# Did not meet TRUSTED criteria This build did not satisfy all of CITT's published criteria for the TRUSTED mark. The full criteria and this app's results are shown below. ## Trust Pillars - **Secure by Design**: Strong. Strong result in this area. - **Data Minimization**: Not met. Did not meet one criterion in this area. - **Manifest Mismatch**: Not met. Did not meet one criterion in this area. - **User Control**: Strong. Strong result in this area. - **Truly Local**: Not applicable. Does not apply to this app. - **Child-Safe**: Not applicable. Does not apply to this app. --- # Security & Privacy Scorecard ## Revolut Business ## What This Means for You Business account identity is linked to AppsFlyer's advertising attribution platform, and usage analytics are shared with Google's Firebase services. Financial data and authentication session data remain encrypted on the device. ## Recommendation: Very Secure CITT assesses this build as very secure for business banking. Network connections to Revolut's servers are protected against interception, financial databases are encrypted on the device, authentication session data is stored in hardware-backed secure storage with biometric binding, and authorization data is restricted to Revolut-owned domains. **Best For:** Business professionals who use Revolut's integrated banking, payment processing, invoicing, and card management tools for day-to-day operations. ## Method and Limitations Static analysis only. CITT reviewed the code of this build without running the app, so runtime behavior was not observed. The findings below describe the analyzed build and may not reflect server-side controls or later versions. CITT makes no determination about compliance with any law or platform policy; it reports what the artifacts contain and cites the published guidance so a reader can compare. ## Key Findings **Data Security:** 0 findings **Network Security:** 2 findings (2 low) **Code Safety:** 5 findings (5 low) **Privacy:** 0 findings ## Privacy Concerns ### What Leaves the Device - Business account identity: linked to AppsFlyer's advertising attribution platform for attribution and behavioral analytics purposes - Advertising identifier: included in internal analytics events shared with analytics and attribution services - Usage analytics, performance data, and crash reports: shared with Firebase Analytics, Firebase Performance, and Firebase Crashlytics - Device system properties (device model, operating system version, hardware configuration details): may be returned to hCaptcha's servers during bot detection validation, as the build's code is designed to support; runtime behavior was not observed - Identity verification information: submitted to Onfido for KYC and identity verification - Navigation link attribution data: shared with Branch.io - Device fraud detection signals: submitted to Revolut's own servers via the SEON fraud detection SDK during onboarding (not shared with the SEON vendor directly) ### What Stays on the Device - Encrypted financial database content: stored in encrypted databases on the device and not shared with advertising or third-party analytics services - Authentication session data and cryptographic keys: stored in hardware-backed secure storage; the underlying key material is designed to remain within the secure hardware ### Third-Party Data Sharing **Third parties that may receive data from the app:** - AppsFlyer - advertising attribution and behavioral analytics - Firebase Analytics (Google) - usage analytics - Firebase Crashlytics (Google) - crash reporting - Firebase Performance (Google) - performance monitoring - Firebase Messaging (Google) - push notification delivery - Firebase App Check (Google) - app integrity verification - Firebase Remote Config (Google) - remote feature configuration - hCaptcha - bot detection and fraud prevention - Google Ad Manager (Google) - advertising - Google Play Integrity (Google) - device integrity verification - Onfido - identity verification and KYC - Google ML Kit (Google) - document and biometric processing - Branch.io - navigation link attribution - MeshConnect Link - financial account connectivity - Google Pay / Tap and Pay (Google) - payment processing - youTransactor uCube - card reader operations ## Understanding the Scores **Security:** 93/100 **Privacy:** 88/100 ### Security Breakdown - **Data Security:** 93/100. Financial databases are encrypted on the device and authentication session data is stored in hardware-backed secure storage with biometric binding. - **Network Security:** 95/100. Network connections to Revolut's servers are protected against interception and all unencrypted traffic is blocked globally with no exceptions. - **Code Safety:** 91/100. The build includes commercial code protection with emulator, tamper, and unofficial-install detection alongside layered device integrity checks. ### Privacy Breakdown - **Data Collection:** 89/100. Standard usage analytics, crash reports, and device identifiers are shared with analytics and attribution services; financial transaction data stays on the device or is processed via Revolut's own servers. - **Data Sharing:** 88/100. Authorization data is scoped to Revolut-owned domains by design and is not included in requests to third-party analytics or attribution services, though business account identity is linked to AppsFlyer's attribution platform. - **User Control:** 89/100. Automatic device backup is disabled, preventing banking data from reaching Google cloud storage, and fraud detection signals are routed through Revolut's own servers rather than to the fraud detection vendor directly. ## Positive Security Features - Network connections to Revolut's servers are protected against interception, including when a device trusts a rogue certificate authority. - All unencrypted network traffic is blocked globally with no exceptions. - In-app browser views cancel loading when connection errors occur rather than proceeding past them. - Authentication session data is stored in hardware-backed secure storage with biometric binding. - All financial databases are encrypted on the device. - Cryptographic keys are stored in hardware-backed secure storage with biometric binding and dedicated security chip support. - Authorization data is scoped to Revolut-owned domains by design and is not included in requests to third-party analytics or attribution services. - Automatic device backup is disabled, preventing banking data from reaching Google cloud storage. - The build includes commercial code protection with emulator, tamper, and unofficial-install detection. - A layered device integrity check identifies compromised device states including unlocked bootloaders and modified firmware. - The SEON fraud detection SDK is integrated such that device fingerprint data is routed to Revolut's own servers rather than to the vendor's servers directly. ## Areas for Improvement ### Disclosure observations Observations about disclosure, each stated against the published guidance so a reader can compare: 1. **Business account identity linked to advertising attribution** The build links a verified business account identifier to AppsFlyer's attribution platform. AppsFlyer's [Privacy for Advertisers documentation](https://dev.appsflyer.com/hc/docs/privacy-overview) describes data minimization options including limiting the fields associated with a user profile; whether this association was disclosed in the privacy notice in effect for this build could not be determined from the binary. 2. **Advertising identifier in business banking analytics** The build includes an advertising identifier in internal analytics events. Google's [Advertising ID policy](https://support.google.com/googleplay/android-developer/answer/6048248) permits use of this identifier for analytics purposes; whether its inclusion in analytics events from a business banking account is disclosed in the privacy notice for account holders could not be determined from the binary. 3. **Scope of fraud detection signals during onboarding** The SEON fraud detection SDK gathers hardware-persistent device identifiers, the list of accessibility apps installed on the device, clipboard data, and the connected Wi-Fi network name during KYC onboarding. These signals are routed to Revolut's own servers. Whether the full scope of these signals is disclosed to users at the point of collection could not be determined from the binary. ### Security Enhancements 1. **Screen capture protection controlled by remote configuration** The build registers Firebase Remote Config flags that can disable screen capture protection for banking screens. Migrating this control to a client-side-only mechanism would eliminate the dependency on third-party infrastructure availability for this security feature. 2. **Custom navigation scheme without link verification** The build registers `revolut-business://` as a navigation link handler without the verification mechanism used for HTTPS links. Any other app installed on the device may register the same scheme and intercept link requests intended for Revolut Business; migrating internal navigation to verified HTTPS links would address this. 3. **Staging-environment link domains in the production build** The build registers Branch.io staging-environment domains (`revolut-business.test-app.link` and `revolut-business-alternate.test-app.link`) as verified link handlers in the production release. Links from Branch.io's staging infrastructure may invoke live production banking flows; removing these staging-environment entries from the production build would address this. 4. **Alpha-stage HTTP library in a production financial app** `assets/libraries.json` lists an alpha-stage release of the Fuel HTTP library (`3.0.0-alpha04`) as a production runtime dependency. Alpha software carries no defined security response policy, making patch timelines unpredictable. Payment card industry guidance (PCI DSS section 6.3.3) recommends that all components be maintained free from known security gaps; migrating to the stable 2.x release series would align with this guidance. 5. **Payment card protocol traces in production log files** `assets/logback.xml` configures the card reader logger at DEBUG level, routing payment card protocol traces to rolling log files stored on the device. Reducing the log level to WARN or INFO in the production build, and auditing on-device log content against payment card industry log management guidance, would limit the protocol data available to an attacker with physical access to the device. ## Technical Context **App Type:** Business banking and payment processing, high-sensitivity financial application **Classes Analyzed:** 92,591 **Third-Party Services:** 21 **Context Tags:** financial, business, sensitive_data, analytics, biometric, kyc --- ## About This Analysis This security analysis was conducted by CITT (Can I Trust That), an independent security analysis service. The analysis is static code review of Android applications, intended to help people make informed decisions about app security and privacy. ### App Details **Developer:** Revolut Ltd **Version:** 6.3.1 (versionCode: 616003111) **Analysis Date:** 2026-08-13 **Package:** com.revolut.business ### Analysis Limitations - Static analysis only (code review without running the app) - Based on APK version 6.3.1 analyzed on 2026-08-13 - May not reflect server-side security controls - Cannot detect all runtime behaviors