# Security & Privacy Scorecard

## Cédula Digital Colombia

**Version:** 4.2.5 (Build 7080)
**Scan Date:** 2026-02-05
**Platform:** Android
**Package:** co.gov.registraduria.ceduladigital

## What This Means for You

Biometric data is processed through third-party identity verification software from multiple vendors. App usage behavior is tracked by Localytics, a behavioral analytics service, alongside crash and performance data sent to Google Firebase. Users have limited control over how their data is handled once it leaves the app.

## Recommendation: Use With Caution

**Best For:** Colombian residents who need an official digital ID
**Avoid If:** Uncomfortable with biometric data sent to multiple vendors

## Key Findings

**Data Security** - 6 findings (2 critical, 2 high, 2 medium)

**Network Security** - 1 finding (1 medium)

**Code Safety** - 0 findings

**Privacy** - 6 findings (2 critical, 4 high)

## Privacy Concerns

### What Data is Collected

Biometric information, including facial scans and document images, is captured and forwarded to multiple external identity verification services. In-app behavior, such as which screens are visited and how frequently the app is used, is collected by Localytics. Crash reports and performance data are automatically sent to Google Firebase whenever the app encounters an error or slowdown.

### Third-Party Data Sharing

User data is shared with multiple external parties:

- **Localytics (Upland Software):** Receives behavioral and usage data to analyze how users interact with the app.
- **Google Firebase (Crashlytics and Performance Monitoring):** Receives crash reports and performance metrics from the device.
- **IDEMIA Mobile ID SDK and Morpho Biometric SDK:** Process biometric data as part of identity verification.
- **Microblink:** Processes images of identity documents during scanning.
- **Google Play Services:** Receives standard device and usage signals.

## Understanding the Scores

| Category | Score |
|---|---|
| Security | 35/100 |
| Privacy | 30/100 |
| Data Security | 30/100 |
| Network Security | 85/100 |
| Code Safety | 45/100 |
| Data Collection | 40/100 |
| Data Sharing | 25/100 |
| User Control | 30/100 |

## Positive Security Features

No notable security practices were identified in this version of the app that provide meaningful user-facing protections.

## Areas for Improvement

- Biometric and behavioral data flows to several external vendors with no in-app controls allowing users to limit or withdraw from that sharing.
- There is no visible way for users to review, delete, or restrict personal data already transmitted to third-party analytics and biometric processing services.
- The Data Sharing score of 25/100 reflects that personal information reaches multiple outside parties, with limited transparency about how long it is retained or for what purposes it may be reused.

---

## About This Analysis

Scores and findings in this report are based on technical analysis of the app version listed above. This scorecard helps users make an informed decision about whether to use this app.

### App Details

| Field | Value |
|---|---|
| App Name | Cédula Digital Colombia |
| Package ID | co.gov.registraduria.ceduladigital |
| Version | 4.2.5 (Build 7080) |
| Scan Date | 2026-02-05 |
| Platform | Android |