# Security & Privacy Scorecard

## Culture Cloud

**Security Score: 45/100 | Privacy Score: 55/100**

## What This Means for You

In-app behavior is recorded by FullStory, which can capture screen interactions and session replays. User activity is also tracked by Firebase and Google Analytics. Some data protections fall short of expectations, meaning sensitive information submitted may not be fully protected.

## Recommendation: Use With Caution

**Best For:** Employees required to use it for workplace recognition
**Avoid If:** You prefer work apps that don't record your screen activity

## Key Findings

**Data Security** - 4 findings (2 critical, 2 high)

**Network Security** - 1 finding (1 high)

**Code Safety** - 0 findings

**Privacy** - 2 findings (2 medium)

## Privacy Concerns

### What Data is Collected

Culture Cloud collects behavioral and interaction data throughout user sessions. FullStory captures screen activity and session replays of in-app behavior. Firebase and Google Analytics collect usage patterns, device information, and engagement data. The Embrace SDK gathers performance and stability information from the device.

### Third-Party Data Sharing

User data is shared with the following external services:

- **FullStory** - Screen and session recording
- **Firebase Analytics** - Usage and behavioral analytics
- **Google Analytics** - Engagement and activity tracking
- **Embrace SDK** - App performance monitoring
- **Tenor GIF API** - GIF content delivery
- **Pluto** - In-app diagnostic tooling
- **Stetho** - In-app diagnostic tooling

## Understanding the Scores

| Category | Score |
|----------|-------|
| Security | 45/100 |
| Privacy | 55/100 |
| Data Security | 35/100 |
| Network Security | 65/100 |
| Code Safety | 50/100 |
| Data Collection | 60/100 |
| Data Sharing | 70/100 |
| User Control | 50/100 |

## Positive Security Features

- No positive security features were identified in this version of the app.

## Areas for Improvement

- Sensitive data entered in the app may not be stored with adequate protections, putting personal and workplace information at risk.
- Session activity is recorded by third-party services without clear in-app notice, limiting user awareness and control over what is captured.
- Some communications between the app and its servers lack adequate protection, and data may travel with less protection than expected.

---

## About This Analysis

This scorecard is based on static analysis of the app's code and configuration. Results reflect the state of the app at the time of the scan.

### App Details

- **App:** Culture Cloud
- **Package ID:** com.octanner.android.culturecloud
- **Version:** 1.26.1 (Build 1117)
- **Scan Date:** 2026-02-08
- **Platform:** Android