strong control over your data. Device backup access is disabled, your government documents cannot be extracted via standard backup tools, and you control what documents you add to the app.

Positive Security Features

• Strong PIN protection using a secure key derivation function with a random salt, meeting modern security standards
• Government account data stored in encrypted databases backed by hardware-level device security
• Device backup disabled, preventing government ID and account data from being copied via USB backup tools
• Payment links verified against official government domains before processing
• Push notification links validated against an approved list before navigation
• Authentication screen wipes all session data before loading the government sign-in page
• No exposed JavaScript interfaces in web screens, limiting cross-context data access
• EUDI Wallet operations use ISO 18013-compliant cryptography for mobile driver's license presentation

Areas for Improvement

GDPR / CCPA Compliance

The app's privacy practices could be strengthened by:

1. Remove Advertising Tracking Permissions
   The analytics SDK requests advertising and conversion-tracking permissions that have no clear purpose in an official government identity service. Removing these permissions would better align with the app's purpose and reduce unnecessary data sharing with Google's advertising infrastructure.

2. Harden Encryption Fallback Behavior
   When the device's secure storage chip is unavailable, the app should pause or alert the user rather than silently switching to unprotected storage for government ID data and account information.

Security Enhancements

1. Remove the Diagnostic Tool from Production Builds
   A network inspection and debugging tool is bundled into the production release and can be activated with a 7-tap sequence, with no additional authentication required. It should be excluded from production builds to prevent unintended exposure of API traffic and account data.

2. Strengthen the OAuth Login Screen Configuration
   The government identity sign-in screen enables scripting features that are not required for the login process to complete. Restricting these settings would reduce the attack surface for the authentication flow.

3. Replace Staging URLs in Production Flows
   Two user-facing screens navigate to staging environment addresses in the production release, and a test payment gateway is treated as a valid payment option. These should be updated to production addresses.

Technical Context

App Type: Government identity and public services (sensitive data - national ID, health, financial)
Classes Analyzed: 3,400
Third-Party Services: 23 identified
Context Tags: government, sensitive_data, financial, health, identity

---

About This Analysis

This security analysis was conducted by CITT (Can I Trust That), an independent security analysis service. We perform static code analysis on Android applications to help users make informed decisions about app security and privacy.

App Details

Developer: e-Governance Agency of Moldova
Version: 2.0.1.240 (versionCode 240)
Analysis Date: 2026-06-13
Package: md.egov.evo

Analysis Limitations

• Static analysis only (code review without running the app)
• Based on APK version 2.0.1.240 analyzed on 2026-06-13
• May not reflect server-side security controls
• Cannot detect all runtime behaviors