Scan results

Recommendation: Acceptable With Awareness

NordVPN is well-engineered with strong security practices, but has two data protection gaps that could matter if your device were ever physically compromised or seized. AppsFlyer advertising tracking may concern privacy advocates given this is a privacy-focused product.

Key Findings

Medium Security Risks (2 issues)

1. VPN Configuration Files Stored Without Full Encryption ⚠️
   Files holding your VPN server settings and connection parameters are saved without iOS file protection enabled. This means they can be read even when your device is locked by tools that can access device storage directly.

   This applies if: Your device is jailbroken, physically confiscated, or accessed with forensic extraction tools.

   For most users: On a standard, unmodified iPhone, this data is not accessible to other apps or casual users. The risk is limited to scenarios involving physical device access.

2. App Configuration Accessible After Initial Unlock ⚠️
   Certain app settings stored in the device's secure storage remain accessible after you've unlocked your device once, even if you subsequently lock it again. Your login credentials, by contrast, are correctly protected with the strongest available option and require an active unlock.

   This applies if: Your device is compromised while powered on — for example, via a jailbreak or forensic tool operating on a running device.

   For most users: This does not affect normal day-to-day usage and requires sophisticated access to your device to exploit.

Low Priority Items (2 issues)

1. Custom OpenVPN Configurations May Skip Server Verification ⚠️
   If you manually import a custom OpenVPN configuration file that lacks proper server verification settings, the app will proceed with the connection while flagging the gap. Connections to standard NordVPN servers use proper verification.

   This applies if: You manually import custom OpenVPN configuration files that do not include full security settings.

   For most users: Standard NordVPN server connections are not affected by this.

2. Advertising SDK Collects Device Identifier ⚠️
   An advertising attribution service (AppsFlyer) is bundled in the app and collects your device identifier for cross-app advertising tracking. Users who choose a VPN specifically for privacy may not expect this type of tracking within the VPN product itself.

Privacy Concerns

What Data is Collected

• Device information: Device identifier for advertising attribution
• Usage and analytics data: App interactions and preferences (consent-gated via GDPR controls)
• Connection preferences: VPN server choices and configuration settings

Third-Party Data Sharing

The following third parties may receive your data:

• AppsFlyer - Advertising attribution and cross-app tracking (device identifier collected)
• Braze - Customer engagement, messaging, and push notification management
• Firebase / Google - Analytics framework is present but explicitly disabled in this production build
• Google Ads - On-device advertising conversion measurement

Understanding the Scores

Security: 88/100
Privacy: 34/100

Security Breakdown

• Data Security: 82/100 - Strong overall, with two storage protection gaps for VPN config files and certain app settings
• Network Security: 92/100 - All traffic encrypted over secure connections with no exceptions permitted
• Code Safety: 100/100 - No dangerous code patterns identified in the binary

Privacy Breakdown

• Data Collection: 25/100 - Advertising attribution tracking is unexpected in a privacy-focused product
• Data Sharing: 28/100 - Multiple advertising and analytics third-party integrations present
• User Control: 85/100 - GDPR consent level management built in, gating analytics behind user preference

Positive Security Features

• ✓ Advanced certificate verification protects the VPN management connection from interception attacks
• ✓ Login credentials stored with the strongest available iOS protection, requiring an active device passcode and unlock
• ✓ All app traffic enforces secure connections with no plain-text exceptions permitted
• ✓ Firebase Analytics is explicitly disabled in the production build — the framework is present but not collecting data
• ✓ GDPR consent level management is built in, gating analytics collection behind user preferences
• ✓ Privacy declarations are present for all included frameworks
• ✓ No hardcoded server credentials, passwords, or private keys found in the binary
• ✓ Jailbreak detection implemented to warn users when their device may be compromised

Areas for Improvement

GDPR / CCPA Compliance

The app's privacy practices could be strengthened by:

1. Reconsider Advertising Attribution in a Privacy Product
   Given NordVPN's core value proposition is user privacy, the inclusion of advertising attribution tracking — collecting device identifiers for cross-app tracking — may undermine user trust. Evaluating privacy-preserving attribution alternatives would better align with the product's privacy mission.

2. Improve In-App Transparency for Third-Party Data Collection
   Users may benefit from clearer disclosure within the app about which third-party services receive data, what is collected, and for what purpose — particularly for advertising integrations.

Security Enhancements

1. Apply Stronger File Protection to VPN Configuration Data
   Enabling full iOS file protection for VPN server configuration files would ensure this data remains encrypted and inaccessible when the device is locked, providing better protection in physical access scenarios.

2. Extend Strongest Keychain Protection to Configuration Data
   Applying the same strongest protection class already used for authentication credentials to other configuration data would provide consistent data security across all stored items.

Technical Context

App Type: VPN / Network Security (Privacy-Sensitive Utility)
Version Analyzed: 9.2.0 (Build 428)
Third-Party Services: 11 third-party frameworks identified
Context Tags: Privacy, Network, Sensitive Data

---

About This Analysis

This security analysis was conducted by CITT (Can I Trust That), an independent security analysis service. We perform static code analysis on iOS applications to help users make informed decisions about app security and privacy.

App Details

Developer: Nordvpn S.A.
Version: 9.2.0 (Build 428)
Analysis Date: March 26, 2026
Package: com.nordvpn.NordVPN

Analysis Limitations

• Static analysis only (code review without running the app)
• Based on iOS app version 9.2.0 analyzed on March 26, 2026
• May not reflect server-side security controls
• Cannot detect all runtime behaviors

Right of Reply

Developer not yet contacted