Where the security score comes from
Eight channels, each asking one question of the published record and reading a named set of fields to answer it. They multiply rather than add — the factor beside a channel is what is left after the pressure it found, and open a channel to see every field it read, as it is stored. How the model works
Security fields
67 55 of them feed a channel
Established
22 45 left unknown, 0 not applicable
Completeness
34% the share the model could weigh
Citations
40 across 10 documents
Every value carries what it rests on, and the model weighs the four levels differently. Weight, then how many citations on this record sit at that level:
A weighs 1.00 · 2 hereB weighs 0.85 · 38 here
The weights are methodology.json’s own; a claim seen in the artefact itself counts for more than the same claim reported second-hand. The date at the end of a row is the day that value was last read.
A channel does not price every field it reads. The ones it did are marked along their edge and carry what they added; everything else was read and cost nothing. Only a channel that composes field by field can mark a field at all — the rest price themselves by the parameters printed above their rows.
Still open on this record.
Server footprint. AVG publishes only "more than 100 server locations" and never a country list; the one dated document naming actual places lists eight torrent-enabled data centres (Prague, Frankfurt, Amsterdam, New York, Miami, Seattle, London, Paris), a named subset rather than the fleet. U02_server_countries and everything derived from it stay unknown rather than guessed from that subset.
No audit found. Neither the VPN policy nor the support site names an independent audit, pentest or transparency report for AVG Secure VPN specifically, so the whole V-block and P05/P07 stand unknown. This is an access-and-search gap, not a finding: a document may exist and not be indexed where this session looked.
the rest of what is open — 102 more words
Store versus policy on location. Google Play's data-safety form for this app declares collecting precise location and sharing approximate location for advertising and marketing; the linked privacy policy never mentions location at all. X12_store_data_declaration records this as undisclosed behaviour; whether it reflects the current app build or a stale store listing was not established.
Payment and anonymity. The VPN policy defers questions about billing to unnamed "payment providers" and points to a separate general privacy policy for details, without itself naming a card processor, cash option or crypto option; C05_payment_anonymous stays unknown rather than being read as an absence of anonymous methods.
On the record as a whole.
Operated by Avast Software s.r.o. (Prague), under Gen Digital Inc. since the NortonLifeLock-Avast merger closed 2022-09-12; Avast itself had acquired AVG Technologies N.V. in a 2016 tender offer, so the current ownership is one step removed from AVG's original corporate history.
The FTC's 2024 order against Avast Software s.r.o. (for selling browsing data collected by antivirus and browser-extension products through the Jumpshot subsidiary) concerns those products, not this VPN client directly; it is recorded under X04_owner_group_history as the operating entity's own regulatory record, not as a finding about VPN logging.
AVG Secure VPN's protocol menu is IPsec, with a proprietary "Mimic" obfuscation mode for restrictive networks; no WireGuard or OpenVPN option is offered. Kill switch, protocol selection and P2P (limited to eight named data centres) are documented in the AVG Secure VPN FAQ (support.avg.com); this article covers Windows/Mac/Android/iOS in one page and was read as a whole rather than per platform tab, so a platform-specific gap in any of these features is possible.
IntegrityHas it been caught saying one thing and doing another?16 fields read · 9 left unknown · 66.5 points of pressure×0.335
What this channel priced on this record:Monetisation 0.2Absolute claims 0.04Cluster contagion 0.04Store declaration 0.3Owner group history 0.35
Transparency reportalso read by ignorance, silenceP05_transparency_report
unknown
Computed
×0.046 of a clean record completeness 34%
Where the drop comes from: Integrity. It is the channel this record's risk is concentrated in — on its own it takes a clean record to ×0.335, and its bar above is filled to that.
Exposure is recorded as low and the integrity status as unexamined.
Against the rest of the register, this record sits furthest above on Jurisdiction — ×0.849 where the register averages ×0.680 — and furthest below on Integrity, ×0.335 against ×0.658.
Every row above is one field of the published record, and every one of them can be challenged: every row carries Report, or raise something about the record as a whole. A correction with a source behind it is made the same day, and if it moves the score it moves the rank.
