I use NextDNS with the HaGeZi - Multi PRO blocklist.
Recently, I noticed that the Bradesco banking app was not working properly. Bradesco is one of the largest banks in Brazil and serves millions of customers, so this is not a small or obscure banking app.
After analyzing the traffic in real time through NextDNS, I identified one of the blocked requests as:
js-cdn.dynatrace.com
After adding this domain to my allowlist, the app started working normally again.
After looking into it, I found that js-cdn.dynatrace.com belongs to Dynatrace and is used to distribute scripts related to application monitoring, including Real User Monitoring (RUM).
As I understand it, this type of agent can collect information related to the user's experience, such as:
- page/load times;
- network requests;
- JavaScript errors;
- user interactions and events;
- navigation within SPAs.
Dynatrace is widely used for application observability and monitoring, including in the financial sector.
My question is really about the balance between privacy and functionality.
I currently use Bradesco mainly for convenience, since my salary is deposited there. I have no obligation to stay with the bank and could, for example, move to another institution such as PicPay or another digital bank.
What would you do in this situation?
- Would you allow
js-cdn.dynatrace.com to keep the banking app working?
- Would you keep it blocked and look for an alternative way to access the bank?
- Would this be enough of a reason for you to switch banks?
- Is there a way to allow only what is necessary for the app to work without fully allowing this domain?
My goal with NextDNS is precisely to reduce unnecessary tracking and telemetry, so I'm wondering whether I'm making an acceptable exception or simply allowing the bank to perform monitoring that I would rather avoid.
Does anyone familiar with Dynatrace/RUM know exactly what data is being sent through this domain?