Proton VPN: Fast & Secure Security & Privacy Scorecard
by Proton AG · iOS
App installation and usage patterns are shared with advertising networks including Google, Twitter, and Snap for ad attribution. A developer debugging tool is present in this production release, which is unusual for a shipped app. The app provides strong in-app controls over settings and account data.
Best for
Personal VPN use with hands-on privacy settings
Avoid if
You expect zero ad-network data sharing
Findings
- 0 critical
- 2 high
- 2 medium
- 5 low
- 10 info
19 issues identified across security and privacy analysis.
Top security issues
- Google Play Console Service Account Private Key Embedded in APK
- External Apps Can Silently Start and Stop the VPN
- AES Encryption Key Stored in Plaintext File Adjacent to Encrypted Data
Top privacy issues
- Atlantis framework in production broadcasts all decrypted network traffic (including auth tokens and API calls) to any Proxyman instance on the local network, transparently and without user awareness
- SKAdNetwork attribution postbacks enabled for Google, Twitter/X, Snap, and Adjust — platforms users may be relying on ProtonVPN to avoid
- Main app PrivacyInfo.xcprivacy manifest missing, leaving telemetry collection (TelemetryConnectionStatusReporter, TelemetryConversionReporter) undeclared for users and App Store reviewers
Full analysis
Overall Security Score: 62/100 | Privacy Score: 35/100
What This Means for You
App installation and usage patterns are shared with advertising networks including Google, Twitter, and Snap for ad attribution. A developer debugging tool is present in this production release, which is unusual for a shipped app. The app provides strong in-app controls over settings and account data.
Recommendation: Use With Caution
Best For: Personal VPN use with hands-on privacy settings
Avoid If: You expect zero ad-network data sharing
Key Findings
Data Security - 4 findings (1 medium, 2 low, 1 info)
Network Security - 5 findings (1 high, 1 medium, 3 info)
Code Safety - 0 findings
Privacy - 4 findings (1 low, 3 info)
Privacy Concerns
What Data is Collected
The app collects device and installation identifiers linked to a specific device. This data is used to measure advertising effectiveness and attribute the installation to ad campaigns.
Third-Party Data Sharing
Device data is shared with the following advertising and analytics platforms:
- Adjust - Tracks installation and app opens for ad attribution
- Google - Receives attribution signals via SKAdNetwork
- Twitter/X - Receives attribution signals via SKAdNetwork
- Snap - Receives attribution signals via SKAdNetwork
- Sentry (self-hosted) - Receives diagnostic and error data from user sessions
Understanding the Scores
| Category | Score |
|---|---|
| Security | 62/100 |
| Privacy | 35/100 |
| Data Security | 70/100 |
| Network Security | 55/100 |
| Code Safety | 72/100 |
| Data Collection | 25/100 |
| Data Sharing | 30/100 |
| User Control | 94/100 |
Positive Security Features
None identified in this release.
Areas for Improvement
- Installation and usage data is shared with four advertising networks. Removing ad attribution would substantially reduce the amount of data shared about user behavior.
- A developer debugging proxy tool is included in this production release. This is not standard practice for a shipped app and could reveal information about how the app communicates internally.
- Network protection practices have gaps that could leave connection data less protected than expected.
About This Analysis
App Details
| Field | Value |
|---|---|
| Package | ch.protonmail.vpn |
| Version | 7.3.0 (Build 3007637.2603241554) |
| Scan Date | 2026-04-06 |
| Total Findings | 19 (0 critical, 2 high, 2 medium, 5 low, 10 info) |
Versions & scan history
| Scan | Date | Overall score |
|---|---|---|
| #1 (current) | 43/100 |