Planet VPN’s Android App Passed the MASA Audit: What It Means
Every VPN app asks for the same thing: your trust. Once it’s on, all of your traffic runs through it: your logins, your messages, your browsing on café Wi-Fi. Yet most of what you know about a VPN app’s security comes from the company that built it.
An independent audit changes that. Instead of taking a VPN’s word for it, you can see what an outside lab found.
Planet VPN’s Android app passed the MASA audit at Assessment Level 2, the stricter level of the App Defense Alliance’s Mobile Application Security Assessment. Leviathan Security Group, an authorized lab, tested the app, and the ADA certificate was issued on 28 October 2026. The result also shows on the Planet VPN Google Play listing.
Below, you’ll find what the auditors checked, what the result means for you, how to verify it in under a minute and what the audit doesn’t cover.
Planet VPN MASA audit: key facts
| Field | Details |
| What | Mobile Application Security Assessment (MASA), an App Defense Alliance program |
| App tested | Planet VPN for Android, listed on Google Play as “Planet Free VPN ™ Super Proxy” (package com.freevpnplanet), version 8.5.7, default configuration |
| Tested by | Leviathan Security Group, Inc., an authorized independent ADA lab |
| Certified by | TrustCB B.V., the certification body that issued the certificate |
| Standard | MASA v2.1.1, built on OWASP MASVS, Assessment Level 2 (AL2, lab assessment) |
| Result | In compliance: all applicable requirements met, no failed or inconclusive verdicts |
| Tested on | Android 17 |
| Evaluation completed | 3 August 2026 |
| Certificate | ADA certificate 10308, issued 28 October 2026, valid until 28 October 2027 |
| Where to verify | Google Play → Data safety → “Independent security review”; ADA certificate registry entry; |
MASA Audit Explained
A MASA audit is an independent security test for mobile apps, carried out by authorized labs under the App Defense Alliance (ADA). The Mobile Application Security Assessment (MASA) checks whether an app stores, encrypts, and sends data in line with a common, published security standard.
The Organization Behind MASA
The App Defense Alliance runs MASA. Google founded the ADA in 2019, and it now operates as part of the Linux Foundation, with Google, Meta, and Microsoft behind it. The ADA authorizes testing labs, maintains the requirements, and publishes every certificate.
The Standard MASA Is Built On
MASA is built on the OWASP Mobile Application Security Verification Standard (MASVS). OWASP, the Open Worldwide Application Security Project, is a non-profit that publishes widely used security standards. Labs follow the OWASP Mobile Application Security Testing Guide (MASTG) when they run the tests.
The ADA turned MASVS into a list of specific, testable requirements, each with a pass or fail verdict. The specification was previously published as the Mobile App Profile (MAP), so you may still see that name. Planet VPN’s Android app was tested against MASA v2.1.1, the current version.
AL1 vs AL2: The Two Assessment Levels
MASA has two assessment levels for mobile apps:
- Assessment Level 1 (AL1) — the developer supplies evidence and answers a questionnaire, and the lab reviews that evidence alongside an automated scan.
- Assessment Level 2 (AL2) — a lab assessment. The lab’s security engineers test the published app directly, with static and dynamic analysis and manual testing.
Planet VPN’s Android app passed at AL2, the more thorough level. Only AL2 apps can show the “Independent security review” label on Google Play.
The Lab Behind Planet VPN’s MASA Audit
Leviathan Security Group, an outside lab authorized by the App Defense Alliance, carried out Planet VPN’s MASA audit — not Planet VPN. The lab tested the public Google Play release of the Android app, version 8.5.7, the same app users install. Leviathan Security Group runs its assessments under the ISO/IEC 17025 standard for testing laboratories.
A second, separate organization made the final call. The lab tested the app and attested to its results, then TrustCB B.V., a certification body provisionally authorized by the ADA, reviewed the evidence and issued the certificate. Planet VPN cannot mark its own work.
What the Auditors Checked in the Planet VPN Android App
The auditors checked how the Planet VPN Android app stores data, uses encryption, connects to servers, interacts with Android, handles its code, and describes its data collection.
Data Storage: Keeping Data Safe on Your Phone
The lab checked that the Planet VPN Android app does not leave sensitive data where other apps or people could read it (controls 1.1.1 and 1.1.2, both passed). That includes system logs and the keyboard cache.
What this protects you from: another app on your phone, or someone who picks up your device, reading information the VPN app holds.
Is the encryption implemented correctly?
The lab checked that the app uses current, strong cryptography and manages its encryption keys properly (controls 1.2.1 and 1.2.2, both passed). That covers secure random number generation, no outdated encryption modes and keys used only for their intended purpose.
What this protects you from: weak or misused encryption that could let an attacker recover protected data.
Cryptography: Encryption Implemented Correctly
The lab checked that every network connection the Planet VPN Android app makes is encrypted, uses a modern TLS configuration and verifies the identity of the server it connects to (control 1.4.1, passed).
What this protects you from: someone on the same public Wi-Fi impersonating a server or reading the app’s traffic in transit.
Network: Connections Protected from Interception
The lab checked how the app interacts with Android: how it shares features with other apps, how it uses WebViews and whether it hides sensitive data on screen (controls 1.5.1–1.5.3, all passed). It also checked that the app requests access only to the data and resources it needs (control 1.8.1, passed).
What this protects you from: other apps abusing VPN app features, and sensitive data showing up in screenshots or over your shoulder.
Platform: Only the Access the App Needs
The lab checked how the app interacts with Android: how it shares features with other apps, how it uses WebViews and whether it hides sensitive data on screen (controls 1.5.1–1.5.3, all passed). It also checked that the app requests access only to the data and resources it needs (control 1.8.1, passed).
What this protects you from: other apps abusing VPN app features, and sensitive data showing up in screenshots or over your shoulder.
Code: No Known Vulnerabilities
The lab checked that the app targets an up-to-date Android version, uses no software components with known vulnerabilities and validates untrusted input (controls 1.6.1–1.6.3, all passed). It also checked that the app is properly signed, ships without debugging symbols and can’t be debugged when installed from outside an app store (controls 1.7.1–1.7.3, all passed).
What this protects you from: tampered copies of the app and attacks that rely on old, publicly known security flaws.
Privacy: A Data Label That Matches What the App Does
The lab checked that the Planet VPN Android app is transparent about what data it collects and why (control 1.8.2, passed). It also checked that users can request deletion of their data from inside the app (control 1.8.3, passed).
What this protects you from: apps that collect more than their store listing admits, or that give you no way to remove your data.
Planet VPN’s MASA Audit Results
Planet VPN’s Android app passed the MASA audit with every applicable requirement met. The compliance report rates the app “IN COMPLIANCE” with MASA v2.1.1 at AL2 and records no failed or inconclusive verdicts.
| Area | Controls | Verdict |
| Storage | 1.1.1, 1.1.2 | Pass |
| Cryptography | 1.2.1, 1.2.2 | Pass |
| Authentication | 1.3.1 | Not applicable |
| Network | 1.4.1 | Pass |
| Platform | 1.5.1, 1.5.2, 1.5.3 | Pass |
| Code | 1.6.1, 1.6.2, 1.6.3 | Pass |
| Resilience | 1.7.1, 1.7.2, 1.7.3 | Pass |
| Privacy | 1.8.1, 1.8.2, 1.8.3 | Pass |
One control, authentication (1.3.1), was marked not applicable. In MASA v2.1.1, its only requirement covers apps that sign users in with OAuth 2.0. A “not applicable” verdict needs a documented basis the certification body accepts.
You can download the full compliance report from the ADA registry.
What the MASA Audit Means for Planet VPN Users
The MASA audit means an outside lab, not Planet VPN, confirmed that the Android app handles data in line with recognized mobile security standards. In practice, that gives you:
- Safer use on public Wi-Fi: The app’s own connections are encrypted and check that they reach the real server.
- Encryption that was tested, not just claimed: A lab reviewed how the app uses cryptography and stores keys.
- No unnecessary access: The app was checked for data minimization and for what it exposes to other apps.
- An honest Google Play data label and control over your data: Transparency and in-app data deletion were both part of the review.
The free Planet VPN Android app went through the same independent assessment. The lab tested the free-to-download Google Play app, and Free and Premium run on that same VPN for Android app.
How to Check That Planet VPN Passed the MASA Audit
You can check Planet VPN’s MASA result on Google Play and in the App Defense Alliance registry in under a minute:
- Open the Planet VPN listing on Google Play. The app is listed as “Planet Free VPN ™ Super Proxy” and the developer name is Free VPN Planet. Make sure it’s the official app, not a look-alike.
- Scroll to Data safety and tap See details.
- Find the “Independent security review” entry.
- Or go straight to the registry entry. It shows the status, validity dates, lab and certification body.
What the MASA Audit Does Not Cover
The MASA audit covers the Planet VPN Android app only. It is not an audit of Planet VPN’s servers, no-logs policy, or infrastructure.
A few more limits to keep in mind:
- Other platforms: Planet VPN for iOS, Windows, macOS, and the browser extensions are not covered by this certificate.
- Build and version: the certificate covers the Google Play release of the Android app (package com.freevpnplanet), version 8.5.7, in its default configuration, tested on Android 17.
- Time: The certificate is valid for 1 year, from 28 October 2026 to 28 October 2027, and must be renewed to stay valid.
- Baseline, not a guarantee: MASA sets a security baseline, not a guarantee against every possible issue.
MASA Audit vs Other VPN Audits
A MASA audit tests the mobile app against a fixed public standard. Other VPN audits look at different parts of the service.
| MASA app assessment | No-logs audit | Penetration test | Open-source code review | |
|---|---|---|---|---|
| What is tested | The mobile app, against MASA requirements based on OWASP MASVS | Server setup and data-handling practices | Chosen systems, attacked as a real intruder would | The published source code |
| Who does it | An ADA-authorized lab, with a certification body issuing the certificate | An audit or accounting firm | A security firm hired by the company | Anyone, or a hired reviewer |
| What it proves | The app meets a common mobile security baseline | Logging practices matched the policy when audited | Specific weaknesses were found and fixed in scope | The code can be inspected for flaws |
| How users can check | Google Play label and public ADA registry entry | Published report or summary, if released | Report summary, if released | Public code repository |
Why Google Play Labels VPN Apps That Passed a Security Review
Google Play shows which VPN apps passed an independent security review because VPN apps handle a large amount of sensitive user data. Google added the “Independent security review” label to the Data safety section in November 2023, starting with VPN apps. You can read Google’s announcement on the Google Security Blog.
FAQ
Has the Planet VPN Android app been independently audited?
Yes. Planet VPN’s Android app passed the MASA audit carried out by Leviathan Security Group, with the evaluation completed on 3 August 2026 and the certificate issued on 28 October 2026. The audit covers the Android app, not Planet VPN’s servers or other platforms.
Does the MASA audit cover the free version of Planet VPN?
Yes. Planet VPN’s MASA audit tested the free-to-download Google Play app, and Free and Premium use that same Android app.
Does the MASA audit apply to Planet VPN on iPhone, Windows or Mac?
No. Planet VPN’s MASA certificate covers the Android app only.
How long is a MASA certification valid?
A MASA certification is valid for 1 year from the issue date. Planet VPN’s certificate 10308 is valid until 28 October 2027.
What does “Independent security review” on Google Play mean?
“Independent security review” means the app passed a MASA assessment at AL2 by an authorized lab. On Planet VPN’s listing, the label appears in the Data safety section.
Which VPN apps have passed a MASA audit?
The full list of apps that passed a MASA audit is public in the App Defense Alliance Certified Products registry, and the Planet VPN Android app is on it as certificate 10308. Ready to try it? Download Planet VPN.