# Security & Privacy Scorecard

## io.b2a.BankProd

## What This Means for You

In-app activity and usage patterns are shared with marketing services including Adjust and Braze, which can use this data to send targeted messages. Signing in with Facebook links activity across both platforms. Identity verification steps require submitting personal documents to a third-party service.

## Recommendation: Trustworthy

**Best For:** Managing finances with strong security standards

## Key Findings

**Data Security** - 5 findings (1 medium, 3 low, 1 info)

**Network Security** - 4 findings (1 medium, 1 low, 2 info)

**Code Safety** - 0 findings

**Privacy** - 6 findings (1 medium, 1 low, 4 info)

## Privacy Concerns

### What Data is Collected

This app collects account activity, transaction history, and usage patterns. Identity verification requires submitting government-issued documents and biometric data through Veriff. Financial account linking through Plaid may access account balances and transaction records from connected banks. Diagnostic data is collected automatically to monitor app stability.

### Third-Party Data Sharing

User data is shared with the following third-party services:

- **Adjust** - Receives in-app actions and usage patterns for marketing measurement
- **Braze** - Receives behavioral data to power targeted push notifications and in-app messages
- **Facebook** - Receives activity data when users use Facebook sign-in
- **Veriff** - Receives identity documents and biometric data for identity verification
- **Plaid** - Receives banking access information to link external financial accounts
- **Stripe Terminal** - Receives payment transaction data for payment processing
- **Sentry** - Receives diagnostic and error data to improve app stability
- **Firebase** - Receives usage analytics and app performance data
- **Google** - Provides mapping features and optional sign-in
- **AWS** - Provides backend infrastructure and liveness detection for identity flows

## Understanding the Scores

| Category | Score |
|---|---|
| Security | 87/100 |
| Privacy | 86/100 |
| Data Security | 88/100 |
| Network Security | 93/100 |
| Code Safety | 95/100 |
| Data Collection | 88/100 |
| Data Sharing | 88/100 |
| User Control | 93/100 |

## Positive Security Features

- Code safety scored 95 out of 100, reflecting well-structured and hardened code across the app
- Network security scored 93 out of 100, indicating strong protections for data sent between the device and servers
- User control scored 93 out of 100, reflecting meaningful options for managing account and data
- Data security scored 88 out of 100, showing solid practices for handling stored information

## Areas for Improvement

- The number of marketing and analytics services with access to behavioral data could be reduced to limit profiling of in-app habits
- Third-party identity verification means personal documents and biometric data are handled outside the app's direct control
- Linking external bank accounts through Plaid introduces an additional third party that receives financial account information

---

## About This Analysis

This scorecard is based on automated static analysis of the app's code and configuration. Scores reflect security and privacy practices observed at the time of the scan and may not capture every aspect of how the app handles user data at runtime.

### App Details

| Field | Value |
|---|---|
| Package | io.b2a.BankProd |
| Version | 7.20.0 (Build 7200052) |
| Scan Date | 2026-04-08 |