# Did not meet TRUSTED criteria This build did not satisfy all of CITT's published criteria for the TRUSTED mark. The full criteria and this app's results are shown below. ## Trust Pillars - **Secure by Design**: Not met. Did not meet one criterion in this area. - **Data Minimization**: Strong. Strong result in this area. - **Manifest Mismatch**: Not met. Did not meet one criterion in this area. - **User Control**: Strong. Strong result in this area. - **Truly Local**: Not applicable. Does not apply to this app. - **Child-Safe**: Not applicable. Does not apply to this app. --- # Security & Privacy Scorecard ## Wise: International Transfers ## What This Means for You Build 9.36.2 links a fraud-detection SDK configured to send device signals, including touch patterns and a persistent hardware identifier, to Sardine AI. An analytics integration may share a linked user identifier and payment-initiation details with Mixpanel; runtime behavior for both integrations was not observed. ## Recommendation: Trustworthy CITT rates this build Trustworthy (85/100). Authentication data is protected using hardware-backed encryption, and network connection integrity controls cover the app's primary domains. The build includes integrations for fraud detection, analytics, marketing, and crash reporting; completed financial transaction data was not observed flowing to advertising networks in this analysis. **Best For:** People who send and receive money internationally and want their completed transaction amounts and account balances kept within Wise's own infrastructure rather than shared with advertising networks. ## Method and Limitations Static analysis only. CITT reviewed the code of this build without running the app, so runtime behavior was not observed. The findings below describe the analyzed build and may not reflect server-side controls or later versions. CITT makes no determination about compliance with any law or platform policy; it reports what the artifacts contain and cites the published guidance so a reader can compare. ## Key Findings **Data Security:** 2 findings (2 low) **Network Security:** 1 finding (1 low) **Code Safety:** 2 findings (2 medium) **Privacy:** 5 findings (1 medium, 4 low) ## Privacy Concerns ### What Leaves the Device - Device signals (hardware identifier, touch patterns, network details, installed-app presence): the Sardine AI SDK in build 9.36.2 is configured to submit these to Sardine AI's servers; runtime delivery was not observed. - Payment flow details (source currency, target currency, payment amount at initiation): the Mixpanel integration appears configured to share these with Mixpanel's servers; runtime delivery was not observed. - User account identifier: appears to be shared with Mixpanel, linking behavioral events on Mixpanel's servers to a specific Wise account; runtime confirmation was not observed. - User account identifier: appears to be shared with Braze, routed to Braze's EU servers for push notification and in-app message targeting; runtime confirmation was not observed. - User profile reference: appears to be shared with Singular for attribution; runtime confirmation was not observed. ### What Stays on the Device - Biometric liveness data for identity verification: FaceTec processes this on the device; no biometric data was observed leaving the device in this analysis. - Completed transfer amounts, account balances, and beneficiary details: not observed flowing to advertising or marketing networks in this analysis. These remain within Wise's own infrastructure based on the analyzed build. ### Third-Party Data Sharing **Third parties that may receive data from the app:** - Sardine AI - fraud detection (device signals, touch patterns, hardware identifiers) - Mixpanel - analytics (user identifier, payment flow metadata) - Braze - marketing automation and push notifications (user identifier), EU-hosted - Singular - attribution (user profile reference) - Firebase Analytics - analytics - Firebase Crashlytics - crash reporting - Firebase Cloud Messaging - push notifications - Facebook SDK - present in build 9.36.2; specific runtime data flows not fully determined from static analysis - Sentry - error monitoring - Rollbar - crash and error reporting - Twilio Conversations - in-app messaging ## Understanding the Scores **Security:** 87/100 **Privacy:** 84/100 ### Security Breakdown - **Data Security:** 60/100. The primary authentication storage path uses hardware-backed encryption. The Sardine SDK in build 9.36.2 caches a device signal payload using a simple rotation cipher rather than a strong storage method, and a crash-reporting service access identifier is hardcoded in the build's resource files. - **Network Security:** 94/100. Build 9.36.2 implements HTTPS communication with signed connection integrity controls covering wise.com, transferwise.com, and wise.cn, backed by multiple digest configurations. This is a strong result for a financial services build. - **Code Safety:** 87/100. The build includes strong protective controls: screen recording detection, overlay attack protection configured for payment and PIN flows, full backup disablement, and biometric authentication bound to transaction signing operations. Two in-app web display components use runtime-determined JavaScript interface registration whose full scope cannot be enumerated from static analysis alone. ### Privacy Breakdown - **Data Collection:** 82/100. The fraud-detection SDK in build 9.36.2 is configured to collect a broad set of device signals, including a non-resettable hardware identifier and behavioral touch patterns. Payment flow analytics appear to share a linked user identifier with Mixpanel. Completed financial transaction data was not observed flowing to advertising or marketing networks. - **Data Sharing:** 82/100. Data appears to be shared with Sardine AI, Mixpanel, Braze, and Singular as described in the findings. No advertising SDK (such as Google AdMob or Meta Audience Network) was found in the build. SDK-level opt-out controls are present for Braze and Singular. - **User Control:** 86/100. Location access requires explicit user consent before any access and is limited to approximate location. Users can request data deletion per the developer's Play Store disclosure. SDK-level opt-out controls are wired in for marketing and attribution integrations. ## Positive Security Features - Authentication session data is protected by hardware-backed encryption in the primary storage path. - Transaction approval signing keys are generated inside the device's secure hardware store and bound to biometric authentication. - Network connection integrity controls cover the app's primary domains with multiple backup configurations. - Android backup is fully disabled, and data extraction rules exclude app data from cloud backup and device transfer. - Screen recording detection and overlay attack protection are configured for payment and PIN screens. - No advertising SDK (such as Google AdMob or Meta Audience Network) was found in build 9.36.2. - Completed financial transaction amounts and beneficiary details were not observed flowing to advertising networks in this analysis. - Biometric liveness processing for identity verification runs on the device; no biometric data was observed leaving the device. - Location access is limited to approximate location and requires explicit user consent before any access occurs. - SDK-level opt-out controls are present for Braze and Singular, not only interface-level toggles. ## Areas for Improvement ### Disclosure observations Observations about disclosure, each stated against the published guidance so a reader can compare: 1. **Sardine AI not named in the Wise privacy policy** The Wise privacy policy (wise.com/privacy-policy, retrieved August 2026) discloses third-party data sharing in general terms but does not name Sardine AI as a recipient. Build 9.36.2 links the Sardine MDI SDK version 1.2.57, which is configured to submit device signals, including a non-resettable hardware identifier, behavioral touch data, and VPN-detection results, to Sardine AI's servers. Google Play's Data Safety guidelines ask developers to name all third parties that receive user data. Whether the current policy satisfies that requirement is a matter for the reader to compare against the policy text and the Play Store guidelines; CITT makes no compliance determination. 2. **App inventory permission scope** Build 9.36.2 declares a broad installed-app visibility permission used by both the fraud-detection SDK and an internal integrity module. The same manifest already lists over 230 specific package names in targeted query blocks; the developer could evaluate whether those targeted blocks are sufficient for the fraud-detection use case, which would narrow the app's visibility into the installed-app list. ### Security Enhancements 1. **Strengthen Sardine cache storage protection** The Sardine SDK stores its device signal payload using a simple rotation cipher. Upgrading this to a strong storage method would reduce the exposure window on devices with elevated access privileges. 2. **Evaluate payment web display interface scope** The payment web display registers JavaScript interfaces through a runtime delegate pattern, making the full interface surface difficult to audit from static analysis alone. A compile-time registry of permitted interfaces would improve future auditability. ## Technical Context **App Type:** International money transfer and multi-currency financial services (Finance) **Classes Analyzed:** 38,744 **Third-Party Services:** 18 **Context Tags:** financial, sensitive_data, location --- ## About This Analysis This security analysis was conducted by CITT (Can I Trust That), an independent security analysis service. The analysis is static code review of Android applications, intended to help people make informed decisions about app security and privacy. ### App Details **Developer:** Wise Payments Ltd. **Version:** 9.36.2 (build 1622) **Analysis Date:** 2026-08-13 **Package:** com.transferwise.android ### Analysis Limitations - Static analysis only (code review without running the app) - Based on APK version 9.36.2 analyzed on 2026-08-13 - May not reflect server-side security controls - Cannot detect all runtime behaviors