Where the security score comes from
Eight channels, each asking one question of the published record and reading a named set of fields to answer it. They multiply rather than add — the factor beside a channel is what is left after the pressure it found, and open a channel to see every field it read, as it is stored. How the model works
Security fields
67 55 of them feed a channel
Established
31 30 left unknown, 6 not applicable
Completeness
49% the share the model could weigh
Citations
44 across 9 documents
Every value carries what it rests on, and the model weighs the four levels differently. Weight, then how many citations on this record sit at that level:
B weighs 0.85 · 44 here
The weights are methodology.json’s own; a claim seen in the artefact itself counts for more than the same claim reported second-hand. The date at the end of a row is the day that value was last read.
A channel does not price every field it reads. The ones it did are marked along their edge and carry what they added; everything else was read and cost nothing. Only a channel that composes field by field can mark a field at all — the rest price themselves by the parameters printed above their rows.
Still open on this record.
Retention. The privacy policy describes account, payment and analytics data with a 2-year post-use retention window, but never states what, if anything, is retained about a VPN session itself — no mention of connection logs, source IP or timestamps in either direction. Nothing establishes C01_linkable_retention.
No audit of any kind. No transparency report, warrant canary, audit or pentest page exists anywhere in the site's own sitemap. The no-audit finding rests on that absence rather than on a document that says so, which is why it is recorded as a fact about the sitemap rather than a stronger claim.
the rest of what is open — 132 more words
Feature scope undocumented. A kill switch ("Network Lock") is named in the help centre, but no page states which platforms carry it, so U08_kill_switch stays unknown rather than guessed as full or partial coverage. The same gap applies to the full protocol list, split tunneling and simultaneous-device limits: help articles reference these features by name without the setup pages that would confirm scope.
Ownership beyond the registered entity. UDITech Limited is a Hong Kong private company; nothing found names a beneficial owner, parent, or sibling brand, and general web search turned up no press, litigation or breach coverage of FlyVPN at all — which for a service claiming 18 million users is itself notable, though it is silence rather than a finding and is priced as ignorance, not as a clean record.
On the record as a whole.
FlyVPN is operated by UDITech Limited (Hong Kong), launched 2007, claiming 18 million users and 500+ self-built servers across 40+ countries — both are unverified marketing claims (D-level) and not recorded as established facts. The site's Google Play listing (com.flyvpn.android) belongs to an unrelated third-party app ('Hustle Run' / INTELIGENTIAL ENCOD, LLC); the provider's own download page links the correct package, com.fvcorp.flyclient, published by UDITech Limited, which is what this record cites.
RetentionDoes a record exist that links traffic to a person, and who checked?13 fields read · 3 left unknown · 5 not applicable · 55.0 points of pressure×0.450
Composed rather than added: a prior of 0.55 on the none branch, moved by what the paper says (0.0) and by what the practice shows (0.0), at credence 0.0 from the audit and 0.2975 from how the provider engaged, against a severity of 0.55 for what is actually retained.
How the report is publishedV02_report_publication
Computed
×0.083 of a clean record completeness 49%
Where the drop comes from: Retention. It is the channel this record's risk is concentrated in — on its own it takes a clean record to ×0.450, and its bar above is filled to that.
Exposure is recorded as medium and the integrity status as unexamined.
Against the rest of the register, this record sits furthest above on Jurisdiction — ×0.902 where the register averages ×0.680 — and furthest below on Silence, ×0.715 against ×0.927.
Every row above is one field of the published record, and every one of them can be challenged: every row carries Report, or raise something about the record as a whole. A correction with a source behind it is made the same day, and if it moves the score it moves the rank.
