# Did not meet TRUSTED criteria This build did not satisfy all of CITT's published criteria for the TRUSTED mark. The full criteria and this app's results are shown below. ## Trust Pillars - **Secure by Design**: Under review. This area was not fully assessed in this version. - **Data Minimization**: Not met. Did not meet one criterion in this area. - **Manifest Mismatch**: Critical issue. Has a high-severity open item in this area, detailed below. - **User Control**: Strong. Strong result in this area. - **Truly Local**: Not applicable. Does not apply to this app. - **Child-Safe**: Not applicable. Does not apply to this app. --- # Security & Privacy Scorecard ## NordVPN - fast VPN for privacy ## What This Means for You The Play Store privacy label for this build declared "No data shared with third parties"; the build links both a Braze CRM and marketing-automation SDK and an AppsFlyer attribution SDK, both initialized with the authenticated account identifier on login, creating a potential data flow to two independent marketing companies that the label does not reflect. Both SDKs are capable of routing that identifier off-device to their respective servers, though transmission was not observed at runtime in this analysis. ## Recommendation: Elevated Risk CITT rates this Elevated Risk (51/100). The security engineering in this build is strong: session data is protected by hardware-backed encryption, the VPN infrastructure is built on memory-safe Rust code, and network communication is validated against a 19-pin server identity list with dynamic rotation. The privacy sub-scores are significantly lower because the build links both a Braze CRM SDK and an AppsFlyer attribution SDK, both of which are initialized with the authenticated account identifier on login, while the Play Store privacy label for this app declared "No data shared with third parties" as of August 2026. **Best For:** People who want an encrypted internet connection for everyday browsing and streaming, and who are looking for a full-featured VPN with a large server network. ## Method and Limitations Static analysis only. CITT reviewed the code of this build without running the app, so runtime behavior was not observed. The findings below describe the analyzed build and may not reflect server-side controls or later versions. CITT makes no determination about compliance with any law or platform policy; it reports what the artifacts contain and cites the published guidance so a reader can compare. ## Key Findings **Data Security:** 3 findings (3 low) **Network Security:** 0 findings **Code Safety:** 2 findings (2 medium) **Privacy:** 2 findings (1 high, 1 medium) ## Privacy Concerns ### What Leaves the Device - Account identifier (UUID): the build initializes the Braze SDK with the authenticated account identifier on login; this SDK is designed to relay that identifier to Braze's marketing automation servers, though transmission was not observed at runtime in this analysis. - Device advertising and attribution identifiers: the build links the AppsFlyer attribution SDK with device advertising identifiers; these may be sent to AppsFlyer's servers when the user has granted advertising consent, though this was not directly observed at runtime in this analysis. - First-party product analytics: the build routes Moose and Nudler analytics modules to NordVPN's own infrastructure, not to independent third-party data companies. ### What Stays on the Device - Login session data: encrypted with Android hardware-backed Keystore protection and stored on the device. - Application activity logs: written and retained on the device for diagnostic purposes. ### Third-Party Data Sharing **Third parties that may receive data from the app:** - Braze - CRM and in-app marketing automation (linked with account identifier in this build) - AppsFlyer - attribution analytics (linked with device advertising identifiers; may receive data when advertising consent is granted) - Firebase (Google) - crash reporting and performance monitoring (disabled by default in this build) - Google App Measurement - analytics (disabled by default in this build) - Google Play Billing - processes in-app purchase transactions - HiveMQ - push notification delivery infrastructure ## Understanding the Scores **Security:** 88/100 **Privacy:** 35/100 ### Security Breakdown - **Data Security:** 86/100. The build protects login session data with Android hardware-backed Keystore encryption, and all data in transit is encrypted. Three low-severity storage configuration observations are detailed in Areas for Improvement. - **Network Security:** 95/100. All network communication in this build is restricted to HTTPS and validated against a 19-pin server identity list with dynamic rotation; no cleartext network paths were found. - **Code Safety:** 87/100. Core VPN infrastructure in this build is written in memory-safe Rust, and the kill-switch firewall includes runtime anti-tamper detection. Two medium-severity code configuration observations are detailed in Areas for Improvement. ### Privacy Breakdown - **Data Collection:** 25/100. Both a Braze CRM SDK and an AppsFlyer attribution SDK are initialized with the authenticated account identifier at login. Firebase Analytics and Crashlytics are disabled by default in this build, which limits the default scope of data that may leave the device. - **Data Sharing:** 30/100. The build links SDKs designed to route account and device advertising identifiers to two independent marketing companies. The Play Store data safety label declared "No data shared with third parties" as of August 2026. - **User Control:** 40/100. This build includes consent-gated shutdown paths for both AppsFlyer and Braze: the code removes these SDKs from the device when advertising consent is revoked. The scope of data that may have reached third-party servers before revocation could not be determined from the binary. ## Positive Security Features - Login session data is encrypted using Android hardware-backed Keystore protection before being stored on the device. - All network communication in this build is restricted to HTTPS and validated against a 19-pin server identity list with dynamic rotation; no cleartext network paths were found. - Core VPN infrastructure components are written in memory-safe Rust, reducing the risk of memory errors common in native code. - The kill-switch firewall includes runtime anti-tamper detection to identify hooks from other software. - Memory safety monitoring is enabled in production builds, not only in test configurations. - Firebase Analytics, Crashlytics, and Performance data collection are disabled at app startup by default. - The AppsFlyer attribution SDK is properly deactivated when users decline advertising consent. - The Braze CRM SDK is wiped from the device and disabled when advertising consent is revoked. - The build routes first-party product analytics (Moose and Nudler) to NordVPN's own infrastructure only, not to independent third-party data companies. ## Areas for Improvement ### Disclosure observations Observations about disclosure, each stated against the published guidance so a reader can compare: 1. **Play Store data safety label vs. bundled marketing SDKs** Google Play's Data Safety guidance (support.google.com/googleplay?p=data-safety) requires developers to declare when data is shared with third parties. The Play Store privacy label for this app, as retrieved in August 2026, declared "No data shared with third parties." The build links both a Braze SDK (Braze, Inc.) and an AppsFlyer SDK, both initialized with the authenticated account identifier on login. Whether the identifier reached off-device servers during a live session was not observed in this static analysis; a reader can compare the binary evidence against the label to assess the gap. ### Security Enhancements 1. **Encryption key configuration** The key used to protect session data is configured with system-level randomization enforcement disabled. The calling code in this build currently supplies a fresh initialization value per operation, so the present risk is theoretical. Enabling system-enforced randomization would maintain that protection independently of future code changes. 2. **Push notification service data storage** The build stores push notification service connection data (server address, username, and password) in an unencrypted DataStore file, contrasting with other sensitive stores in the codebase that receive an encryption layer. Applying the same encryption wrapper used elsewhere in the build would bring this store to parity with the rest of the codebase. 3. **In-app browser domain validation** The in-app browser component that handles OAuth flows accepts the target URL from an internal parameter without validating against a permitted domain list. Adding a domain allowlist would reduce the risk that a routing issue elsewhere in the app could direct the browser to an unintended page under the NordVPN brand. 4. **VPN connection URL handler caller restriction** The VPN connection URL handler is accessible to any installed app or website without a caller permission requirement. Adding a caller permission check would prevent third-party apps from switching the user's VPN exit node or triggering reconnections without user authorization. 5. **On-device log retention** Application logs are written at INFO level in production builds and retained for up to 41 MB of rolling storage. Reducing production log verbosity or retention would limit the amount of session metadata available to software with file read access on the device. ## Technical Context **App Type:** VPN and network privacy tool; handles sensitive connection metadata **Classes Analyzed:** 4,200 **Third-Party Services:** 15 **Context Tags:** sensitive_data, ads, location --- ## About This Analysis This security analysis was conducted by CITT (Can I Trust That), an independent security analysis service. The analysis is static code review of Android applications, intended to help people make informed decisions about app security and privacy. ### App Details **Developer:** Nord Security **Version:** 9.0.4 (versionCode 1844) **Analysis Date:** August 13, 2026 **Package:** com.nordvpn.android ### Analysis Limitations - Static analysis only (code review without running the app) - Based on APK version 9.0.4 analyzed on August 13, 2026 - May not reflect server-side security controls - Cannot detect all runtime behaviors