Where the security score comes from
Eight channels, each asking one question of the published record and reading a named set of fields to answer it. They multiply rather than add — the factor beside a channel is what is left after the pressure it found, and open a channel to see every field it read, as it is stored. How the model works
Security fields
67 55 of them feed a channel
Established
31 29 left unknown, 7 not applicable
Completeness
50% the share the model could weigh
Citations
39 across 7 documents
Every value carries what it rests on, and the model weighs the four levels differently. Weight, then how many citations on this record sit at that level:
B weighs 0.85 · 22 hereC weighs 0.70 · 17 here
The weights are methodology.json’s own; a claim seen in the artefact itself counts for more than the same claim reported second-hand. The date at the end of a row is the day that value was last read.
A channel does not price every field it reads. The ones it did are marked along their edge and carry what they added; everything else was read and cost nothing. Only a channel that composes field by field can mark a field at all — the rest price themselves by the parameters printed above their rows.
Still open on this record.
The owner-group fields. M08 (user scale), M15/M16/M17 (owner-group cluster key, control-since date, precise brand role) and M18 (shared infrastructure) are unestablished: Gen Digital's own brand page names Norton, Avast, LifeLock and MoneyLion but not a specific acquisition date for HMA itself, and this catalogue does not yet carry another Gen-owned VPN brand to anchor a cluster key against, so M15 is left unknown rather than invented as a new slug on a single data point.
Which jurisdiction compels. P11_gag_order_regime is left unknown rather than guessed: M06 is Czech Republic (the GDPR Controller, Avast Software s.r.o.) while the ultimate owner is US-domiciled, and this pass did not establish which jurisdiction's secret-order regime actually governs a compelled request against HMA's own infrastructure - the two are not obviously the same question. P08/P09 (current request counts) are unknown because HMA publishes no transparency report at all (P05=none).
the rest of what is open — 100 more words
What no page carried. U02 (server countries), U07 (protocols), U08 (kill switch), U10 (simultaneous devices - the pricing page states '5 or 10 devices' without clearly binding either figure to a specific plan tier this pass could disambiguate) and the full V12-V15 hygiene block were not found on any page opened.
Two values that changed reading. C10/C11 diverge from the prior (v1, uncorrected) record, which read them as no: countries.csv lists both CZ (M06) and US (M11) as under_mandate=yes, so both are recorded yes here against the project's current mandate table rather than ported from the earlier, apparently stale, reading.
On the record as a whole.
HMA is one of two entries in this pass (with Hotspot Shield) that reads not as a denial contradicted later, but as a service that disclosed its retention practice openly and then honoured a lawful order under it - the useful negative case against X02=denied_then_proven.
The no-log-policy page states directly: 'you're anonymous even to us' regarding original IP address, immediately beside an admission that HMA retains 'the day you connect and general time (morning or evening)' and 'the amount of data transmitted, rounded to the hundredth Mb' for 35 days - the exact figures the 2011 LulzSec case shows were used in practice.
the rest of what is open — 373 more words
The Register's contemporaneous report on the Cody Kretsinger/Sony Pictures case quotes HMA's own account: it logged 'the time a customer logs onto and disconnects from the service as well as the IP addresses he or she connects to,' produced under what HMA called a court order it likened to a US subpoena, and defended the disclosure by pointing to its own terms of service rather than denying that logging occurred.
That is why X01_documented_lie is recorded none (no gap between a specific denial and later proof - HMA never denied logging in the first place, then or since) while X02_claim_gap is marketing_overstates (the 'anonymous even to us' framing oversells what the same page's own retention admission supports, without there being a specific falsified claim to point to).
Ownership: the GDPR Controller is Avast Software s.r.o. in Prague; Avast's UK representative is named as NortonLifeLock UK Limited, which independently confirms the tie to what is now Gen Digital Inc. (NASDAQ: GEN) - Gen's own brand page names Norton, Avast, LifeLock and MoneyLion as its consumer brands and states dual headquarters in Prague and Tempe, Arizona.
C07a_app_sdk is recorded attribution (the worst of the three SDKs the no-log page itself names for mobile: Firebase for analytics, Crashlytics for crash reporting, and AppsFlyer, which HMA's own text says exists to tell its 'marketing teams' 'which ads worked' - install attribution is exactly what AppsFlyer is for) - the desktop client is separately stated to use no third-party tools at all, so C07a is scoped to the mobile finding, the worse of the two.
Refresh 2026-09-13 (U04/U04b): hidemyass.com/en-us/pricing currently sells only a 12-month and a 36-month term, no month-to-month plan at all, so U04_price_monthly is now not_applicable rather than the $11.99/mo the prior fill carried - that figure was the 12-month plan's undiscounted renewal rate ($143.88/yr divided by twelve), not a standalone monthly price.
U04b_price_yearly is corrected to $59.88, the discounted total actually charged at checkout for the 12-month plan's first term; the page states the renewal reverts to $143.88/yr ($11.99/mo) once the offer period ends. A 36-month plan is also offered at $107.64 first term ($2.99/mo equivalent), renewing at $431.64 per 36 months; neither is recorded in a field since neither term is monthly or annual.
JurisdictionCan someone compel what exists, without the provider getting a say?5 fields read · 3 left unknown · 80.1 points of pressure×0.199
Where the company sits 0.6, where its owner sits 0.45, the exits it offers 0.05, the gag-order regime 0.05.
Response to a national logging mandatealso read by ignoranceP04_mandate_response
unknown
nothing published · recorded as asserted
ReportComputed
×0.027 of a clean record completeness 50%
Where the drop comes from: Jurisdiction. It is the channel this record's risk is concentrated in — on its own it takes a clean record to ×0.199, and its bar above is filled to that.
Exposure is recorded as medium and the integrity status as caught_lying.
Against the rest of the register, this record sits furthest above on Integrity — ×0.864 where the register averages ×0.658 — and furthest below on Jurisdiction, ×0.199 against ×0.680.
Every row above is one field of the published record, and every one of them can be challenged: every row carries Report, or raise something about the record as a whole. A correction with a source behind it is made the same day, and if it moves the score it moves the rank.
