Not recommended

Avast VPN

Commercial VPNCzechiaRank 63 of 68

Paying monthly

— no monthly plan

Paying yearly

$59.88 billed once a year

Coverage

Not published no country list published

Free tier

No paid trial only

1 out of 100

Security

62 out of 100

Usability

Visit site

Offered countries that sit under a logging mandateC09_mandate_countries

unknown

Country of the ultimate beneficial ownerM11_owner_jurisdiction

Owner group cluster keyM15_owner_group

gen digital

Date the current owner took controlM16_control_since

2022-09-12

Role of this brand inside the groupM17_brand_role

principal

Infrastructure shared with cluster siblingsM18_shared_infrastructure

unknown

Total published auditsV10_audit_count

Service class

Commercial VPN — security leads

Security score

1 of 100 · Not recommended

Usability score

62 of 100 · state known · 82% established · 80.6% of the weight read

Legal entity

Avast Software s.r.o., Enterprise Office Center, Pikrtova 1737/1A, 140 00 Prague 4, Czech Republic; UK GDPR representative is NortonLifeLock UK Limited, London

Jurisdiction

Czech Republic

Ultimate owner

Gen Digital Inc. (NASDAQ: GEN), dual-headquartered in Prague, Czech Republic and Tempe, Arizona, USA; Avast Software s.r.o. is a wholly-owned indirect subsidiary of Avast Ltd (UK), itself part of the Gen group since the September 2022 merger

Exposure

Medium · dominant channel: jurisdiction

Retention

Connection timestamps

Latest audit

none · not applicable · None · unknown

Countries with exits

not published

Protocols

OpenVPN WireGuard IKEv2 An obfuscated protocol

Works under active censorship

Claimed to work

Weakest protocol still offered

not applicable

Own DNS inside the tunnel

Yes, on the provider's word

Platforms

Android iOS macOS Windows

Simultaneous devices

Kill switch

On some platforms

Split tunnelling

Available

Signing up

An email address only

Free tier

A trial only

P2P allowed

Allowed on some servers

Major streaming services reachable

unknown

Price, monthly

not published

Price, yearly

$59.88 a year at renewal, billed once

Where the security score comes from

Eight channels, each asking one question of the published record and reading a named set of fields to answer it. They multiply rather than add — the factor beside a channel is what is left after the pressure it found, and open a channel to see every field it read, as it is stored. How the model works

Security fields

67 55 of them feed a channel

Established

29 30 left unknown, 8 not applicable

Completeness

46% the share the model could weigh

Citations

46 across 11 documents

Every value carries what it rests on, and the model weighs the four levels differently. Weight, then how many citations on this record sit at that level:

A weighs 1.00 · 3 hereB weighs 0.85 · 34 hereC weighs 0.70 · 9 here

The weights are methodology.json’s own; a claim seen in the artefact itself counts for more than the same claim reported second-hand. The date at the end of a row is the day that value was last read.

A channel does not price every field it reads. The ones it did are marked along their edge and carry what they added; everything else was read and cost nothing. Only a channel that composes field by field can mark a field at all — the rest price themselves by the parameters printed above their rows.

Still open on this record.

Server fleet and architecture. U02_server_countries, C00_architecture and C08_servers_ownership are unestablished: no official Avast page enumerates the current full list of server locations (only an eight-city torrenting subset and a stale 2018 press figure exist), and nothing states whether Avast owns its hardware or rents it, or whether the exit is provider-operated. C09b_mandate_hosting depends on U02 and stays unknown for the same reason.

Device identifiers and site trackers. C12_device_identifier is unknown: the VPN policy explicitly denies using the Android/iOS advertising ID for Firebase Analytics but does not say the same for the AppsFlyer or Singular attribution SDKs it also names, so no rung can be assigned without guessing. C07b_site_trackers (avast.com's own trackers) and C02/C03/C05 (RAM-only, IP sharing, anonymous payment) were not found on any page opened this session.

the rest of what is open — 134 more words

Launch year and audit hygiene. M07_launch_year is unknown: Avast's own blog shows SecureLine VPN already an established product by July 2013, but no dated announcement states the actual launch year, and the specific years given by affiliate-review sites are not usable as a source. V12-V15 (open source client, reproducible builds, pentest, assurance strength) were not addressed on any official page or the Avast GitHub organisation.

Scope of the FTC finding. X04_owner_group_history records the FTC's 2024 order against Avast Ltd/Avast Software s.r.o./Jumpshot for selling browsing data collected via the Avast Extensions, Avast Secure Browser and Avast antivirus software - the same legal entity that operates SecureLine VPN. The complaint does not name SecureLine VPN anywhere, so X01_documented_lie and X09_incident_handling for the VPN itself are left unknown rather than inheriting a finding made about different products.

On the record as a whole.

Avast SecureLine VPN is operated by Avast Software s.r.o. (Prague), the same GDPR-controller entity named on HideMyAss's privacy policy, under Gen Digital Inc. since the NortonLifeLock-Avast merger closed 2022-09-12.

C01_linkable_retention is recorded connection_timestamps on the VPN Policy's own admission: it retains, for up to 18 months, the cumulative data volume transmitted and the selected VPN location/protocol/server, and separately retains connection attempts/disconnections/errors for 12 months; the same page states plainly that originating IP address, DNS queries, browsing history and transferred data are not retained.

the rest of what is open — 269 more words

That declared scope is materially narrower than what the FTC's February 2024 complaint against Avast Ltd, Avast Software s.r.o. and the now-defunct Jumpshot, Inc. describes: from 2014 to January 2020, Avast's browser extensions (Avast/AVG Online Security), Avast Secure Browser and Avast's antivirus software collected and sold consumers' full browsing URLs, search queries and third-party cookie values in re-identifiable form, despite marketing claiming to block tracking and protect privacy - a $16.5M settlement and a permanent ban on selling browsing data followed.

That complaint (read via pypdf after WebFetch's own HTML conversion garbled the binary PDF) never names SecureLine VPN, so X04_owner_group_history carries the finding as an owner-group/company-history fact (sanctioned_or_prosecuted) while X01/X02/X09 for the VPN itself stay unknown/none rather than importing a different product's documented lie.

X12_store_data_declaration is undisclosed_behaviour: the Google Play Data Safety form for com.avast.android.vpn declares both approximate and precise location as collected and shared, while neither the VPN Policy nor the general Privacy Policy mentions geolocation collection anywhere - only Google Play was checked, Apple's privacy label was not.

U06_censorship_circumvention is claimed, not proven: Avast's own FAQ names a proprietary "Mimic" transport (coded here as obfuscated) as a fallback "in restricted regions", but Avast's own vpn-territory page lists Belarus, China, Iran, Iraq, North Korea, Oman, Turkey, Turkmenistan and the UAE as jurisdictions where VPN use itself carries legal risk rather than as markets the product targets, and no independent measurement of the claim was found.

U04_price_monthly is not_applicable: the product page sells only 1-, 2- and 3-year terms (no month-to-month plan); U04b_price_yearly is $59.88, the discounted first-year total, which the same page states renews at $99.99/yr thereafter.

JurisdictionCan someone compel what exists, without the provider getting a say?5 fields read · 3 left unknown · 80.1 points of pressure×0.199

Where the company sits 0.6, where its owner sits 0.45, the exits it offers 0.05, the gag-order regime 0.05.

Hosting in the mandate countries it offersC09b_mandate_hosting

unknown

nothing published · recorded as asserted

Report a problem with C09b_mandate_hosting

Incorporation country mandates retentionC10_company_under_mandate

yes

Bavast.com13 Sep 2026

Report a problem with C10_company_under_mandate

Beneficial owner sits under a retention regimeC11_owner_under_mandate

yes

Bgendigital.com13 Sep 2026

Report a problem with C11_owner_under_mandate

Response to a national logging mandatealso read by ignoranceP04_mandate_response

unknown

nothing published · recorded as asserted

Report

Computed

×0.014 of a clean record completeness 46%

Where the drop comes from: Jurisdiction. It is the channel this record's risk is concentrated in — on its own it takes a clean record to ×0.199, and its bar above is filled to that.

Exposure is recorded as medium and the integrity status as clean.

Against the rest of the register, this record sits furthest above on Silence — ×1.000 where the register averages ×0.927 — and furthest below on Jurisdiction, ×0.199 against ×0.680.

Published score

Every row above is one field of the published record, and every one of them can be challenged: every row carries Report, or raise something about the record as a whole. A correction with a source behind it is made the same day, and if it moves the score it moves the rank.

Specification

Carried, never scored

What changed

If this one is not right

Avast VPN

Proton VPN

Mullvad VPN

IVPN

Where the security score comes from