NordVPN – fast VPN for privacy Security & Privacy Scorecard

NordVPN - fast VPN for privacy

What This Means for You

Your advertising identifier and cross-app tracking profile are permanently linked to your VPN account on NordVPN's servers each time you log in, meaning your account identity is tied to advertising data even while using a service marketed as private.

Recommendation: Use With Caution

Strong encryption and network security, but permanently links advertising identifiers (GAID, AppsFlyer) to your VPN account, conflicting with its no-logs privacy claim. Consider alternatives if privacy is paramount.

Best For: Users who want strong network security, reliable VPN performance, and access to geo-restricted content and are comfortable with NordVPN's data practices

Key Findings

Data Security - 2 findings (1 medium, 1 info)

Network Security - 2 findings (1 low, 1 info)

Code Safety - 3 findings (2 low, 1 info)

Privacy - 6 findings (3 medium, 2 low, 1 info)

Privacy Concerns

What Data is Collected

• Personal information: email address, advertising identifier, subscription plan and payment details
• Device information: device ID, AppsFlyer cross-app tracking ID, phone status
• Usage data: VPN connection triggers, connected server country, feature activation states (Call Protection, Dark Web Monitor, Threat Protection, Meshnet)
• Call data: incoming caller phone numbers (when Call Protection feature is enabled)

Third-Party Data Sharing

The following third parties may receive your data:

• AppsFlyer - cross-app attribution and advertising analytics; persistent device ID forwarded to NordVPN's own authentication servers
• Braze - marketing communications and CRM profiling via in-app messaging
• Firebase (Google) - push notifications (FCM) and remote configuration; analytics and crash tracking disabled by default
• Google Play Billing - subscription and payment processing
• Google Play Integrity - app integrity verification
• Moose / Nudler (Nord Security internal) - internal telemetry pipeline collecting VPN usage patterns and subscription financial details

Understanding the Scores

Security: 88/100
Privacy: 33/100

Security Breakdown

• Data Security: 83/100 - Authentication data is encrypted with hardware-backed storage, though an encryption parameter management concern exists for stored authentication data within a session
• Network Security: 92/100 - Strong server identity verification with static pins and dynamic rotation; cleartext HTTP disabled across all connections including censorship-circumvention fallback domains
• Code Safety: 92/100 - Kill switch implemented in memory-safe Rust with zero critical findings; memory protection enabled app-wide

Privacy Breakdown

• Data Collection: 25/100 - Collects advertising identifiers, subscription financials, VPN usage patterns, and incoming caller phone numbers when Call Protection is active
• Data Sharing: 28/100 - Advertising identifiers linked to your VPN account at login; multiple analytics and marketing SDKs integrated
• User Control: 37/100 - A consent tier system exists but VPN connection metadata may be classified as non-optional; no user-facing opt-out for advertising identifier linkage at login

Positive Security Features

• Strong server identity verification with 19 static pins and dynamic rotation that fails safely when dynamic updates are unavailable
• API responses carry integrity signatures, preventing tampering in transit
• Firebase Analytics, Crashlytics, and Performance tracking disabled by default
• Login data and account details encrypted using hardware-backed key storage on supported devices, with keys that cannot be exported
• VPN kill switch built in memory-safe Rust with zero critical findings from static analysis
• Memory protection (GWP-ASan) enabled across the entire app, with additional stack protection in native binaries
• No data transmitted over unencrypted HTTP, including on censorship-circumvention fallback connections
• App backup disabled at the system level - account data cannot leak via Android backup

Areas for Improvement

GDPR / CCPA Compliance

The app's privacy practices could be strengthened by:

1. Advertising Identifier Consent at Login
   Users should receive a clear opt-out before their advertising identifier is attached to their VPN account at login, with an explicit disclosure explaining why this linkage occurs and how long it is retained.

2. Caller Data Disclosure for Call Protection
   Users enabling Call Protection should see prominent disclosure that every incoming caller's phone number is sent to NordVPN's servers for lookup, along with an option to use an on-device alternative if available.

3. Telemetry Scope Transparency
   The scope of data classified as non-optional within the internal telemetry system - including subscription financials and VPN connection patterns - should be clearly disclosed and justified in the privacy policy.

Security Enhancements

1. Per-Operation Encryption Parameter Refresh
   Generating fresh encryption parameters for stored authentication data on each operation would prevent any keystream reuse within a session.

2. External Link Connection Confirmation
   Adding a brief confirmation prompt when a VPN connection is triggered by an external app or web page would prevent unintended server switching without user awareness.

Technical Context

App Type: VPN / Network Security application, high sensitivity
Classes Analyzed: Not available for this version
Third-Party Services: 10 third-party and internal services identified
Context Tags: privacy, vpn, subscription, analytics-tracking, location, financial-data

---

About This Analysis

This security analysis was conducted by CITT (Can I Trust That), an independent security analysis service. We perform static code analysis on Android applications to help users make informed decisions about app security and privacy.

App Details

Developer: nordvpn S.A.
Version: 9.0.4 (versionCode: 1844)
Analysis Date: 2026-04-17
Package: com.nordvpn.android

Analysis Limitations

• Static analysis only (code review without running the app)
• Based on APK version 9.0.4 analyzed on 2026-04-17
• May not reflect server-side security controls
• Cannot detect all runtime behaviors