Where the security score comes from
Eight channels, each asking one question of the published record and reading a named set of fields to answer it. They multiply rather than add — the factor beside a channel is what is left after the pressure it found, and open a channel to see every field it read, as it is stored. How the model works
Security fields
67 55 of them feed a channel
Established
29 36 left unknown, 2 not applicable
Completeness
47% the share the model could weigh
Citations
51 across 21 documents
Every value carries what it rests on, and the model weighs the four levels differently. Weight, then how many citations on this record sit at that level:
B weighs 0.85 · 51 here
The weights are methodology.json’s own; a claim seen in the artefact itself counts for more than the same claim reported second-hand. The date at the end of a row is the day that value was last read.
A channel does not price every field it reads. The ones it did are marked along their edge and carry what they added; everything else was read and cost nothing. Only a channel that composes field by field can mark a field at all — the rest price themselves by the parameters printed above their rows.
Still open on this record.
No independent audit. No third-party auditor has examined AdGuard VPN's servers, infrastructure or no-logs claim; the record's retention finding rests entirely on the provider's own privacy notices and transparency report, unverified from outside.
Server hardware and IP model undocumented. Whether servers are owned or rented, RAM-only or disk-based, and whether exit IPs are shared among users or dedicated, is not stated anywhere found on the provider's own site or knowledge base.
Physical vs virtual hosting in mandate countries unknown. The 61-country server list offered spans many data-retention jurisdictions, but no page states which of those locations run on real hardware there versus virtual routing from elsewhere.
the rest of what is open — 33 more words
Owners unnamed. The company page says AdGuard Software Limited is run by "three founders" but names none of them, so ownership transparency rests on the registered corporate entity alone, not on identified individuals.
On the record as a whole.
Two of the provider's own pages disagree on fleet size: the welcome page advertises "75+ locations" while the free-vs-unlimited knowledge-base article says paid users get "all 85+ locations" — the 61-country list in U02 is read off the welcome page's rendered list, the higher count is not itemised anywhere found.
The VPN protocol, TrustTunnel, was open-sourced by AdGuard itself (Apache-licensed, spec and reference client/server on GitHub via trusttunnel.org) and is the only protocol the shipping apps expose (HTTP/2 or QUIC as transport, no WireGuard/OpenVPN/IKEv2 option in-app). Native apps (Windows, Mac, Android, iOS) are closed-source and ship only a public bug tracker on GitHub; the browser extension is GPL-3.0 and genuinely open.
the rest of what is open — 109 more words
Crypto payments are accepted but the checkout does not name a processor, so C05 is coded crypto_processor rather than crypto_direct on the conservative assumption of third-party processing.
M07_launch_year reads 2020, from AdGuard's own blog post (dated 2020-01-27) saying the browser extension was already in public beta and "about to officially hit the digital shelves of Chrome Web Store" — this is the earliest documented public form of the service. The Windows desktop app reached its own v1.0 only in August 2021; that date remains cited alongside the 2020 one because it is the more precise, unambiguous release event, even though it describes one platform rather than the service's origin.
RetentionDoes a record exist that links traffic to a person, and who checked?13 fields read · 11 left unknown · 75.0 points of pressure×0.250
Composed rather than added: a prior of 0.55 on the none branch, moved by what the paper says (0.0) and by what the practice shows (0.0), at credence 0.0 from the audit and 0.2975 from how the provider engaged, against a severity of 0.75 for what is actually retained.
How the report is publishedV02_report_publication
Computed
×0.115 of a clean record completeness 47%
Where the drop comes from: Retention. It is the channel this record's risk is concentrated in — on its own it takes a clean record to ×0.250, and its bar above is filled to that.
Exposure is recorded as low and the integrity status as unexamined.
Against the rest of the register, this record sits furthest above on Integrity — ×1.000 where the register averages ×0.658 — and furthest below on Retention, ×0.250 against ×0.432.
Every row above is one field of the published record, and every one of them can be challenged: every row carries Report, or raise something about the record as a whole. A correction with a source behind it is made the same day, and if it moves the score it moves the rank.
