# Did not meet TRUSTED criteria This build did not satisfy all of CITT's published criteria for the TRUSTED mark. The full criteria and this app's results are shown below. ## Trust Pillars - **Secure by Design**: Not met. Did not meet one criterion in this area. - **Data Minimization**: Not met. Did not meet one criterion in this area. - **Manifest Mismatch**: Critical issue. Has a high-severity open item in this area, detailed below. - **User Control**: Strong. Strong result in this area. - **Truly Local**: Not applicable. Does not apply to this app. - **Child-Safe**: Not applicable. Does not apply to this app. --- # Security & Privacy Scorecard ## Davivienda ## What This Means for You Build 8.1.1 links behavioral analytics, fraud-detection, and marketing SDKs that may share device identifiers, interaction patterns, and motion sensor data with US-based third-party vendors, while the Play Store privacy label for this build declared no data collected. ## Recommendation: Use With Caution The build's overall score of 69 places it in the Use With Caution band for a banking application. The binary links a networking library that includes a configuration path, reachable from JavaScript code, to disable server certificate checks; whether this path is triggered at runtime was not tested from static analysis alone. The Play Store privacy label for this build declared no data collected while the binary links four SDKs initialized with outbound server connections. **Best For:** Davivienda bank customers who need mobile access to accounts, transfers, bill payments, and Colombia's national payment network. ## Method and Limitations Static analysis only. CITT reviewed the code of this build without running the app, so runtime behavior was not observed. The findings below describe the analyzed build and may not reflect server-side controls or later versions. CITT makes no determination about compliance with any law or platform policy; it reports what the artifacts contain and cites the published guidance so a reader can compare. ## Key Findings **Data Security:** 1 finding (1 high) **Network Security:** 2 findings (1 high, 1 medium) **Code Safety:** 8 findings (2 high, 2 medium, 4 low) **Privacy:** 3 findings (1 high, 2 medium) ## Privacy Concerns ### What Leaves the Device - Device identifiers and app-install attribution data: may be shared with AppsFlyer, based on SDK initialization code linking to AppsFlyer's servers. - Session data, device identifiers, and push notification registrations: may be shared with Braze to US-based servers, based on the Braze SDK present in the binary. - Screen interaction events and network performance data: may be shared with Dynatrace, based on the Dynatrace SDK present in the build. - Touch patterns, motion sensor readings, device fingerprint, and behavioral signals: may be shared with BioCatch for fraud detection, based on BioCatch SDK initialization code; the data scope captured by BioCatch is partly determined by server configuration and was not fully determinable from the binary alone. ### What Stays on the Device Firebase Analytics and Firebase Crashlytics are initialized with data collection disabled in the manifest for this build. Data that would otherwise flow to those services is not transmitted while this configuration is in effect; whether runtime code re-enables collection was not tested from static analysis. ### Third-Party Data Sharing **Third parties that may receive data from the app:** - AppsFlyer - marketing attribution and install analytics - Braze - user engagement, in-app messaging, and push notification management - BioCatch - behavioral fraud detection using touch, motion, and device signals - Dynatrace - application performance and interaction monitoring - Sentry - error and crash reporting - Firebase Analytics - collection disabled at app launch in this build - Firebase Crashlytics - collection disabled at app launch in this build - Google Pay (TapAndPay) - NFC payment processing - FaceTec - biometric face scanning for identity verification - Incode - document and identity verification - Transmit Security - identity risk assessment - Cleafy - mobile fraud detection ## Understanding the Scores **Security:** 70/100 **Privacy:** 68/100 ### Security Breakdown - **Data Security:** 72/100. Most storage paths in this build use Android's system-backed secure storage. One custom storage component derives its encryption key using a fixed salt value embedded in the binary, which reduces the protection that component provides; the rest of the storage implementation uses stronger mechanisms. - **Network Security:** 76/100. Primary banking traffic to Davivienda's own domain uses HTTPS with no cleartext exception, and NFC payment traffic includes additional bundled server verification. A third-party networking library in the build ships a configuration path to disable server certificate checks, which may be reachable from JavaScript; whether this path is triggered at runtime was not tested. A payment-processor integration also permits unencrypted connections to two payment-gateway domains. - **Code Safety:** 76/100. Backup extraction is blocked, production debugging is disabled, and the build is configured for release use. Two payment-related components are declared publicly reachable in the manifest without requiring authorization from calling apps, meaning other device-resident apps could send messages to those components. Several additional configuration items, including broad file-sharing scope and a wildcard origin policy on the in-app browser messaging bridge, could be tightened to further reduce the potential attack surface. ### Privacy Breakdown - **Data Collection:** 68/100. Four third-party SDKs are initialized with outbound data connections in the binary while the Play Store privacy label for this build declared no data collected. BioCatch's data scope, which includes touch events, motion sensor readings, and device fingerprint signals, is partly determined by server configuration at runtime. - **Data Sharing:** 74/100. Financial transaction data is directed to Davivienda's own infrastructure over HTTPS. Third-party data sharing is primarily to analytics, engagement, and fraud-detection vendors, with payment processing handled through Google Pay's infrastructure. - **User Control:** 68/100. Firebase Analytics is disabled at app launch, preserving some control over that data flow. The behavioral fraud-detection scope managed by BioCatch is partly server-configured, which limits local visibility into what is captured during a session. The Play Store listing states that data deletion requests are supported. ## Positive Security Features - ADB backup and cloud backup are disabled in the manifest, preventing app data extraction through standard Android backup mechanisms - Security-sensitive storage in the banking SDK and identity-verification SDK paths uses Android system-backed encrypted storage - Primary banking domain traffic uses HTTPS with no cleartext exception configured - Debugging tools and in-app browser debugging are disabled for production use - NFC payment traffic is restricted to connections verified against a bundled list of approved server certificates - Firebase Analytics and Firebase Crashlytics are disabled at app launch per the manifest configuration ## Areas for Improvement ### Disclosure observations Observations about disclosure, each stated against the published guidance so a reader can compare: 1. **Play Store Data Safety label and linked SDKs** Google Play's Data Safety policy (support.google.com/googleplay) requires developers to disclose data types shared with third parties. The Data Safety label retrieved on 2026-08-11 for this build declared "No data collected" while simultaneously stating "This app may share these data types with third parties: Location, Personal info, and Device or other IDs." The binary links AppsFlyer, Braze, Dynatrace, and BioCatch, all initialized with outbound server connections. Whether runtime controls prevent off-device data flows was not testable from static analysis alone. Aligning the label with the SDKs present in the binary would resolve the internal contradiction. 2. **BioCatch behavioral data scope and user disclosure** The BioCatch SDK bundled in this build lists touch events, motion sensor readings, device fingerprint, clipboard access, installed-app enumeration, and location among configurable collection fields. The scope in use at runtime is determined from BioCatch's servers and was not observable from the binary alone. Neither the Play Store Data Safety label nor a visible in-app disclosure references behavioral biometric or device fingerprint data. ### Security Enhancements 1. **Networking library certificate-check configuration** The RNFetchBlob library ships a configuration option that, when set from JavaScript, replaces server certificate checking with a handler that accepts certificates and server names without verification. For a banking application, auditing whether JavaScript code ever sets this option would confirm the protection level applied to connections made through that library. 2. **Custom encryption key derivation** A custom storage component derives its encryption key using a salt value embedded in the binary, which is the same across all installations of this build. Replacing the fixed salt with a randomly generated per-installation value would restore the full strength intended by the key-derivation step. 3. **Public payment component access controls** Two components that handle payment-related messages from other apps are declared publicly reachable in the manifest without restricting which apps can send those messages. Adding Android permission requirements to these components would prevent unauthorized apps on the same device from interacting with the payment flow. ## Technical Context **App Type:** Mobile banking - high sensitivity financial application **Classes Analyzed:** 1,400 **Third-Party Services:** 27 services identified **Context Tags:** financial, sensitive_data, biometric, ads --- ## About This Analysis This security analysis was conducted by CITT (Can I Trust That), an independent security analysis service. The analysis is static code review of Android applications, intended to help people make informed decisions about app security and privacy. ### App Details **Developer:** BANCO DAVIVIENDA S.A. **Version:** 8.1.1 (versionCode 8100) **Analysis Date:** 2026-08-13 **Package:** com.davivienda.daviviendaapp ### Analysis Limitations - Static analysis only (code review without running the app) - Based on APK version 8.1.1 analyzed on 2026-08-13 - May not reflect server-side security controls - Cannot detect all runtime behaviors