# Security & Privacy Scorecard

## ONPEID

## What This Means for You

App usage data is reported to Firebase, a Google service, for app configuration and diagnostics. The app collects minimal personal data and does not share it with advertising or marketing companies. ID verification activity stays largely on-device.

## Recommendation: Acceptable

**Best For:** Peruvian citizens verifying official IDs

## Key Findings

**Data Security** - 1 finding (1 high)

**Network Security** - 2 findings (1 high, 1 medium)

**Code Safety** - 0 findings

**Privacy** - 1 finding (1 medium)

## Privacy Concerns

### What Data is Collected

ONPEID collects minimal personal data. The app focuses on on-device ID document verification and does not transmit personal identification information to advertising or data broker services. Diagnostic and configuration data is sent to Firebase to keep the app running reliably.

### Third-Party Data Sharing

App usage and configuration data is shared with Firebase (a Google service) for diagnostics and remote configuration. Huawei AGConnect services are present for Huawei device compatibility. No data is shared with advertising or marketing companies.

## Understanding the Scores

| Category | Score |
|---|---|
| Security | 72/100 |
| Privacy | 90/100 |
| Data Security | 75/100 |
| Network Security | 70/100 |
| Code Safety | 88/100 |
| Data Collection | 100/100 |
| Data Sharing | 90/100 |
| User Control | 100/100 |

## Positive Security Features

- Uses established, open-source libraries for document reading and cryptographic operations
- Collects minimal personal data, earning a perfect Data Collection score
- Provides full user control with no unnecessary data permissions
- Implements open standards for machine-readable travel document verification

## Areas for Improvement

- Data stored on the device could be better protected to reduce the risk of unauthorized access if the device is lost or compromised
- Some network connections lack the strongest available protections for data sent between the device and remote services
- One privacy-related practice could be made more transparent to give users a clearer picture of how their information is handled

---

## About This Analysis

This scorecard is based on automated static analysis of the app's code and configuration. Scores reflect the security and privacy practices observed at the time of the scan.

### App Details

| Field | Value |
|---|---|
| App Name | ONPEID |
| Package ID | pe.gob.onpe.id.validator |
| Version | 1.2.0.82 |
| Scan Date | 2026-02-05 |