# Security & Privacy Scorecard

## Aviva Journey

**Version:** 4.6.0 (Build 329)
**Scan Date:** 2026-02-02

## What This Means for You

Driving behaviour, trips, and diagnostic data are collected and shared with telematics and analytics services. Firebase and Mapbox receive usage and location telemetry. User data is used to assess how they drive, which may affect their insurance.

## Recommendation: Acceptable

**Best For:** Aviva customers comfortable with driving telemetry
**Avoid If:** You prefer not to share driving behaviour data

## Key Findings

**Data Security** - 4 findings (2 critical, 1 high, 1 medium)

**Network Security** - 2 findings (1 medium, 1 low)

**Code Safety** - 0 findings

**Privacy** - 4 findings (1 high, 2 medium, 1 info)

## Privacy Concerns

### What Data is Collected

- Driving behaviour and trip records, including routes, speed, and driving patterns
- Vehicle diagnostic data collected via OBD-II connection
- Device location and movement throughout journeys
- App usage and performance telemetry
- Device identifiers

### Third-Party Data Sharing

User data is shared with the following services:

- **Firebase (Google):** Analytics, performance monitoring, crash reporting, and identity services
- **IMS:** Trip detection and diagnostic telemetry for driving behaviour scoring
- **Mapbox:** Map rendering and location telemetry
- **Google:** Awareness and app integrity services
- **DriveSync:** OBD-II vehicle diagnostic data collection

## Understanding the Scores

| Category | Score |
|---|---|
| Security | 78/100 |
| Privacy | 70/100 |
| Data Security | 65/100 |
| Network Security | 92/100 |
| Code Safety | 85/100 |
| Data Collection | 75/100 |
| Data Sharing | 88/100 |
| User Control | 82/100 |

## Positive Security Features

- No specific positive security practices were identified in this version of the app.

## Areas for Improvement

- The app could be clearer about how driving behaviour is scored and how those scores affect insurance premiums.
- Some data is stored on the device in a way that other apps could potentially read if the device is not adequately protected.
- Providing clearer in-app controls, including the ability to review or request deletion of driving history, would give users greater confidence in managing their data.

---

## About This Analysis

This scorecard reflects the security and privacy practices observed in the app at the time of the scan. Scores are based on static analysis of the app's code and configuration.

### App Details

- **App:** Aviva Journey
- **Package ID:** com.aviva.avivajourney
- **Version:** 4.6.0 (Build 329)
- **Platform:** Android
- **Scan Date:** 2026-02-02