# Security & Privacy Scorecard

## BNZ Mobile

**Version:** 9.39.0 (Build 281759970)  
**Package:** nz.co.bnz.droidbanking  
**Scan Date:** 2026-02-10

## What This Means for You

In-app banking behavior is monitored by BioCatch, a behavioral biometrics service, and usage patterns are tracked by Dynatrace and Firebase Analytics. User data is handled with several serious protection concerns identified across storage and network layers. Feature availability is controlled remotely via LaunchDarkly, meaning the user experience can change without an app update.

## Recommendation: Use With Caution

**Best For:** BNZ customers comfortable with behavioral analytics  
**Avoid If:** You avoid apps that monitor your in-app behavior

## Key Findings

**Data Security** - 6 findings (2 critical, 4 high)

**Network Security** - 2 findings (1 critical, 1 high)

**Code Safety** - 0 findings

**Privacy** - 3 findings (1 critical, 1 high, 1 medium)

## Privacy Concerns

### What Data is Collected

BioCatch profiles how users physically interact with the app, capturing touch gestures and input patterns to build a behavioral model tied to user identity. Dynatrace and Firebase Analytics collect session activity, device identifiers, and performance data each time the app is opened. Location data may be processed when users access branch or ATM map features powered by Google Maps.

### Third-Party Data Sharing

User data is shared with the following services:

- **BioCatch** - Behavioral biometrics for fraud detection
- **Dynatrace** - Session and performance monitoring
- **Firebase/Google Analytics** - Usage tracking and crash reporting
- **Google Maps** - Location-based branch and ATM features
- **Atomic.io** - In-app messaging and notifications
- **LaunchDarkly** - Remote feature flag management
- **Firebase Cloud Messaging** - Push notifications
- **Glide** - Image loading
- **Lottie** - Animation rendering
- **MPAndroidChart** - Data visualization

## Understanding the Scores

| Category | Score |
|---|---|
| Security | 45/100 |
| Privacy | 50/100 |
| Data Security | 40/100 |
| Network Security | 45/100 |
| Code Safety | 50/100 |
| Data Collection | 60/100 |
| Data Sharing | 65/100 |
| User Control | 70/100 |

## Positive Security Features

- None identified in this version of the app.

## Areas for Improvement

- Sensitive information stored on the device should be better protected against access by other apps installed on the same device.
- Data sent between the app and its servers should be secured more consistently across all connections.
- Clearer disclosure is needed around how behavioral data collected by third-party services is used, retained, and shared beyond the app.

---

## About This Analysis

This scorecard is based on static analysis of the app's code and configuration. Results reflect the state of the app at the time of the scan and may not reflect subsequent updates.

### App Details

| Field | Value |
|---|---|
| App Name | BNZ Mobile |
| Package ID | nz.co.bnz.droidbanking |
| Version | 9.39.0 (Build 281759970) |
| Scan Date | 2026-02-10 |
| Platform | Android |