Scan results

Recommendation: Elevated Risk

CITT rates this Elevated Risk (51/100). The security engineering in this build is strong: session data is protected by hardware-backed encryption, the VPN infrastructure is built on memory-safe Rust code, and network communication is validated against a 19-pin server identity list with dynamic rotation. The privacy sub-scores are significantly lower because the build links both a Braze CRM SDK and an AppsFlyer attribution SDK, both of which are initialized with the authenticated account identifier on login, while the Play Store privacy label for this app declared "No data shared with third parties" as of August 2026.

Key Findings

Data Security: 3 findings (3 low)

Network Security: 0 findings

Code Safety: 2 findings (2 medium)

Privacy: 2 findings (1 high, 1 medium)

Privacy Concerns

What Leaves the Device

• Account identifier (UUID): the build initializes the Braze SDK with the authenticated account identifier on login; this SDK is designed to relay that identifier to Braze's marketing automation servers, though transmission was not observed at runtime in this analysis.
• Device advertising and attribution identifiers: the build links the AppsFlyer attribution SDK with device advertising identifiers; these may be sent to AppsFlyer's servers when the user has granted advertising consent, though this was not directly observed at runtime in this analysis.
• First-party product analytics: the build routes Moose and Nudler analytics modules to NordVPN's own infrastructure, not to independent third-party data companies.

What Stays on the Device

• Login session data: encrypted with Android hardware-backed Keystore protection and stored on the device.
• Application activity logs: written and retained on the device for diagnostic purposes.

Third-Party Data Sharing

Third parties that may receive data from the app:

• Braze - CRM and in-app marketing automation (linked with account identifier in this build)
• AppsFlyer - attribution analytics (linked with device advertising identifiers; may receive data when advertising consent is granted)
• Firebase (Google) - crash reporting and performance monitoring (disabled by default in this build)
• Google App Measurement - analytics (disabled by default in this build)
• Google Play Billing - processes in-app purchase transactions
• HiveMQ - push notification delivery infrastructure

Understanding the Scores

Security: 88/100
Privacy: 35/100

Security Breakdown

• Data Security: 86/100. The build protects login session data with Android hardware-backed Keystore encryption, and all data in transit is encrypted. Three low-severity storage configuration observations are detailed in Areas for Improvement.
• Network Security: 95/100. All network communication in this build is restricted to HTTPS and validated against a 19-pin server identity list with dynamic rotation; no cleartext network paths were found.
• Code Safety: 87/100. Core VPN infrastructure in this build is written in memory-safe Rust, and the kill-switch firewall includes runtime anti-tamper detection. Two medium-severity code configuration observations are detailed in Areas for Improvement.

Privacy Breakdown

• Data Collection: 25/100. Both a Braze CRM SDK and an AppsFlyer attribution SDK are initialized with the authenticated account identifier at login. Firebase Analytics and Crashlytics are disabled by default in this build, which limits the default scope of data that may leave the device.
• Data Sharing: 30/100. The build links SDKs designed to route account and device advertising identifiers to two independent marketing companies. The Play Store data safety label declared "No data shared with third parties" as of August 2026.
• User Control: 40/100. This build includes consent-gated shutdown paths for both AppsFlyer and Braze: the code removes these SDKs from the device when advertising consent is revoked. The scope of data that may have reached third-party servers before revocation could not be determined from the binary.

Positive Security Features

• Login session data is encrypted using Android hardware-backed Keystore protection before being stored on the device.
• All network communication in this build is restricted to HTTPS and validated against a 19-pin server identity list with dynamic rotation; no cleartext network paths were found.
• Core VPN infrastructure components are written in memory-safe Rust, reducing the risk of memory errors common in native code.
• The kill-switch firewall includes runtime anti-tamper detection to identify hooks from other software.
• Memory safety monitoring is enabled in production builds, not only in test configurations.
• Firebase Analytics, Crashlytics, and Performance data collection are disabled at app startup by default.
• The AppsFlyer attribution SDK is properly deactivated when users decline advertising consent.
• The Braze CRM SDK is wiped from the device and disabled when advertising consent is revoked.
• The build routes first-party product analytics (Moose and Nudler) to NordVPN's own infrastructure only, not to independent third-party data companies.

Areas for Improvement

Disclosure observations

Observations about disclosure, each stated against the published guidance so a reader can compare:

1. Play Store data safety label vs. bundled marketing SDKs
   Google Play's Data Safety guidance (support.google.com/googleplay?p=data-safety) requires developers to declare when data is shared with third parties. The Play Store privacy label for this app, as retrieved in August 2026, declared "No data shared with third parties." The build links both a Braze SDK (Braze, Inc.) and an AppsFlyer SDK, both initialized with the authenticated account identifier on login. Whether the identifier reached off-device servers during a live session was not observed in this static analysis; a reader can compare the binary evidence against the label to assess the gap.

Security Enhancements

1. Encryption key configuration
   The key used to protect session data is configured with system-level randomization enforcement disabled. The calling code in this build currently supplies a fresh initialization value per operation, so the present risk is theoretical. Enabling system-enforced randomization would maintain that protection independently of future code changes.

2. Push notification service data storage
   The build stores push notification service connection data (server address, username, and password) in an unencrypted DataStore file, contrasting with other sensitive stores in the codebase that receive an encryption layer. Applying the same encryption wrapper used elsewhere in the build would bring this store to parity with the rest of the codebase.

3. In-app browser domain validation
   The in-app browser component that handles OAuth flows accepts the target URL from an internal parameter without validating against a permitted domain list. Adding a domain allowlist would reduce the risk that a routing issue elsewhere in the app could direct the browser to an unintended page under the NordVPN brand.

4. VPN connection URL handler caller restriction
   The VPN connection URL handler is accessible to any installed app or website without a caller permission requirement. Adding a caller permission check would prevent third-party apps from switching the user's VPN exit node or triggering reconnections without user authorization.

5. On-device log retention
   Application logs are written at INFO level in production builds and retained for up to 41 MB of rolling storage. Reducing production log verbosity or retention would limit the amount of session metadata available to software with file read access on the device.

Technical Context

App Type: VPN and network privacy tool; handles sensitive connection metadata
Classes Analyzed: 4,200
Third-Party Services: 15
Context Tags: sensitive_data, ads, location

About This Analysis

This security analysis was conducted by CITT (Can I Trust That), an independent security analysis service. The analysis is static code review of Android applications, intended to help people make informed decisions about app security and privacy.

App Details

Developer: Nord Security
Version: 9.0.4 (versionCode 1844)
Analysis Date: August 13, 2026
Package: com.nordvpn.android

Analysis Limitations

• Static analysis only (code review without running the app)
• Based on APK version 9.0.4 analyzed on August 13, 2026
• May not reflect server-side security controls
• Cannot detect all runtime behaviors