Expensify - Travel & Expense Security & Privacy Scorecard

Expensify - Travel & Expense

What This Means for You

Your financial data and expense records are stored in an unencrypted local database on your device, and a session recording tool may capture transaction amounts, receipt images, and financial screens when remotely activated by Expensify.

Recommendation: Acceptable

Suitable for corporate expense reporting on managed devices. Legacy encryption fallbacks and an unencrypted database remain. Session recording may capture transaction details and financial screens when activated.

Best For: Employees doing routine expense reporting on corporate-managed devices

Key Findings

Data Security - 2 findings (1 high, 1 medium)

Network Security - 1 finding (1 low)

Code Safety - 3 findings (1 medium, 2 info)

Privacy - 2 findings (1 medium, 1 low)

Privacy Concerns

What Data is Collected

• Personal information: name, email address, and phone number shared with Expensify servers
• Financial information: expense transactions, receipt data, and card details shared with Expensify servers
• Location data: distance and GPS information shared with Expensify when logging mileage
• Device information: device identifiers and operating system details shared with Expensify and fraud detection services

Third-Party Data Sharing

The following third parties may receive your data:

• FullStory - session recording that may capture financial screens and receipt images when activated
• Firebase (Google) - analytics, crash reporting, and authentication services
• Sentry - error and crash reporting
• Urban Airship - push notification delivery
• Plaid - bank account linking and transaction connectivity
• Onfido - identity verification
• Group-IB - device fraud detection fingerprinting
• Mapbox - mapping and location display
• AdServices - advertising attribution

Understanding the Scores

Security: 78/100
Privacy: 82/100

Security Breakdown

• Data Security: 55/100 - Your account login details rely on an older encryption method as a fallback on legacy installs, and offline expense data is stored in an unencrypted local database.
• Network Security: 96/100 - Communications with Expensify servers use strong encryption in transit across all primary channels.
• Code Safety: 91/100 - Strong hardware-backed secure storage protects account login security on modern Android devices.

Privacy Breakdown

• Data Collection: 86/100 - Expense data, receipts, and location are shared with Expensify's servers to deliver the service, with a scope that aligns with the app's financial management purpose.
• Data Sharing: 87/100 - Financial and personal data is shared with a defined set of service providers supporting payments, identity verification, and analytics.
• User Control: 84/100 - The app offers data deletion requests and two-factor authentication, giving you meaningful control over your account.

Positive Security Features

• Hardware-backed secure storage protects account login details on modern Android devices
• Data encrypted in transit across all primary Expensify server communications
• Two-factor authentication support, with PCI-DSS Level 1, SOC1 and SOC2 Type II certification
• Session recording is server-activated rather than always-on, providing a baseline default protection

Areas for Improvement

GDPR / CCPA Compliance

The app's privacy practices could be strengthened by:

1. Session Recording Safeguards
   Adding screen masking for financial data within the session recording configuration would prevent transaction amounts, card details, and receipt images from being captured when recording is active.

2. Clearer Third-Party Disclosure
   More explicit in-app disclosure of which third-party services may receive financial data, and under what conditions session recordings are activated, would give users greater transparency.

Security Enhancements

1. Local Database Encryption
   Encrypting the offline expense database would protect your financial records if your device is lost or accessed without authorization.

2. Legacy Encryption Removal
   The older fallback encryption method used on legacy installs should be fully retired in favor of the modern, hardware-backed storage already in use on current devices.

Technical Context

App Type: Financial management and corporate expense reporting (sensitive data)
Classes Analyzed: 29,997
Third-Party Services: 17
Context Tags: financial, sensitive_data, location, camera, ads

---

About This Analysis

This security analysis was conducted by CITT (Can I Trust That), an independent security analysis service. We perform static code analysis on Android applications to help users make informed decisions about app security and privacy.

App Details

Developer: Expensify Inc.
Version: 9.4.0-7 (509040007)
Analysis Date: 2026-06-13
Package: org.me.mobiexpensifyg

Analysis Limitations

• Static analysis only (code review without running the app)
• Based on APK version 9.4.0-7 analyzed on 2026-06-13
• May not reflect server-side security controls
• Cannot detect all runtime behaviors