Where the security score comes from
Eight channels, each asking one question of the published record and reading a named set of fields to answer it. They multiply rather than add — the factor beside a channel is what is left after the pressure it found, and open a channel to see every field it read, as it is stored. How the model works
Security fields
67 55 of them feed a channel
Established
41 23 left unknown, 3 not applicable
Completeness
62% the share the model could weigh
Citations
56 across 11 documents
Every value carries what it rests on, and the model weighs the four levels differently. Weight, then how many citations on this record sit at that level:
A weighs 1.00 · 14 hereB weighs 0.85 · 42 here
The weights are methodology.json’s own; a claim seen in the artefact itself counts for more than the same claim reported second-hand. The date at the end of a row is the day that value was last read.
A channel does not price every field it reads. The ones it did are marked along their edge and carry what they added; everything else was read and cost nothing. Only a channel that composes field by field can mark a field at all — the rest price themselves by the parameters printed above their rows.
Still open on this record.
Owner-group history. X04_owner_group_history and the cluster-contagion channel depend on the Pango/AnchorFree group's own record, including the 2017 CDT/FTC complaint that this catalogue's Hotspot Shield record already cites -- but that document was not reopened in this session against Betternet specifically, so X01 and X04 stay unknown here rather than importing a finding second-hand.
Infrastructure hygiene. The Aon engagement explicitly excluded "security measures for the protection of Pango data" and hosting-environment best practices, so C02_ram_only, C06_own_dns_in_tunnel and C08_servers_ownership have no document to stand on and are unknown; nothing on the public site addresses them either.
Pricing and the free tier. Only the monthly plan ($12.99/mo, $1.99 first month) was reached through checkout, so whether a yearly plan still exists is unestablished; the free product is confirmed ad-supported and limited to the US virtual location by default, but its exact feature gate against Premium (bandwidth, server count, protocol choice) was not read off a single source and is not represented field by field.
On the record as a whole.
Betternet is a Pango Group brand: the privacy policy names "Betternet LLC, a division of the Pango Group" and one paragraph carries an unedited template artifact ("which UltraAV web pages or app features are used"), confirming the policy is shared verbatim across Pango's VPN brands rather than written per-brand.
Pango's own site (pango.co) links its careers page to pointwild.com, and pointwild.com self-describes as the parent that has "acquired and integrated 50+ companies" -- Point Wild is recorded as M09_owner_ultimate on that basis, though neither site states the relationship in so many words.
the rest of what is open — 196 more words
The support-centre footer reads "Betternet Technologies Inc.", which does not match "Betternet LLC" in the privacy policy and terms -- both point to the same Boston address, so this reads as a stale footer string rather than a second entity, but it was not resolved.
The only audit found is a 2023-08-25 Aon "Summary Report" (itself the only document Pango published, not an excerpt of a longer one) confirming two narrow claims -- no identity-linked browsing log, no IP/device correlation with browsing -- while leaving general infrastructure security out of scope; V11 is read from the report's own Table 1 of collected categories (device hash, approximate location, diagnostic timestamps), not from an independent log inspection.
The country list at U02 is Betternet's own "Virtual Location" page, which brands every entry as virtual by name (including "India via Singapore"), which is the basis for C09b=virtual_only across the board rather than a per-country finding.
Pricing, device limit and payment method reflect the single funnel this session reached (order.betternet.co, card only, $12.99/mo renewal, 10 devices); no separate annual plan was found in that funnel despite the product page once advertising one, so U04b is left unknown rather than guessed.
RetentionDoes a record exist that links traffic to a person, and who checked?13 fields read · 1 not applicable · 54.6 points of pressure×0.454
Composed rather than added: a prior of 0.55 on the stated branch, moved by what the paper says (0.0356) and by what the practice shows (0.0), at credence 0.0356 from the audit and 0.56 from how the provider engaged, against a severity of 0.45 for what is actually retained.
At least one independent auditmaterialV01_audit_exists
yes_verified
Abetternet.co25 Aug 2023
Computed
×0.097 of a clean record completeness 62%
Where the drop comes from: Retention. It is the channel this record's risk is concentrated in — on its own it takes a clean record to ×0.454, and its bar above is filled to that.
Exposure is recorded as low and the integrity status as clean.
Against the rest of the register, this record sits furthest above on Silence — ×1.000 where the register averages ×0.927 — and furthest below on Hygiene, ×0.720 against ×0.808.
Every row above is one field of the published record, and every one of them can be challenged: every row carries Report, or raise something about the record as a whole. A correction with a source behind it is made the same day, and if it moves the score it moves the rank.
