Reference
Every value on a provider page carries a state, an origin, a date and a source grade before it carries a number. This page defines all of it, plus the eight channels the security score is built from and the VPN vocabulary underneath.
01
A record is not a table of answers. It is a table of answers, each with what it rests on and when anyone last confirmed it — which is why a field can be filled and still be worth almost nothing to the score.
9 terms
As of as_of
The day the value was last confirmed — not the day the page was built. Each field carries its own life before a re-check is due: 30 days for prices, 90 for server counts and enforcement history, 180 for architecture and retention, 365 for audits and company facts.
Completeness completeness
What share of the fields that could have been answered were. It is a property of the research, not a compliment to the provider — a thin record and a bad record look nothing alike, and this is the number that tells them apart.
Field identifier C01, U07, V04
The permanent name of a question. The letter is its block — C capability, M company facts, P pressure and enforcement, V verification, X integrity, U usability — and the number never gets reused. Identifiers are printed beside every value on a record so a correction can name exactly one field.
Key gaps key_gaps
Written prose naming what was not established and what would settle it — a weaker assurance grade than the marketing implies, a finding that rests on one reading of a document, a field left open on purpose. It is the counterweight to a single number and is printed with the score rather than hidden behind a link.
Material hash material_hash
A fingerprint of the fields that can actually change a score. If a re-import leaves the hash where it was, nothing material moved and the record's updated date does not move either. It is what stops a page claiming freshness it did not earn.
Origin origin
Where a value came from. document means a document was read, derived means a rule computed it from other fields, and asserted means the provider says so and nobody has checked. There is no fourth origin: a value either has a citation behind it, was computed from values that do, or rests on the provider's word.
The register holds 3,285 documented values against 2,875 asserted ones, and 460 of those assertions sit on a field that is actually settled. They are stored the same way and weighed very differently: an unexamined favourable claim regresses towards the market prior, while an admission against interest keeps its full weight.
Scored scored
Whether any channel or the usability score reads this field at all. 1,001 of the 6,160 fields on file are not scored — real facts that move no number. Without the flag a reader has no way to tell them from the ones that decide a verdict.
Source grade level
How much a source counts. A is a primary document — an audit report, a court record, a transparency report — and counts fully. B counts at 0.85, C at 0.7, and D, the provider's own marketing, at 0.35. The register runs on 580 A-grade sources, 3,200 B, 289 C and 26 D.
State state
One of known, unknown, not_applicable. It separates we have an answer from nobody has published one from the question does not apply here. Across the register 42% of security fields are unknown — 2,143 of 5,159 — and that is a fact about the market's disclosure rather than about our effort.
02
Two numbers, never averaged. Security decides the order on its own; usability is printed beside it and settles nothing but a tie.
7 terms
Cap and floor
No channel may exceed 0.9: certainty is not available from a document review, and a model reaching 1.0 would be claiming it. In the other direction a single finding can pin a channel from below — a persistent hardware identifier held by the provider sets a floor under retention that no audit can lift.
Channel breakdown.channels
One route by which a user could be identified, carrying a probability between 0 and 1. Every provider page prints all eight with the fields that fed them, which is what makes the arithmetic checkable rather than assertable.
No data usability.state
A statement about the research rather than the provider, on either axis. A no_data security verdict means too little is published to place the record: no of the 77 carry one, no list ranks them, and each keeps its page. Where usability.state is no_data the usability figure is a floor rather than a placement — too little was published to say where the provider actually sits. Ten of the 77 are in that position. They stay in the register and in every filter, marked rather than hidden.
Security score
0 to 100, and the only thing the ranking follows. It is built from eight risk channels, each the probability that this particular route identifies the user, combined as 100 × ∏(1 − risk). A large risk on any one channel drags the whole product down on its own; small risks accumulate gently rather than being rounded away.
Service class service_class
What kind of thing this is, printed with every score because the two are meaningless apart: commercial_vpn, censorship_tool, browser_proxy, p2p_exit, decentralized. 59 of the 77 are commercial VPNs, and decentralized is currently empty.
Usability score
0 to 100 from twelve weighted fields — among them coverage, price, free tier, circumvention, protocols, kill switch, devices, streaming and P2P. It is a weighted mean over the fields that carry a value, so a provider is not punished for a field nobody has filled for anyone. It is never averaged with security and never lifts a provider over a better-scoring one; the one thing it decides is which of two records with the same security score is listed first.
Verdict and the five bands verdict
A word read straight off the security integer, so a provider cannot carry a label that disagrees with its number: strong 75 and above, acceptable 55–74, weak 35–54, insufficient 15–34, not recommended below 15.
03
Each one is a question, and each is answered from named fields. The breakdown on a provider page shows what every channel cost and why.
8 terms
Architecture
Who operates the exit? Usually costs nothing, and occasionally decides the whole record: a service routing traffic through unrelated third parties' devices carries a risk here that no amount of good policy elsewhere can offset.
Disclosure
Has it already handed something over? The one channel built entirely on events rather than policies: seizures where data was obtained, court records of compelled production, disclosure history. Content disclosed is close to disqualifying; account data alone is priced far lower.
Hygiene
What identifying material is collected in passing, and can the client be checked at all? Ten small fields — RAM-only servers, IP sharing, signup without email, anonymous payment, DNS in the tunnel, third-party SDKs, server ownership, open source, reproducible builds, pentests. Individually cheap, capped together, and a reliable read on whether anyone is paying attention.
Ignorance
How much of this did nobody establish? The channel that prices our own blind spots, driven by how much of the record is missing. It is the reason an unexamined provider ranks below a researched one rather than beside it.
Posture earns relief: a maintained warrant canary, a fresh transparency report with numbers, an incident disclosed promptly, or a physical withdrawal from a country that imposed a logging mandate. None of them is a claim about logging — each is behaviour that would be awkward to fake.
Integrity
Has it been caught saying one thing and doing another? Documented lies, gaps between marketing and audit findings, ownership opacity, the owner group's track record, and how the free tier is paid for. Small marketing tells — absolute anonymity claims, lifetime-subscription pushes, coverage that exists only on affiliate sites — each add a little.
Jurisdiction
Can someone compel what exists, without the provider getting a say? Read from where the company is registered and where its beneficial owner sits — a mandate over the owner counts for less than one over the company, but it counts.
Retention
Does a record exist that links traffic to a person, and who checked? The heaviest channel in the model. It reads the retention field, the device identifier, and everything about the audit that would confirm or undercut it — auditor category, assurance standard, how the report was published, whether the scope was the whole fleet or a sample.
Silence
Ten years, millions of users, and nothing on record? A provider with real exposure — years operating × user scale × hostile jurisdictions — and no seizure, no court record and no transparency report is not thereby proven clean. Low exposure costs nothing here; high exposure with an empty file costs a little.
04
The terms behind the field identifiers — what each one actually asks of a provider, and why the answer costs what it costs.
15 terms
Audit scope V04_scope_servers
Whether an audit covered the whole fleet or a sample of it. A no-logs opinion over a sample is a statement about the servers the auditor was shown. The model prices the difference rather than treating both as “audited”.
Device identifier C12_device_identifier
A persistent handle on your device that the provider itself holds, scaling from an app-scoped id through a resettable advertising id to a persistent hardware id. This is the field that can make a clean no-logs report beside the point: nothing was written down about your traffic, and you are nameable anyway.
DNS inside the tunnel C06_own_dns_in_tunnel
Whether name lookups are resolved by the provider's own resolvers inside the tunnel. If they leak to the network's default resolver, an observer learns every site you visit without ever seeing your traffic.
Kill switch U08_kill_switch
Blocks traffic when the tunnel drops instead of quietly letting it out over the ordinary connection. The failure it prevents is the one nobody notices while it is happening.
Linkable retention C01_linkable_retention
What record exists that could link traffic to a person — asked of the evidence on file rather than of what a provider says about its logging. Five answers, in order of what they cost: none_linkable, aggregates_only, session_metadata, source_ip, activity.
Logging mandate C09, C10, C11
A national requirement that VPN operators retain user records. Some of the countries on file impose one. It matters in two places: the country the company is registered in, and the countries its fleet has servers in — different questions with different consequences.
P2P exit nodes C00_architecture
An architecture where traffic exits through other users' devices rather than the operator's servers, usually in exchange for a free tier. Nobody operates the exit, which is both the whole proposition and the whole problem — and it means someone else's traffic may exit through you.
Protocols U07_protocols
Every tunnelling protocol a client speaks, as a list. The field used to carry the single fastest one; since schema 3.4.0 it carries all of them, which is what makes the weakest one visible. WireGuard is small, fast and modern; OpenVPN is older, slower and still shipped nearly everywhere; L2TP, PPTP and SSTP are legacy, and offering one is what C13_weakest_protocol names and the protocol floor prices. Vendor names — NordLynx, Lightway, Hydra, Chameleon — are implementations rather than protocols; NordLynx counts as WireGuard, which is what it is.
RAM-only servers C02_ram_only
Servers running from volatile memory with no disk, so a seizure yields nothing that survived the power being cut. Cheap to claim and hard to verify, which is why the field distinguishes yes_verified from yes_declared.
Reproducible builds V13_reproducible_builds
Whether anyone can rebuild the published app from published source and get a byte-identical binary. Open source says what the code does; reproducible builds say the code is what you are running.
Server countries U02_server_countries
The countries a provider actually enumerates as holding an exit location — the list, not a number. Where a provider publishes no list the field is unknown rather than filled from its marketing, so any count you see here is the length of something you can check. 27 of the 77 publish no list at all; the 41 that do cover 180 countries between them.
Shared and dedicated IPs C03_ip_sharing
A shared exit address puts many users behind one IP, which is the crowd a VPN is partly for. A dedicated IP is yours alone — better for services that block shared ranges, worse for the thing you came for.
Split tunneling U09_split_tunneling
Sending some applications through the tunnel and others around it. Convenient, and a decision about what stays exposed — which is why it sits on the usability axis rather than the security one.
Transparency report P05_transparency_report
A periodic count of requests received and how many were answered with data. Graded on whether it is fresh and carries numbers — and cross-checked for plausibility, since zero requests at mass scale over years is a claim about the world, not about policy.
Warrant canary P07_warrant_canary
A published statement that no secret order has been received, updated on a schedule so that its absence carries the message the operator is forbidden to send. Only useful if maintained: stale and removed are recorded separately, and a canary that quietly stopped is not a neutral event.