# Security & Privacy Scorecard

## George Česko

## What This Means for You

Your financial data and account access are protected by multiple strong security layers built by Česká spořitelna, while performance telemetry about your app usage is sent to Dynatrace, a US-based third-party monitoring service.

## Recommendation: Trustworthy

Trusted financial app from major Czech bank Česká spořitelna, featuring strong security systems and fraud detection. A reliable choice for comprehensive financial management, with a few areas in its security implementation and third-party data disclosures that could be strengthened.

**Best For:** Czech bank customers who need a full-featured banking app and trust Česká spořitelna's security infrastructure

## Key Findings

**Data Security** - 2 findings (1 high, 1 medium)

**Network Security** - 1 finding (1 medium)

**Code Safety** - 2 findings (1 medium, 1 info)

**Privacy** - 4 findings (3 low, 1 info)

## Privacy Concerns

### What Data is Collected

- Account and transaction data: shared with Česká spořitelna servers to operate the banking service
- Location data: accessed on your device for the TravelHub travel insurance geofencing feature; the server destination for geofence trigger events could not be confirmed
- Contact information: accessed on your device for payment and contact features
- App performance and usage telemetry: sent to Dynatrace LLC, a US-based monitoring service
- Behavioral analytics: may be sent to PostHog via the bank's own proxy servers (whether data ultimately reaches PostHog's US-based service could not be confirmed)
- Device identifiers: accessed on your device; sensitive identifiers are intentionally set to neutral values

### Third-Party Data Sharing

**The following third parties may receive your data:**
- Dynatrace LLC - Application performance monitoring and usage telemetry
- Sentry - Crash and error reporting
- ThreatMark - Behavioral fraud detection
- GetStream - In-app chat messaging
- Firebase (Google) - Push notification delivery (analytics disabled)
- Azure Communication Services (Microsoft) - Video and audio advisor calls
- Google Maps - Branch and ATM location services
- Google Pay / Google Wallet - Digital payment processing
- Huawei HMS - Push notifications for Huawei devices
- PostHog - Behavioral analytics, routed via bank proxy (whether data reaches PostHog's own servers is unconfirmed)

## Understanding the Scores

**Security:** 79/100
**Privacy:** 93/100

### Security Breakdown

- **Data Security:** 75/100 - The app's internal key storage has weaknesses in how primary encryption keys are generated and initialized, posing a limited theoretical risk on compromised devices.
- **Network Security:** 93/100 - All connections are encrypted and no unencrypted traffic is permitted in production.
- **Code Safety:** 94/100 - The app applies aggressive code hardening and contains no embedded private key material in the distributed binary.

### Privacy Breakdown

- **Data Collection:** 95/100 - Data collection is focused on banking operations, with Firebase analytics explicitly disabled.
- **Data Sharing:** 94/100 - Third-party data sharing is limited to identifiable service providers with defined purposes.
- **User Control:** 99/100 - Excellent user controls over account settings, card management, and data deletion.

## Positive Security Features

- All network connections are encrypted and no unencrypted traffic is permitted
- Security-sensitive data is stored using your device's dedicated security hardware when available, verified at runtime
- App data is excluded from cloud backups, preventing exposure through backup services
- Active fraud and behavioral threat detection through specialized security systems
- Firebase analytics is explicitly disabled; Firebase is used only for push notifications
- One-time password storage is secured with its own encryption layer
- The distributed app binary contains no embedded private key material
- Aggressive code obfuscation is applied throughout the application

## Areas for Improvement

### GDPR / CCPA Compliance

The app's privacy practices could be strengthened by:

1. **Dynatrace Telemetry Disclosure**
   The Play Store Data Safety section states "No data shared with third parties," but app performance telemetry and potentially a pseudonymous session identifier are sent to Dynatrace LLC. Updating this disclosure to reflect the third-party monitoring relationship would improve transparency for users in the EU.

2. **PostHog Analytics Destination Clarity**
   Behavioral analytics events are routed through the bank's own proxy, making the final destination uncertain. Clarifying whether these events are ultimately forwarded to PostHog's US-based service would allow users to make fully informed decisions.

3. **Background Location Tracking Visibility**
   The TravelHub travel insurance feature re-registers location monitoring after every device reboot without user re-engagement. A clear opt-in reminder following a restart would give users better visibility and control over this ongoing background access.

### Security Enhancements

1. **Stronger Key Material Generation**
   The system that generates the primary key protecting all stored security data uses a very limited random value, creating a small but real theoretical window on compromised devices. Using a properly sized random value here would substantially reduce this risk.

2. **Web Content Bridge Restrictions**
   The bridge connecting the app's web content to its core functions accepts a broad range of actions and network requests without a defined list of what is and is not permitted. Restricting this to an explicit allowed set would contain any impact if the bank's web content were ever compromised.

## Technical Context

**App Type:** Financial banking application (high data sensitivity)
**Classes Analyzed:** 51,408
**Third-Party Services:** 13 identified
**Context Tags:** financial, sensitive_data, location, biometrics

---

## About This Analysis

This security analysis was conducted by CITT (Can I Trust That), an independent security analysis service. We perform static code analysis on Android applications to help users make informed decisions about app security and privacy.

### App Details

**Developer:** Česká spořitelna, a.s.
**Version:** 26.14.24-google (versionCode: 2614242)
**Analysis Date:** 2026-06-13
**Package:** cz.csas.georgego

### Analysis Limitations

- Static analysis only (code review without running the app)
- Based on APK version 26.14.24-google analyzed on 2026-06-13
- May not reflect server-side security controls
- Cannot detect all runtime behaviors