Is Proton VPN Open Source and Independently Audited?

This page is part of the Proton VPN FAQ Hub.

Which apps are open source?

Proton VPN open source coverage runs across the consumer platforms: Windows, macOS, Linux, Android, iOS and the browser extension, all published on GitHub. The client repositories carry the GNU General Public Licence v3, with some bundled WireGuard components under MIT and Apache licences. Proton released the lot in January 2020, and Proton’s open source announcement and audit links have been kept current since.

Worth checking for yourself, because this is the sort of claim that rots quietly. A repository last touched four years ago is technically open source and practically useless. Proton’s are active, with commits landing in the same weeks the apps update.

Who has audited Proton VPN, and when?

Two separate strands. Whether the servers keep any logs has been audited annually by Securitum, a European security firm, since 2022, with the fifth consecutive report published in June 2026. The applications have had their own security audits, including earlier work by SEC Consult and more recent reviews by the independent researcher Ruben Santamarta, refreshed in December 2025.

The part that matters is publication. Proton puts the reports out rather than a summary of the reports, which lets anyone with the patience read the findings and the caveats. A press release announcing that a company passed an audit is not an audit.

What did the no-logs audit actually test?

The 2026 Securitum engagement went after the claims that would matter in a courtroom rather than the ones on the homepage. Auditors reviewed server configuration files, logging directives and the automated systems meant to catch unauthorised changes.

The conclusion, in the auditors’ careful phrasing, was that the technical evidence reviewed did not indicate that the examined infrastructure logs browsing activity, DNS queries, destination services, traffic contents or user-identifiable connection metadata. Careful wording, and appropriately so, because nobody can prove a negative across every machine forever.

• Whether user activity or connection metadata such as DNS queries and timestamps are recorded anywhere
• Whether network traffic contents are inspected or stored in the path
• Whether the services a user connects to are monitored
• Whether the no-logs configuration is uniform across regions, not just on the servers shown to auditors
• Whether automated detection would catch a logging directive being switched back on

What does Proton VPN open source code not prove?

You can read the client. You cannot read the servers, and no VPN on the market can offer that, because a machine you do not control can be reconfigured the moment the auditors pack up. This is the permanent structural limit of the whole category, and Proton is subject to it exactly like everyone else.

Reproducible builds close part of the gap by letting anyone confirm that a shipped binary was compiled from the published source. Proton offers this on some platforms and not on all of them. Until that is universal, reading the source tells you what the source says, not what installed itself on your laptop.

Why does any of this matter to a normal user?

Security that depends on nobody reading the code is not security, a point cryptographers settled in the nineteenth century and now file under Kerckhoffs’s principle. Published code invites awkward questions, and awkward questions are what find bugs. A closed VPN client asks you to take the vendor’s word for it, indefinitely, on the one piece of software with a view of everything you do online.

For most people the benefit of Proton VPN open source code is indirect. You will not be auditing the Android client this weekend. Somebody will, eventually, and that standing possibility is what keeps Proton VPN honest, and much of why the service counts as safe, in a market where several competitors have shipped clients caught reporting back to their own analytics.

---