Where the security score comes from
Eight channels, each asking one question of the published record and reading a named set of fields to answer it. They multiply rather than add — the factor beside a channel is what is left after the pressure it found, and open a channel to see every field it read, as it is stored. How the model works
Security fields
67 55 of them feed a channel
Established
26 38 left unknown, 3 not applicable
Completeness
38% the share the model could weigh
Citations
37 across 10 documents
Every value carries what it rests on, and the model weighs the four levels differently. Weight, then how many citations on this record sit at that level:
B weighs 0.85 · 33 hereC weighs 0.70 · 4 here
The weights are methodology.json’s own; a claim seen in the artefact itself counts for more than the same claim reported second-hand. The date at the end of a row is the day that value was last read.
A channel does not price every field it reads. The ones it did are marked along their edge and carry what they added; everything else was read and cost nothing. Only a channel that composes field by field can mark a field at all — the rest price themselves by the parameters printed above their rows.
Still open on this record.
Audit identity. Bitdefender's own support page (published 2025-06) states an independent audit verified its VPN infrastructure keeps no logs, but names no auditing firm, states no assurance standard, and links to no published report. The claim is recorded as a declaration rather than a verified finding; naming the firm and locating any report would establish V05 through V07 and V11.
Law-enforcement history. No transparency report, warrant canary, court record or seizure account for Bitdefender's VPN could be located this session, on Bitdefender's own site or elsewhere. P01, P02, P03 and P11 stay unknown rather than none_known because no document was found that actually addresses the question, so a genuine absence cannot be told apart from one nobody has published yet.
Infrastructure and app internals. Server hardware ownership, RAM-only design, in-tunnel DNS operator, IP-sharing model, anonymous payment options and the client app's own third-party SDKs were not established from a primary document this session and stay unknown; the same is true of the app-store data-safety declaration against the privacy policy (X12), which would need a full read of the general Bitdefender privacy notice beyond the VPN-specific section.
On the record as a whole.
Bitdefender Premium VPN's own privacy policy (v10.4, 2026-08-18) names IPVanish as the data processor operating the VPN infrastructure on Bitdefender's instructions; the current protocol list (WireGuard, OpenVPN, IKEv2) confirms this, since third-party reviews from recent years instead describe the service as a Hotspot Shield/Pango white label running the proprietary Hydra protocol, which Bitdefender's own support page confirms was discontinued. The record follows the current primary sources.
Bitdefender's own pages disagree on Fire TV support: a marketing summary implies Firestick compatibility while the VPN FAQ explicitly states Bitdefender VPN cannot be used on Firestick because it is not listed in the Amazon Appstore; the FAQ's explicit statement is treated as authoritative and Fire TV is not recorded as a supported platform.
The yearly plan's first-term charge is $34.99 (U04b_price_yearly); the page states it renews at $69.99/yr. A support page published 2025-06 claims an independent audit verified the no-logs policy but names no auditing firm and links no report, recorded as V01=yes_declared / V02=none rather than a verified finding.
JurisdictionCan someone compel what exists, without the provider getting a say?5 fields read · 2 left unknown · 79.1 points of pressure×0.209
Where the company sits 0.6, where its owner sits 0.45, the exits it offers 0.0, the gag-order regime 0.05.
Computed
×0.030 of a clean record completeness 38%
Where the drop comes from: Jurisdiction. It is the channel this record's risk is concentrated in — on its own it takes a clean record to ×0.209, and its bar above is filled to that.
Exposure is recorded as low and the integrity status as unexamined.
Against the rest of the register, this record sits furthest above on Integrity — ×1.000 where the register averages ×0.658 — and furthest below on Jurisdiction, ×0.209 against ×0.680.
Every row above is one field of the published record, and every one of them can be challenged: every row carries Report, or raise something about the record as a whole. A correction with a source behind it is made the same day, and if it moves the score it moves the rank.
