VPN providers
Proton VPN privacy rating
VPN service from Proton in Switzerland with open-source apps on every platform and a free plan without ads.
Summary
Proton VPN scores 83 out of 100 (grade B) on the VPN providers criteria. It meets 8 of 12 criteria: no ads or data sales, independent audit, transparency report, TLS configuration, audited no-logs policy, anonymous payment, open-source apps and modern protocols. It partly meets open source, no trackers or telemetry, tells users about requests and security headers. It is based in Switzerland: Not in the Five, Nine or Fourteen Eyes; GDPR-style data protection law. Automated tests: SSL Labs grade A+ and Mozilla HTTP Observatory grade B.
Score 83 out of 100. How scoring works
Criteria
-
Partial
Open source Weight 3 of 3
Is all the source code needed to run the product public?
Apps are open source under GPL-3.0. The server side is not.
-
Partial
No trackers or telemetry Weight 3 of 3
Are the website and apps free of third-party trackers, with any analytics anonymous and any telemetry off by default?
Website analytics are self-hosted, and the apps send first-party crash reports that can be turned off in settings.
-
Yes
No ads or data sales Weight 2 of 3
Is the product funded without advertising, ad targeting or selling user data?
Funded by paid plans. The free plan has no ads.
-
Yes
Independent audit Weight 2 of 3
Has an independent security or privacy audit been published within the last three years?
Full Securitum no-logs audit report, repeated yearly.
-
Yes
Transparency report Weight 2 of 3
Does the provider regularly publish how many government and legal requests it receives and how it responds?
Yearly counts of legal orders received, contested and complied with, including a separate Proton VPN section.
-
Partial
Tells users about requests Weight 1 of 3
Does the provider promise to tell users about requests for their data, unless a court forbids it?
Swiss law requires authorities to notify subjects of proceedings. Proton does not itself promise notice.
-
Yes
Audited no-logs policy Weight 3 of 3
Has an independent audit confirmed that activity and connection logs are not kept?
Securitum audits the VPN servers each year and found no activity or connection logging.
-
Yes
Anonymous payment Weight 2 of 3
Can an account be created and paid for without an email address, name or card?
Cash and Bitcoin are accepted, and the privacy policy states no personal information is needed to create an account.
-
Yes
Open-source apps Weight 2 of 3
Are the apps for every platform open source?
Apps for Windows, macOS, Linux, Android and iOS are open source.
-
Yes
Modern protocols Weight 1 of 3
Is WireGuard (or another modern audited protocol) supported?
WireGuard is supported alongside OpenVPN and the Stealth protocol.
Automated tests
-
Yes
TLS configuration Weight 2 of 3
Does the website pass the Qualys SSL Labs test with a grade of A or better?
Grade A+
-
Partial
Security headers Weight 1 of 3
Does the website pass the Mozilla HTTP Observatory test with a grade of A or better?
Grade B (75/100+)
-
Not tested yet
Modern web standards Weight 1 of 3
Does the website score 90% or higher on the Internet.nl website test?
Not tested yet.