# Security & Privacy Scorecard

## Seguros SURA

**10 Total Findings** | **Security: 35/100** | **Privacy: 40/100**

co.com.sura.seguros - Version 12.3.3

## What This Means for You

User activity is tracked by Mixpanel, Firebase, and Facebook SDK, sharing behavioral data with multiple third parties. Data moves across advertising and analytics platforms including Google Tag Manager. Users have limited control over what is collected or how it is used.

## Recommendation: Use With Caution

**Best For:** SURA customers comfortable with broad analytics
**Avoid If:** You prefer not to share behavior data with Facebook

## Key Findings

**Data Security** - 2 findings (2 high)

**Network Security** - 2 findings (2 critical)

**Code Safety** - 0 findings

**Privacy** - 6 findings (1 critical, 4 high, 1 low)

## Privacy Concerns

### What Data is Collected

Multiple analytics platforms collect behavioral data, including in-app actions, session duration, screen flows, and device information. Crash reports and performance telemetry are gathered automatically. Medallia Digital captures feedback and session recordings tied to user interactions.

### Third-Party Data Sharing

Data is shared with the following third parties:

- **Facebook SDK** - behavioral and device data shared with Meta's advertising network
- **Google Tag Manager** - coordinates data routing across advertising and analytics services
- **Mixpanel** - receives detailed records of in-app actions and user flows
- **Firebase** (Analytics, Performance, Crashlytics, Firestore, FCM) - Google's platform receives usage, crash, and performance data
- **Datadog RUM** - receives real-time session and performance data
- **Medallia Digital** - captures session feedback and interaction recordings

## Understanding the Scores

| Category | Score |
|----------|-------|
| Security | 35/100 |
| Privacy | 40/100 |
| Data Security | 55/100 |
| Network Security | 25/100 |
| Code Safety | 45/100 |
| Data Collection | 50/100 |
| Data Sharing | 30/100 |
| User Control | 20/100 |

## Positive Security Features

- No positive security practices were observed in this version.

## Areas for Improvement

- The app's network communication lacks consistent protection, putting personal and financial data at risk during transmission.
- Data is shared with a broad network of third-party advertising and analytics platforms, with very limited options to opt out.
- The app gives users almost no control over what information is gathered or how it is used across these platforms.

---

## About This Analysis

This scorecard is based on automated static analysis of the app's compiled code and observable behavior patterns. It reflects security and privacy practices identified at the time of the scan.

### App Details

| Field | Value |
|-------|-------|
| App Name | Seguros SURA |
| Package | co.com.sura.seguros |
| Version | 12.3.3 (Build 450) |
| Scan Date | 2026-02-12 |
| Platform | Android |