Where the security score comes from
Eight channels, each asking one question of the published record and reading a named set of fields to answer it. They multiply rather than add — the factor beside a channel is what is left after the pressure it found, and open a channel to see every field it read, as it is stored. How the model works
Security fields
67 55 of them feed a channel
Established
31 35 left unknown, 1 not applicable
Completeness
46% the share the model could weigh
Citations
41 across 12 documents
Every value carries what it rests on, and the model weighs the four levels differently. Weight, then how many citations on this record sit at that level:
A weighs 1.00 · 4 hereB weighs 0.85 · 34 hereC weighs 0.70 · 3 here
The weights are methodology.json’s own; a claim seen in the artefact itself counts for more than the same claim reported second-hand. The date at the end of a row is the day that value was last read.
A channel does not price every field it reads. The ones it did are marked along their edge and carry what they added; everything else was read and cost nothing. Only a channel that composes field by field can mark a field at all — the rest price themselves by the parameters printed above their rows.
Still open on this record.
Independent audit. No independent audit of F-Secure's own VPN service was found, and none is claimed on its own site. F-Secure's security team is itself a paid auditor for other VPN providers (for example ExpressVPN's Windows app), which is evidence of the firm's competence as an auditor, not evidence about F-Secure VPN's own logging practice or app security.
Server footprint. F-Secure states "over 20 countries" of virtual locations but publishes no citable machine-readable or page-based list of which countries these are, so U02_server_countries and everything derived from it — the mandate-country intersection, the hosting question — stay unknown rather than assembled from review sites.
the rest of what is open — 77 more words
Backend operator. F-Secure's own privacy notice names a third-party provider (Pango) as operating the VPN, but says nothing about whether that infrastructure is owned or rented, whether DNS resolution happens on Pango's or F-Secure's own resolvers, or whether servers are RAM-only.
Practical usability. No citable F-Secure page states its P2P/torrenting policy or which streaming services work over the service, so both fields stay unknown rather than guessed at from review sites that are forbidden as sources here.
On the record as a whole.
F-Secure VPN is a feature of the F-Secure consumer app (formerly branded FREEDOME, renamed in the February 2023 app relaunch). Since a March 2025 backend update the app offers WireGuard and a proprietary "Hydra" transport and dropped IKEv2; OpenVPN was added back for Windows ARM64 in June 2025.
F-Secure's own VPN privacy notice (effective May 2026) discloses that "the new VPN feature" runs on a named third-party provider, Pango — the same company behind the Hydra protocol and behind Hotspot Shield/AnchorFree's white-label VPN business; this is a first-party admission, not an inference from the protocol name.
the rest of what is open — 205 more words
The site advertises a "30-day money-back guarantee" on purchases, which is a refund window, not a free tier; the actual no-payment trial is 5 days and requires a My F-Secure account (email). U04b_price_yearly is the cheapest 1-device/1-year plan (EUR49.99, converted at Mullvad's own stated EUR/USD rate of 1.16 since F-Secure states no rate of its own); 3- and 5-device tiers run EUR69.99 and EUR79.99/year respectively.
On 14-15 January 2019, acting on an urgent German mutual-assistance request in an investigation into suspected aggravated sexual abuse of a child, Finland's National Bureau of Investigation ordered FREEDOME VPN to preserve and then seized log data identifying which IP address one user's VPN connection had reached.
The Helsinki District Court (10.5.2019 no. 1077), the Helsinki Court of Appeal (21.10.2020 no. 1445) and the Supreme Court of Finland (KKO:2022:23, 5.4.2022, ECLI:FI:KKO:2022:23) all held the seizure unlawful — a VPN provider is a communications intermediary and this identification data fell under the seizure and copying prohibition of Coercive Measures Act chapter 7 section 4 — and ordered the logs destroyed.
The published decision anonymises the company as "A Oyj"; the identification as F-Secure comes from HH Partners, the law firm that represented F-Secure Oyj before the Supreme Court in this case.
RetentionDoes a record exist that links traffic to a person, and who checked?13 fields read · 10 left unknown · 75.0 points of pressure×0.250
Composed rather than added: a prior of 0.55 on the none branch, moved by what the paper says (0.0) and by what the practice shows (0.3373), at credence 0.3373 from the audit and 0.2975 from how the provider engaged, against a severity of 0.75 for what is actually retained.
How the report is publishedV02_report_publication
Computed
×0.060 of a clean record completeness 46%
Where the drop comes from: Retention. It is the channel this record's risk is concentrated in — on its own it takes a clean record to ×0.250, and its bar above is filled to that.
Exposure is recorded as medium and the integrity status as unexamined.
Against the rest of the register, this record sits furthest above on Integrity — ×1.000 where the register averages ×0.658 — and furthest below on Retention, ×0.250 against ×0.432.
Every row above is one field of the published record, and every one of them can be challenged: every row carries Report, or raise something about the record as a whole. A correction with a source behind it is made the same day, and if it moves the score it moves the rank.
