# Did not meet TRUSTED criteria This build did not satisfy all of CITT's published criteria for the TRUSTED mark. The full criteria and this app's results are shown below. ## Trust Pillars - **Secure by Design**: Under review. This area was not fully assessed in this version. - **Data Minimization**: Strong. Strong result in this area. - **Manifest Mismatch**: Critical issue. Has a high-severity open item in this area, detailed below. - **User Control**: Strong. Strong result in this area. - **Truly Local**: Not applicable. Does not apply to this app. - **Child-Safe**: Not applicable. Does not apply to this app. --- # Security & Privacy Scorecard ## Revolut: Spend, Save, Trade ## What This Means for You Build 10.142 routes financial transaction data exclusively to Revolut's own servers and gates analytics sharing on user consent; device signals including the installed-app list may flow to SEON, a third-party fraud detection vendor, and identity and document data is shared with multiple verification services during account onboarding. ## Recommendation: Trustworthy CITT assesses this app Trustworthy (82/100). Build 10.142 implements hardware-backed encryption for financial data, anchors all API connections to Revolut's server certificates, and globally blocks unencrypted network traffic. **Best For:** People who want a full-featured neobank for spending, sending, saving, and investing across global markets. ## Method and Limitations Static analysis only. CITT reviewed the code of this build without running the app, so runtime behavior was not observed. The findings below describe the analyzed build and may not reflect server-side controls or later versions. CITT makes no determination about compliance with any law or platform policy; it reports what the artifacts contain and cites the published guidance so a reader can compare. ## Key Findings **Data Security:** 3 findings (1 medium, 2 low) **Network Security:** 1 finding (1 medium) **Code Safety:** 5 findings (2 medium, 3 low) **Privacy:** 3 findings (3 medium) ## Privacy Concerns ### What Leaves the Device - Identity and document data: shared with identity verification vendors (Onfido, Incode, Fourthline/ORCA, Trustdock, Authada, ItrustEkyc) during account verification - Device signals and installed-app list: may be shared with SEON (fraud detection vendor) on each app session - Analytics and attribution signals: sent to Firebase Analytics and AppsFlyer; data does not flow before the user provides consent - Financial transaction data: sent to Revolut's own servers for account and payment processing ### What Stays on the Device No sensitive data was identified as processed exclusively on the device in this analysis. ### Third-Party Data Sharing **Third parties that may receive data from the app:** - SEON - fraud detection and device fingerprinting - Onfido - identity document verification - Incode - identity verification - Fourthline/ORCA - identity verification - Trustdock - identity verification - Authada - identity verification - ItrustEkyc - identity verification - AppsFlyer - marketing attribution - Firebase Analytics - product analytics - Firebase Crashlytics - crash reporting - Firebase Cloud Messaging - push notifications - Firebase Installations - device identifier management - Google Maps - mapping and location features - Google Pay/Wallet - payment processing - Google Play Billing - in-app purchases - MeshConnect/Plaid - open banking data connections - Kontomatik - open banking sign-in - Rollee - income data verification - YouTransactor - card reader payment processing - Twilio Voice - in-app voice calls - hCaptcha - bot protection - Google Nearby Messages - proximity communication features - Google Play Services Integrity - app integrity verification ## Understanding the Scores **Security:** 82/100 **Privacy:** 83/100 ### Security Breakdown - **Data Security:** 70/100. The build uses hardware-backed encryption for financial data and blocks all unencrypted network connections globally. A database integrity configuration setting and receipt image storage location reduce the score from a higher band. - **Network Security:** 93/100. All API connections to Revolut's servers are protected with strong encryption and the build globally blocks unencrypted connections. - **Code Safety:** 82/100. All 13 native libraries in the build passed analysis without identified memory safety issues. Several embedded web components include file access settings that are not required for their functions. ### Privacy Breakdown - **Data Collection:** 82/100. Analytics and attribution data flows are consent-gated, with all tracking signals off by default. The installed-app list is scanned on each app session for fraud detection purposes. - **Data Sharing:** 80/100. Financial transaction data flows only to Revolut's own servers. Multiple identity verification vendors and a fraud detection vendor receive identity data and device signals. - **User Control:** 87/100. The build includes a data deletion mechanism and consent management for analytics. All account and session data is fully cleared from storage on logout. ## Positive Security Features - All network connections use encryption; the build configuration globally blocks unencrypted connections - API connections to Revolut's servers are anchored to known server certificates, blocking interception on untrusted networks - Financial data is protected using hardware-backed encryption via the device's secure hardware - Cloud backup is disabled across the app, preventing backup-based extraction of account data and locally stored information - Firebase Analytics and AppsFlyer tracking signals are disabled by default; no analytics data flows until the user grants consent - All account and session data is fully cleared from storage on logout - The build includes anti-tampering protections that detect modified device environments, screen capture tools, and remote access applications - All 13 native libraries analyzed without identified memory safety or cryptographic issues - Financial transaction data flows only to Revolut's own infrastructure; no advertising networks or data brokers receive financial data - API request and response bodies are not written to logs in the production build ## Areas for Improvement ### Disclosure observations Observations about disclosure, each stated against the published guidance so a reader can compare: 1. **Third-party data sharing disclosure** The Play Store Data Safety label (as retrieved 2026-08-11) declares "No data shared with third parties." Build 10.142 links the SEON fraud detection SDK; SEON's published documentation describes its data collection scope as including device hardware fingerprint, installed-app list, network characteristics, SIM data, and behavioral signals transmitted to SEON's servers. Whether SEON processes this data solely as a service provider under Revolut's direction or also as an independent data controller could not be determined from the binary alone. Readers may wish to review Revolut's privacy policy for clarification on this relationship. 2. **Installed-app list disclosure** The Data Safety label does not list "Installed apps" as a collected data type. Build 10.142 uses a permission granting access to all installed applications and performs a full device package scan on each app foreground. What portion of this scan result is transmitted off the device could not be determined from static analysis alone. ### Security Enhancements 1. **Database integrity configuration** Build 10.142 includes a configuration that disables per-page integrity checking on encrypted databases. Enabling this check would provide an additional layer of protection against undetected modification of stored financial records. 2. **Receipt image storage** Transaction receipt images are written to a shared storage location accessible via file management apps on older Android versions. Storing these images in the app's private directory would limit access to the app itself. 3. **Web component file access** Several embedded web components have file system access enabled where it is not functionally required. Restricting file access to only components that load local content would reduce the surface area of the embedded web functionality. 4. **Payment link routing** The manifest registers both encrypted and unencrypted URL schemes for payment-related domains. Using only the encrypted scheme would strengthen Android's guarantee that incoming payment links originate from the correct source. ## Technical Context **App Type:** Finance - full-service neobanking, payments, savings, and investment **Classes Analyzed:** 257,401 **Third-Party Services:** 26 **Context Tags:** financial, sensitive_data, location, camera --- ## About This Analysis This security analysis was conducted by CITT (Can I Trust That), an independent security analysis service. The analysis is static code review of Android applications, intended to help people make informed decisions about app security and privacy. ### App Details **Developer:** Revolut Ltd **Version:** 10.142 (Build 1030142101) **Analysis Date:** 2026-08-13 **Package:** com.revolut.revolut ### Analysis Limitations - Static analysis only (code review without running the app) - Based on APK version 10.142 analyzed on 2026-08-13 - May not reflect server-side security controls - Cannot detect all runtime behaviors