# Security & Privacy Scorecard

## Mi Bancolombia

**Version:** 1.79.3 (Build 458)
**Package:** co.com.bancolombia.personas.superapp
**Scan Date:** 2026-02-04

## What This Means for You

Typing patterns and in-app behavior are monitored by a third-party behavioral analytics company alongside standard banking activity. Usage data is shared with marketing attribution, A/B testing, and multiple analytics platforms across several providers. Users have very little ability to control or opt out of what is collected and shared.

## Recommendation: Use With Caution

**Best For:** Bancolombia customers accepting behavioral monitoring
**Avoid If:** Users who expect minimal data sharing from their bank

## Key Findings

**Data Security** - 4 findings (1 high, 1 medium, 1 low, 1 info)

**Network Security** - 1 finding (1 high)

**Code Safety** - 0 findings

**Privacy** - 6 findings (4 high, 2 medium)

## Privacy Concerns

### What Data is Collected

Mi Bancolombia collects behavioral biometrics through BioCatch, which monitors typing rhythm, touch patterns, and device interaction habits to build a continuous profile of how the app is used. Firebase Analytics and Firebase Performance record in-app actions, session data, and performance metrics. AppsFlyer captures install source and attribution data. Huawei Mobile Services collects device identifiers and usage data on Huawei devices. Dynatrace and Medallia Digital observe user interactions and satisfaction signals.

### Third-Party Data Sharing

Data is shared with the following third-party companies:

- **Behavioral profiling:** BioCatch
- **Analytics and performance:** Firebase Analytics, Firebase Performance, Dynatrace
- **Marketing attribution:** AppsFlyer
- **A/B testing and optimization:** VWO
- **Customer feedback and experience:** Medallia Digital
- **Platform services:** Huawei Mobile Services (HMS Core, Analytics, Maps, ScanKit, ML Kit)
- **Device identity management:** AppGate DIDM
- **Security monitoring:** Talsec RASP
- **Utilities:** EasySol

## Understanding the Scores

| Category | Score |
|---|---|
| Security | 45/100 |
| Privacy | 30/100 |
| Data Security | 60/100 |
| Network Security | 55/100 |
| Code Safety | 50/100 |
| Data Collection | 25/100 |
| Data Sharing | 20/100 |
| User Control | 15/100 |

## Positive Security Features

- No notable positive security practices were identified in this analysis.

## Areas for Improvement

- Behavioral patterns, including typing rhythm and swipe behavior, are shared with a third-party profiling company. This level of data collection goes beyond what most financial apps require.
- Usage data flows to a large number of analytics, marketing, and attribution companies, providing limited transparency into where the information goes and how it is used.
- The app provides very little ability to limit or opt out of data collection during normal use, placing meaningful control outside users' reach.

---

## About This Analysis

This scorecard is based on automated analysis of the app's compiled code and embedded configuration. Scores reflect observed data practices at the time of the scan and may not capture every behavior.

### App Details

| Field | Value |
|---|---|
| App Name | Mi Bancolombia |
| Package ID | co.com.bancolombia.personas.superapp |
| Version | 1.79.3 (Build 458) |
| Scan Date | 2026-02-04 |