# Security & Privacy Scorecard

## Private Internet Access VPN (PIA VPN)

Private Internet Access (PIA) is a privacy-focused VPN service offering WireGuard and OpenVPN protocols with no advertising or behavioral tracking. It encrypts your internet traffic and is designed for users who want to browse without being monitored.

## What This Means for You

Your internet traffic is encrypted with zero advertising or tracking companies receiving your data, though a missing Apple-required privacy declaration means the app has not fully disclosed all the system features it uses to Apple's review process.

## Recommendation: Acceptable with Awareness

Strong VPN fundamentals with zero tracking or advertising SDKs embedded in the codebase. The account management component stores authentication data with slightly weaker protection than the rest of the app, and a missing privacy manifest leaves some system feature usage undeclared. Suitable for privacy-conscious users who want a no-tracking VPN.

**Best For:** Privacy-conscious users wanting a no-tracking VPN with strong security fundamentals

## Key Findings

**Data Security** - 4 findings (1 medium, 3 info)

**Network Security** - 3 findings (1 low, 2 info)

**Code Safety** - 4 findings (2 low, 2 info)

**Privacy** - 3 findings (1 medium, 1 low, 1 info)

## Privacy Concerns

### What Data is Collected

- Account authentication data (stored securely in the device's secure storage)
- VPN connection performance statistics (opt-in only, includes a daily-regenerated random identifier not linked to your account)
- App preferences and connection state (stored locally on device only)

### Third-Party Data Sharing

**The following third parties may receive your data:**
- Kape Technologies (via csi.supreme.tools) - VPN connection performance statistics, transmitted only if you explicitly opt in during setup

No advertising, analytics, or attribution companies receive your data.

## Understanding the Scores

**Security:** 92/100
**Privacy:** 35/100

### Security Breakdown

- **Data Security:** 92/100 - Sensitive data is handled securely throughout most of the app; one account management component uses slightly weaker secure storage protection than the rest
- **Network Security:** 97/100 - All connections enforce encrypted HTTPS with no exceptions; VPN server trust is anchored to PIA's own certificate authority
- **Code Safety:** 94/100 - No browser component eliminates a common attack surface; Siri Shortcuts can trigger VPN disconnect from the lock screen without requiring device unlock

### Privacy Breakdown

- **Data Collection:** 25/100 - Collects opt-in performance statistics sent to Kape Technologies infrastructure; the main app is missing Apple's required privacy usage declaration
- **Data Sharing:** 30/100 - Performance data shared with Kape Technologies on an opt-in basis; no advertising or behavioral profiling data shared with third parties
- **User Control:** 93/100 - Performance telemetry is opt-in; no third-party tracking present; users can control VPN connection fully

## Positive Security Features

- Zero third-party tracking, advertising, or analytics companies receive your data
- All network connections enforce encrypted HTTPS with no exceptions allowed
- VPN server trust is anchored exclusively to PIA's own certificate authority, not the broader public internet
- Sensitive account and session data is stored in the device's secure keychain with strong protection in the main app and VPN extensions
- No browser component is embedded in the app, eliminating a common attack surface found in many apps
- No local database storing your personal information on device
- Opt-in performance reporting uses additional transport-layer protection between the app and PIA's servers
- No advertising identifiers or behavioral profiling frameworks present anywhere in the codebase

## Areas for Improvement

### GDPR / CCPA Compliance

The app's privacy practices could be strengthened by:

1. **Privacy Manifest Declaration**
   The main app bundle should include Apple's required privacy declaration file to formally disclose which system features and data categories it uses. All three of the app's extensions already include this declaration correctly - the main app should follow suit.

2. **Telemetry Ownership Transparency**
   When users opt in to performance data collection, the in-app disclosure could more clearly identify that data goes to csi.supreme.tools, a domain operated by Kape Technologies (PIA's parent company), so users fully understand where their data is sent.

### Security Enhancements

1. **Consistent Secure Storage Protection**
   The account management component could be updated to use the same stronger storage protection level that the main app and VPN extensions already apply, ensuring authentication data cannot be accessed before the device is first unlocked after a cold restart.

2. **Universal Links for Login Flows**
   The app's login-via-link feature uses custom URL schemes that any other app on the same device could potentially intercept. Migrating to Apple's Universal Links system would ensure these login links open only in PIA VPN.

3. **Lock Screen Confirmation for VPN Disconnect**
   Adding a confirmation step before allowing Siri Shortcuts to disconnect the VPN from the lock screen would prevent accidental or unauthorized disconnection that would expose your traffic.

## Technical Context

**App Type:** VPN and privacy service - high security sensitivity
**Classes Analyzed:** 272
**Third-Party Services:** 6 (WireGuard, TunnelKit, OpenSSL, Kotlin Multiplatform, ReachabilitySwift, nanopb)
**Context Tags:** vpn, privacy, network_security, subscription

---

## About This Analysis

This security analysis was conducted by CITT (Can I Trust That), an independent security analysis service. We perform static code analysis on iOS applications to help users make informed decisions about app security and privacy.

### App Details

**Developer:** Private Internet Access
**Version:** 3.29.1 (Build 174)
**Analysis Date:** 2026-04-14
**Package:** com.privateinternetaccess.ios.PIA-VPN

### Analysis Limitations

- Static analysis only (code review without running the app)
- Based on IPA version 3.29.1 (Build 174) analyzed on 2026-04-14
- May not reflect server-side security controls
- Cannot detect all runtime behaviors