CITT

    Scan results

    Avanza

    Android

    Avanza is a Swedish online banking and investment app offering savings, investing, mortgage loans, and portfolio management. Sign up with electronic ID, trade stocks with low fees, move securities, and manage your finances through an intuitive interface.

    CITT SCORE
    68
    out of 100
    TRUSTish

    Quick Verdict

    Best for: Swedish investors comfortable with standard crash reporting

    What It Means For You

    App usage and crash data is shared with Firebase, including diagnostics that help the developer but also feed Google's infrastructure. Authentication flows through BankID and Trustly, third-party services that handle user identity and payment data. Some data is stored in ways that carry moderate risk if the device is compromised.

    Method and Limitations

    Static analysis only. CITT reviewed the code of this build without running the app, so runtime behavior was not observed. The findings below describe the analyzed build and may not reflect server-side controls or later versions. CITT makes no determination about compliance with any law or platform policy; it reports what the artifacts contain and cites the published guidance so a reader can compare.

    How CITT scores an app

    Findings (18)

    Data Security

    9 total
    3 High
    5 Medium
    1 Low

    Network Security

    1 total
    1 Medium

    Code Security

    5 total
    1 High
    2 Medium
    2 Low

    Privacy

    3 total
    1 High
    1 Medium
    1 Low

    Third-Party Services

    Firebase Cloud Messaging, Firebase Crashlytics, Firebase App Check, BankID, Trustly

    Security Strengths

    • ✓AES-256-GCM encryption for storage
    • ✓No analytics or behavioral tracking SDKs
    • ✓Multi-token authentication with CSRF protection
    • ✓Hardware-backed key storage via Android Keystore
    • ✓No SSL certificate validation bypasses
    What changed since the last scan

    Version diff is on the Developer plan. See developer plans.

    Context Tags

    financial
    sensitive data
    biometric
    push notifications

    Package

    se.avanzabank.androidapplikation

    Version

    5.127.0 (Build 1027)

    Analysis Date

    Dec 18, 2025

    Classes Analyzed

    7,462

    Was this analysis helpful?

    Feedback helps us improve our analysis

    View on Play Store

    Recommendation: Use With Caution

    Key Findings

    Data Security - 9 findings (3 high, 5 medium, 1 low)

    Network Security - 1 finding (1 medium)

    Code Safety - 0 findings

    Privacy - 3 findings (1 high, 1 medium, 1 low)

    Privacy Concerns

    What Data is Collected

    Avanza collects usage and behavioral data through Firebase analytics, capturing how users interact with the app and which features they use. Crash and diagnostic reports are sent to Firebase Crashlytics when the app encounters errors. Device identifiers and session activity are included in this collection.

    Third-Party Data Sharing

    Data is shared with three external services:

    • Firebase (Google) - receives crash reports, usage patterns, and app diagnostics
    • BankID - receives user identity information during authentication flows
    • Trustly - receives payment-related data when users use connected payment features

    Understanding the Scores

    CategoryScore
    Overall Security65/100
    Overall Privacy75/100
    Data Security58/100
    Network Security92/100
    Code Safety72/100
    Data Collection88/100
    Data Sharing78/100
    User Control70/100

    Positive Security Features

    • Network communications are well-protected, as reflected in the high Network Security score of 92/100
    • Authentication relies on established Swedish financial identity infrastructure rather than a custom-built login system

    Areas for Improvement

    • Certain data stored locally on the device could be better protected against unauthorized access if the device is lost or stolen
    • Options to control or limit data collected about in-app behavior are limited
    • Data flows through multiple third-party services, each applying their own data handling practices outside the developer's direct control

    About This Analysis

    This scorecard was generated through automated static analysis of the app's code and configuration. Scores reflect the security and privacy practices observed in the analyzed version and may not capture server-side behaviors.

    App Details

    FieldValue
    App NameAvanza
    Package IDse.avanzabank.androidapplikation
    Version5.127.0 (Build 1027)
    Scan Date2025-12-18
    PlatformAndroid

    Right of Reply

    Developer not yet contacted