Where the security score comes from
Eight channels, each asking one question of the published record and reading a named set of fields to answer it. They multiply rather than add — the factor beside a channel is what is left after the pressure it found, and open a channel to see every field it read, as it is stored. How the model works
Security fields
67 55 of them feed a channel
Established
33 18 left unknown, 16 not applicable
Completeness
64% the share the model could weigh
Citations
64 across 15 documents
Every value carries what it rests on, and the model weighs the four levels differently. Weight, then how many citations on this record sit at that level:
B weighs 0.85 · 57 hereC weighs 0.70 · 7 here
The weights are methodology.json’s own; a claim seen in the artefact itself counts for more than the same claim reported second-hand. The date at the end of a row is the day that value was last read.
A channel does not price every field it reads. The ones it did are marked along their edge and carry what they added; everything else was read and cost nothing. Only a channel that composes field by field can mark a field at all — the rest price themselves by the parameters printed above their rows.
Still open on this record.
Who owns Hola. Ownership is the largest hole and the reason X03 reads opaque: no page Hola publishes names a parent, a shareholder or an officer, so M09, M11 and M15 stay unknown and the group fields with them. An Israeli Corporations Authority extract would close all four at once.
The identifier the label will not name. C12 is the second: the Apple privacy label declares a Device ID linked to identity and used for the developer's own advertising, but neither the label nor the policy says which identifier, so the rung is unestablished and no floor is applied - the iOS binary or an Android data-safety form would settle it.
the rest of what is open — 131 more words
A location list that lists nothing. U02 is unknown because the page that purports to list locations enumerates every ISO country in code order with blank server and peer counts; a real fleet list or a server API would replace it.
The infrastructure nobody describes. C02 and C06 stay unanswered because no Hola document describes RAM-only storage or in-tunnel DNS handling on the premium side. C08 moves off unknown: the FAQ states Premium runs on "a dedicated network of high performance servers" that paying users only use and do not contribute device resources to, distinct from the free peer-to-peer network - so exits are not solely other users' devices. Whether those dedicated servers are owned outright, rented, or operated through Bright Data is not stated anywhere Hola or Bright Data publish.
On the record as a whole.
Two products under one brand, and they are not the same architecture. The free tier routes through other users' devices - the terms call it the Value Exchange and say other Hola devices may use your connection and resources - while Premium is sold as freedom from exactly that, on a dedicated server network.
C00 records the free product, which is the one the catalogue is about. The FAQ adds a wrinkle worth keeping: the browser extensions, the iOS app and the Android build from Google Play are not peers, so the exit-node exposure lands on the Windows desktop client and the Android build taken from hola.org.
the rest of what is open — 420 more words
X01 rests on Hola's own two documents disagreeing in the present tense. The FAQ says "Hola keeps your information private and does not pass it on to any third party" and "we don't collect any of your personal information"; the privacy policy, last updated 14 April 2026, says it may collect and retain IP address, name and e-mail, that browser-extension log data may include browsing history, that Log Data is kept up to twelve months, and that Personal Information including Log Data is disclosed on subpoena.
The same FAQ also says that when Hola senses dubious activity "we are able to see the source of the request and help law enforcement get to the cyber criminal". C01 is filled from the policy, not from the FAQ.
The launch year is stated three different ways on the provider's own site: the About timeline opens at 2012, the FAQ says both "since 2012 when we started" and "Hola was founded in 2008", and the Premium page says sixteen years in business. M07 takes 2012, the value two of the three pages support and the one that claims the least exposure.
The terms bind free users to the Bright Data SDK EULA at bright-sdk.com/eula. That host does not resolve - NXDOMAIN, checked twice - so the agreement a user is told they have accepted cannot be read at the address the contract gives.
Bright Data itself is separately owned: its own history page dates its acquisition by EMK Capital to 2017 and never mentions Hola. M10 therefore records the residential-proxy business as Hola's own commercial line, evidenced by Hola's FAQ ("Hola charges validated corporations for use of the network") rather than by a shared parent.
P11 follows the Criminal Procedure (Enforcement Powers - Communication Data) Law 2007, which opens a second route beside the court order: a senior police officer may order a transfer without a warrant for up to twenty-four hours. The law addresses telecommunication service providers, and whether a VPN operator falls inside that definition is not settled by the source cited.
V01 is "no" rather than unknown: the FAQ's security section is where an audit would be named, and what it offers instead is a Google Sheets link that answers with a login page. No audit is claimed anywhere on the site.
IntegrityHas it been caught saying one thing and doing another?16 fields read · 1 left unknown · 3 not applicable · 90.0 points of pressure×0.100
What this channel priced on this record:Lie 0.6Monetisation 0.55Incident handling 0.2Store declaration 0.3Owner transparency 0.4Report concealment 0.15Owner group history 0.25
Computed
×0.001 of a clean record completeness 64%
Where the drop comes from: Integrity. It is the channel this record's risk is concentrated in — on its own it takes a clean record to ×0.100, and its bar above is filled to that.
Exposure is recorded as high and the integrity status as caught_lying.
Against the rest of the register, this record sits furthest above on Jurisdiction — ×0.829 where the register averages ×0.680 — and furthest below on Architecture, ×0.250 against ×0.900.
Every row above is one field of the published record, and every one of them can be challenged: every row carries Report, or raise something about the record as a whole. A correction with a source behind it is made the same day, and if it moves the score it moves the rank.
