We’re happy to be the first VPN provider to open source apps on all platforms (Windows, macOS, Android, and iOS) and undergo an independent security audit. Transparency, ethics, and security are at the core of the Internet we want to build and the reason why we built ProtonVPN in the first place.
We launched ProtonVPN in 2017 to provide ProtonMail users with a trustworthy VPN service, which was increasingly necessary given the rise of Internet censorship. VPN in particular was an area in dire need of improvement. Studies have found that over one-third of Android VPNs actually contain malware, many VPNs suffered from major security lapses, and many free VPN services that claimed to protect privacy are secretly selling user data to third parties. In general, there is also a lack of transparency and accountability regarding who operates VPN services, their security qualifications, and whether they fully conform to privacy laws like the GDPR.
ProtonVPN changed this by delivering an unparalleled level of transparency and accountability. We have done things differently from the start: We have a strict no-logs policy, we’re based in Switzerland, regulated by some of the world’s strongest privacy laws, we have a deep security background, and we have even opened up our technology for inspection by Mozilla. We’re regularly audited by independent security experts, and our latest security audit results confirm our no logs policy.
Making all of our applications open source is therefore a natural next step. As former CERN scientists, publication and peer review are a core part of our ethos. We are also publishing the results of independent security audits covering all of our software.
You can find the open source code and audit reports here:
Why it’s important to use an open source VPN
When you choose to use a virtual private network, you are placing an extraordinary amount of faith in that service provider. Here’s why:
When you are not connected to a VPN, your unencrypted Internet traffic (i.e., that which is not protected by TLS) may be intercepted by your WiFi provider, by your Internet service provider (ISP), by hackers monitoring the local network, or by the government authorities in your jurisdiction. Your IP address (i.e. your device’s identity and your geographical location) is also exposed, including to the websites you visit, which can use that information to track you across the Internet. Even encrypted traffic can be monitored to observe the websites you visit, and your IP address will remain exposed.
When you connect to a VPN, your Internet traffic is encrypted between your device and the VPN server, protecting it from local network surveillance. Even your DNS lookups (the names of the web domains you visit) are protected. And your IP address is masked to help protect your identity and location. However, the VPN provider effectively becomes your ISP in that it can see your browsing activity, IP address, and location. This is why choosing a trustworthy VPN service is so important.
In contrast, proprietary code relies on “security through obscurity,” meaning vulnerabilities are less likely to be discovered. Or worse, these vulnerabilities may be only known to malicious actors who exploit them secretly without users being aware.
When it comes to online privacy and security software, we believe free and open source software is better for safety and provides better accountability to our user community. Open source has long been at the core of Proton, and our open source software includes the ProtonMail web app, iOS app, Android app, and the desktop Bridge app.
This means that all Proton apps that are out of beta are open source.
We also maintain open source encryption libraries, such as OpenPGPjs, which power a significant fraction of encrypted applications on the web today and serve tens of millions of users.
Third-party security audits
Another unique quality of ProtonVPN is our commitment to having independent security researchers inspect our software before releasing it publicly. Previously, Mozilla reviewed our implementations, organizational structure, and our technology as part of their due diligence for a partnership with us.
Since then, we have initiated more thorough security-focused audits for all our clients. We contracted SEC Consult, a leading security firm, to conduct the audits. Although such audits are expensive and time-consuming, we believe these are a critical step that must go together with open sourcing our code. Going forward, we will continue to do audits on an ongoing basis to have continual independent checks on our application security.
Working with the Proton community
The other important benefit of open sourcing our software is that it furthers our overall mission to build an Internet that’s more secure, private, and free by leveraging the power of the community. Security improvements can now be submitted by developers from around the world through our bug bounty program. And in some cases even features improvements from the community may be incorporated into the official ProtonVPN apps, similar to what we have done previously with the official ProtonVPN Linux client.
As a community-supported organization, we have a responsibility to be as transparent, accountable, and accessible as possible. Going open source helps us to do that and serve you better at the same time.
Your feedback and suggestions have become a vital source of ideas and inspiration for us, and we will continue working to meet your expectations in 2020 and beyond. We will be launching new servers all over the world, improving security, and releasing new features to keep you safe and help you bypass censorship. None of what we have achieved to date could have been done without our community.
Thank you for your support!
The ProtonVPN Team
Follow us on social media to stay up to date on the latest ProtonVPN news:
To get a free ProtonMail encrypted email account, visit: protonmail.com