# Security & Privacy Scorecard

## Kiwi Crédito

**Version:** 1.9.0 (Build 131) | **Scan Date:** February 6, 2026

## What This Means for You

Identity and financial details are handled by this app, and data security findings indicate that user information may not be fully protected in storage. Google services collect usage data about how users interact with the app. Identity verification is handled through a third-party provider that sees users' personal documents.

## Recommendation: Use With Caution

**Best For:** Credit seekers comfortable with Google analytics

## Key Findings

**Data Security** - 3 findings (1 critical, 2 high)

**Network Security** - 3 findings (2 medium, 1 low)

**Code Safety** - 0 findings

**Privacy** - 3 findings (1 high, 1 medium, 1 low)

## Privacy Concerns

### What Data is Collected

Kiwi Crédito collects personal and financial information to process credit applications, including identity documents uploaded for verification. Google services embedded in the app track how users navigate and interact with it, including which screens are visited and actions taken.

### Third-Party Data Sharing

User data is handled by several third-party providers:

- **Persona SDK** - Processes users' identity documents and personal details for identity verification
- **Google Play Services** - Provides platform features and collects usage information tied to the device
- **Google Data Transport** - Routes analytics data from the device to Google's infrastructure
- **Google ML Kit** - Supports on-device processing tasks within the app

## Understanding the Scores

| Category | Score |
|---|---|
| Security | 55/100 |
| Privacy | 62/100 |
| Data Security | 45/100 |
| Network Security | 82/100 |
| Code Safety | 85/100 |
| Data Collection | 70/100 |
| Data Sharing | 75/100 |
| User Control | 65/100 |

## Positive Security Features

- Network communications use secure transport protocols, reflected in the above-average network security score

## Areas for Improvement

- The way personal and financial information is stored on the device needs strengthening, so user data stays protected if the phone is lost or accessed by someone else
- Controls over what data the app collects and keeps are limited, giving users less ability to manage their own information
- The handling of identity documents involves a third-party provider, and the protections around how those documents are transmitted and retained could be more transparent

---

## About This Analysis

This scorecard is based on automated static analysis of the app's code and configuration. Scores reflect observed security and privacy practices at the time of the scan.

### App Details

- **App Name:** Kiwi Crédito
- **Package ID:** com.kiwwi.android
- **Version:** 1.9.0 (Build 131)
- **Scan Date:** February 6, 2026
- **Platform:** Android