Where the security score comes from
Eight channels, each asking one question of the published record and reading a named set of fields to answer it. They multiply rather than add — the factor beside a channel is what is left after the pressure it found, and open a channel to see every field it read, as it is stored. How the model works
Security fields
67 55 of them feed a channel
Established
29 37 left unknown, 1 not applicable
Completeness
44% the share the model could weigh
Citations
45 across 16 documents
Every value carries what it rests on, and the model weighs the four levels differently. Weight, then how many citations on this record sit at that level:
A weighs 1.00 · 6 hereB weighs 0.85 · 37 hereC weighs 0.70 · 2 here
The weights are methodology.json’s own; a claim seen in the artefact itself counts for more than the same claim reported second-hand. The date at the end of a row is the day that value was last read.
A channel does not price every field it reads. The ones it did are marked along their edge and carry what they added; everything else was read and cost nothing. Only a channel that composes field by field can mark a field at all — the rest price themselves by the parameters printed above their rows.
Still open on this record.
No independent audit. No evidence of a third-party audit, pentest or source review of Avira Phantom VPN was found on Avira's own site or in its support knowledge base; the whole V-block stands unknown. A published no-logs audit, even a limited one, would be the single fact that moves this record most.
Support claim and privacy policy disagree on IP address. Avira's VPN support article states it does not track "your real IP address," while the same product's privacy policy lists IP address as collected Product Data with no stated deletion window. The record follows the policy, the more authoritative and more specific of the two documents, and flags the gap rather than picking the flattering line.
the rest of what is open — 123 more words
The mobile client is bundled, not standalone. Phantom VPN ships inside the single "Avira Security Antivirus & VPN" Android app rather than as its own listing, so the Play Data Safety declaration (which names shared device identifiers and collected precise location) cannot be attributed to the VPN module alone. App-SDK, tracker and store-declaration fields are left unknown for this reason rather than charged to the VPN on a mixed-app signal.
Server hardware and DNS handling are undocumented. Avira names "server providers" in its third-party-data note, which is read as rented infrastructure, but nothing on its site states RAM-only operation, in-tunnel DNS, IP-sharing model or what the exit does to passing traffic, so those capability fields stand unknown rather than assumed favourable or adverse.
On the record as a whole.
Avira Phantom VPN's mobile apps (Android, iOS) are delivered inside the combined "Avira Security" app, not as a dedicated VPN app; desktop has its own Phantom VPN installer. U07_protocols is read from Avira's own support article on VPN ports: OpenVPN/TCP 443 on Windows, Mac and Android, IPsec (UDP 500/4500) on iOS, Mac App Store and Microsoft Store builds — the article does not name IKE version, so it is coded as the generic ipsec token rather than ikev2.
The kill switch is documented by Avira itself as a Windows-only feature ("Kill switch (Windows Feature)"), coded partial since no other platform is named. Avira Phantom VPN is withdrawn from India over that country's data-logging mandate (P04_mandate_response); the India-specific CERT-In rule that triggered this is well known but its effective date was not independently verified here, so the field is dated to the day this session read Avira's current banner, not to the regulation's own date.
the rest of what is open — 113 more words
X04_owner_group_history records the FTC's 2024 order against sibling brand Avast/Jumpshot for selling browsing data, which is a fact about the current owner (Gen Digital) rather than about Avira's own VPN; cluster contagion into Avira's own score additionally requires a dated X01/X02 finding on the Avast record itself, which this session did not check.
P11_gag_order_regime is read from Germany's G10 Act: surveillance requests against German residents go through a parliamentary G10 Commission rather than a court, and notification to the affected person can be delayed or, in narrow cases, withheld — closer to secret_order_possible than to a court-only (judicial_only) regime, though this rests on a government-authority summary page rather than the statute text itself.
RetentionDoes a record exist that links traffic to a person, and who checked?13 fields read · 12 left unknown · 75.0 points of pressure×0.250
Composed rather than added: a prior of 0.55 on the none branch, moved by what the paper says (0.0) and by what the practice shows (0.0), at credence 0.0 from the audit and 0.2975 from how the provider engaged, against a severity of 0.75 for what is actually retained.
How the report is publishedV02_report_publication
unknown
nothing published · recorded as
Computed
×0.045 of a clean record completeness 44%
Where the drop comes from: Retention. It is the channel this record's risk is concentrated in — on its own it takes a clean record to ×0.250, and its bar above is filled to that.
Exposure is recorded as medium and the integrity status as caught_lying.
Against the rest of the register, this record sits furthest above on Jurisdiction — ×0.900 where the register averages ×0.680 — and furthest below on Retention, ×0.250 against ×0.432.
Every row above is one field of the published record, and every one of them can be challenged: every row carries Report, or raise something about the record as a whole. A correction with a source behind it is made the same day, and if it moves the score it moves the rank.
