CITT

    Scan results

    Proton VPN: Fast & Secure VPN

    Android

    Proton VPN is a fast and secure VPN app created by CERN scientists. It offers unlimited data, strict no-logs policy, 15,000+ servers across 126 countries, and advanced privacy features like DNS leak protection, kill switch, and split tunneling. Free and premium plans available.

    CITT SCORE
    90
    out of 100
    TRUSTED

    Quick Verdict

    Best for: Privacy-minded users who want encrypted browsing

    What It Means For You

    Crash and error data is shared with Sentry, and Google Play handles subscription billing. Aside from those two services, traffic, browsing activity, and usage patterns stay on-device and are not shared with advertising or analytics platforms.

    Method and Limitations

    Static analysis only. CITT reviewed the code of this build without running the app, so runtime behavior was not observed. The findings below describe the analyzed build and may not reflect server-side controls or later versions. CITT makes no determination about compliance with any law or platform policy; it reports what the artifacts contain and cites the published guidance so a reader can compare.

    How CITT scores an app

    Findings (6)

    Data Security

    1 total
    1 Medium

    Network Security

    1 total
    1 Low

    Code Security

    3 total
    3 Low

    Privacy

    1 total
    1 Medium

    Third-Party Services

    Sentry, Google Play Billing, OkHttp, Retrofit, AndroidX Compose, AndroidX Biometric, AndroidX Room, AndroidX Work, ZXing Barcode Scanner, WireGuard, UniFFI, Certificate Transparency, Dagger Hilt, Kotlin Coroutines, Coil, Firebase Encoders, Google Play Services FIDO2, Google Play Services Billing

    Security Strengths

    • ✓Certificate pinning implemented with SPKI validation
    • ✓DNS-over-HTTPS implementation with 48 alternative providers
    • ✓Hardware-backed authentication token encryption using Android KeyStore
    • ✓Sentry crash reporting with user consent and privacy-preserving configurations
    • ✓No advertising SDKs or third-party trackers
    • ✓WebView metrics explicitly disabled
    What changed since the last scan

    Version diff is on the Developer plan. See developer plans.

    Context Tags

    vpn
    network
    privacy
    security tools
    encryption
    sensitive data

    Package

    ch.protonvpn.android

    Version

    5.16.83.0 (Build 605168300)

    Analysis Date

    Mar 5, 2026

    Classes Analyzed

    17,483

    Was this analysis helpful?

    Feedback helps us improve our analysis

    View on Play Store

    Recommendation: Very Secure

    Key Findings

    Data Security - 1 finding (1 medium)

    Network Security - 1 finding (1 low)

    Code Safety - 0 findings

    Privacy - 1 finding (1 medium)

    Privacy Concerns

    What Data is Collected

    This app collects a narrow slice of data. When the app encounters an error, a crash report is sent to Sentry so the developer can fix problems. Billing and subscription details are handled through Google Play.

    Third-Party Data Sharing

    User information reaches two external services:

    • Sentry - receives crash and error diagnostics when the app encounters a problem
    • Google Play Billing - processes subscription payments on behalf of the developer

    Browsing activity, connection history, and usage patterns do not reach advertising networks or behavioral profiling services.

    Understanding the Scores

    CategoryScore
    Security94/100
    Privacy87/100
    Data Security88/100
    Network Security99/100
    Code Safety99/100
    Data Collection98/100
    Data Sharing100/100
    User Control98/100

    Positive Security Features

    • Encrypts internet traffic using WireGuard, a modern protocol with a strong and well-reviewed security track record
    • Supports biometric login (fingerprint or face recognition) to protect access to the account on the device
    • Implements FIDO2 standards, enabling strong hardware-backed authentication options
    • Uses Certificate Transparency checks to protect against fraudulent certificates that could otherwise intercept the connection

    Areas for Improvement

    • Some data stored locally on the device could be protected more strongly, which would reduce risk if the device were ever accessed physically without permission.
    • A minor refinement to how secure connections are verified would close a small theoretical gap and further strengthen protection while connected.
    • A modest amount of usage data is collected that, while not linked to advertising, could be scoped more narrowly to reduce the overall data footprint.

    About This Analysis

    This scorecard is produced through automated static analysis of the app's code and structure. Scores reflect the app's privacy and security posture at the time of the scan.

    App Details

    • Package ID: ch.protonvpn.android
    • Version: 5.16.83.0 (Build 605168300)
    • Scan Date: March 5, 2026
    • Platform: Android

    Right of Reply

    Developer not yet contacted