Hoxx was assessed by the HushFleet team and placed in the Not recommended band, with a security score of 3/100; too little is published to place its usability score. In the overall security ranking of VPN providers it ranks 52 of 68. Commercial VPN, company jurisdiction United States.
7 fields sit on this record without entering the score, and the contract says so in the field itself: scored: false. They are here because a reader asking who owns this company, or who signed the audit, is asking something the record answers — and because a value that never touches the arithmetic should be visibly outside it rather than quietly mixed in.
Alternatives
Not recommended
Paying monthly
— no monthly plan
Paying yearly
— no yearly plan
Coverage
Not published no country list published
Free tier
Yes limited free plan
Security
Usability
| Service class | Commercial VPN — security leads |
|---|---|
| Security score | 3 of 100 · Not recommended |
| Usability score | 63 of 100 · state no_data · 25% established · 35.3% of the weight read |
| Legal entity | Hoxx Inc. |
| Jurisdiction | United States |
| Ultimate owner | Hoxx Inc. |
| Exposure | Medium · dominant channel: retention |
| Retention | What was reached: sites, destinations or content |
| Latest audit | unknown · unknown · unknown · unknown |
| Countries with exits | not published |
| Protocols | unknown |
| Works under active censorship | Claimed to work |
| Weakest protocol still offered | unknown |
| Own DNS inside the tunnel | unknown |
| Platforms | WindowsAndroidiOSmacOSLinuxBrowser extension |
| Simultaneous devices | unknown |
| Kill switch | unknown |
| Split tunnelling | unknown |
| Signing up | unknown |
| Free tier | A free tier with limits |
| P2P allowed | unknown |
| Major streaming services reachable | unknown |
| Price, monthly | not published |
| Price, yearly | not published |
| Offered countries that sit under a logging mandateC09_mandate_countries | unknown |
|---|---|
| Country of the ultimate beneficial ownerM11_owner_jurisdiction | US |
| Owner group cluster keyM15_owner_group | independent |
| Date the current owner took controlM16_control_since | unknown |
| Role of this brand inside the groupM17_brand_role | principal |
| Infrastructure shared with cluster siblingsM18_shared_infrastructure | separate |
| Total published auditsV10_audit_count | unknown |
Coverage147countries
Paying monthly$9.99monthly
Paying yearly$53.88yearly total
Free tierYeslimited free plan
Devices10at once
Security
Usability
Coverage50countries
Paying monthly$5.69monthly
Paying yearly$69.60yearly total
Free tierNopaid plans only
Devices5at once
Security
Usability
Coverage41countries
Paying monthly$6.00monthly
Paying yearly$60.00yearly total
Free tierNopaid plans only
Devices5at once
Security
Usability
Eight channels, each asking one question of the published record and reading a named set of fields to answer it. They multiply rather than add — the factor beside a channel is what is left after the pressure it found, and open a channel to see every field it read, as it is stored. How the model works
Security fields
67 55 of them feed a channel
Established
31 35 left unknown, 1 not applicable
Completeness
51% the share the model could weigh
Citations
31 across 8 documents
Every value carries what it rests on, and the model weighs the four levels differently. Weight, then how many citations on this record sit at that level:
B weighs 0.85 · 30 hereC weighs 0.70 · 1 here
The weights are methodology.json’s own; a claim seen in the artefact itself counts for more than the same claim reported second-hand. The date at the end of a row is the day that value was last read.
A channel does not price every field it reads. The ones it did are marked along their edge and carry what they added; everything else was read and cost nothing. Only a channel that composes field by field can mark a field at all — the rest price themselves by the parameters printed above their rows.
Still open on this record.
Server footprint. Hoxx claims "50+ locations worldwide" and says it adds new servers every week, but publishes no dated country list anywhere in its navigation, so U02_server_countries and everything derived from it (C09_mandate_countries, C09b_mandate_hosting) stay unknown. A published server-location page would close this.
Exact pricing. The pricing page advertises Premium "From $1.99/Month" but states that purchases happen only inside the client app via in-app purchase, with no month-to-month figure or annual total shown anywhere on the public site. U04_price_monthly and U04b_price_yearly stay unknown until the in-app purchase screen itself is read.
No independent audit. Nothing on hoxx.com, in the FAQ, or in press coverage mentions a third-party security or no-logs audit, a transparency report, or a warrant canary. The whole V-block and P05/P07 stay unknown rather than "none", since failing to find one in a search is not the same as a documented absence.
Protocol and platform internals. No protocol name (WireGuard, OpenVPN, IKEv2 or otherwise) appears anywhere on the download, pricing, or support pages, even though those pages describe the client in some technical detail, so U07_protocols and the field derived from it, C13_weakest_protocol, stay unknown rather than resting on a guess about what a browser-extension proxy is likely to use underneath.
On the record as a whole.
Hoxx is a browser-extension-first proxy/VPN (Chrome, Firefox, Edge add-ons plus native Windows, macOS, Linux, Android and iOS clients) operated by a single Florida-registered entity, Hoxx Inc., with no disclosed parent or sibling brand. The free tier carries a daily bandwidth quota; Premium removes it. M08_user_scale ("protected more than 7 million clients since 2014") is the provider's own unverified figure, cited at B only because it is a plain factual claim on its own domain, not because it has been independently checked anywhere.
Composed rather than added: a prior of 0.55 on the none branch, moved by what the paper says (0.0) and by what the practice shows (0.0), at credence 0.0 from the audit and 0.2975 from how the provider engaged, against a severity of 0.88 for what is actually retained.
Retention linkable to a person as declaredmaterialC01_linkable_retention
activity
Bhoxx.com13 Sep 2026
Report a problem with C01_linkable_retentionPersistent device identifier the provider holdsC12_device_identifier
resettable_ad_id
Bhoxx.comBapps.apple.com13 Sep 2026
Report a problem with C12_device_identifierAt least one independent auditmaterialV01_audit_exists
unknown
nothing published · recorded as asserted
Computed
×0.028 of a clean record completeness 51%
Where the drop comes from: Retention. It is the channel this record's risk is concentrated in — on its own it takes a clean record to ×0.120, and its bar above is filled to that.
Exposure is recorded as medium and the integrity status as caught_lying.
Against the rest of the register, this record sits furthest above on Integrity — ×0.850 where the register averages ×0.658 — and furthest below on Retention, ×0.120 against ×0.432.
Published score
3Every row above is one field of the published record, and every one of them can be challenged: every row carries Report, or raise something about the record as a whole. A correction with a source behind it is made the same day, and if it moves the score it moves the rank.
How the report is publishedV02_report_publication
unknown
nothing published · recorded as asserted
Subject of the latest auditV03_audit_subject
unknown
nothing published · recorded as asserted
Server fleet coverageV04_scope_servers
unknown
nothing published · recorded as asserted
Auditor categoryV06_firm_category
unknown
nothing published · recorded as asserted
Assurance standardV07_audit_standard
unknown
nothing published · recorded as asserted
Date of latest reportmaterialV08_audit_date_latest
unknown
nothing published · recorded as asserted
Audit cadenceV09_audit_regularity
unknown
nothing published · recorded as asserted
What the report states is retainedV11_audit_findings
unknown
nothing published · recorded as asserted
Strength of the assurance opinionV15_assurance_strength
unknown
nothing published · recorded as asserted
Chronology of documented enforcement eventsP12_case_history
nothing published · recorded as asserted
Priced from what is missing: 0.51 of the weighted record is established, on a slope of 0.9 under a cap of 0.6, with a posture of 0.0 relieved by 0.4.
Record completenessS08_completeness
51%
derived from the record itself
Response to a national logging mandatealso read by jurisdictionP04_mandate_response
unknown
nothing published · recorded as asserted
Transparency reportalso read by silence, integrityP05_transparency_report
unknown
nothing published · recorded as asserted
Reported numbers plausible for this scalealso read by integrityP06_report_plausibility
unknown
nothing published · recorded as asserted
Warrant canary disciplinealso read by disclosureP07_warrant_canary
unknown
nothing published · recorded as asserted
Security incident and how it was disclosedalso read by integrityX09_incident_handling
none_known
nothing published · recorded as asserted
Where the company sits 0.03, where its owner sits 0.03, the exits it offers 0.05, the gag-order regime 0.2 — one circumstance, priced once rather than compounded.
Hosting in the mandate countries it offersC09b_mandate_hosting
unknown
nothing published · recorded as asserted
Incorporation country mandates retentionC10_company_under_mandate
unknown
nothing published · recorded as asserted
Beneficial owner sits under a retention regimeC11_owner_under_mandate
unknown
nothing published · recorded as asserted
Response to a national logging mandatealso read by ignoranceP04_mandate_response
unknown
nothing published · recorded as asserted
Secret-order regime in the incorporation countryP11_gag_order_regime
nsl_equivalent
Ceff.org13 Sep 2026
Report a problem with P11_gag_order_regimeA capped sum — the one channel that adds: 0.185 of a possible 0.28, from the fields marked below.
RAM-only diskless serversC02_ram_only
unknown+0.018
nothing published · recorded as asserted
IP allocation modelC03_ip_sharing
unknown+0.012
nothing published · recorded as asserted
Signup without emailC04_signup_no_email
no+0.025
Bhoxx.com13 Sep 2026
Report a problem with C04_signup_no_emailAnonymous payment optionsC05_payment_anonymous
crypto_processor+0.010
Own DNS inside the tunnelC06_own_dns_in_tunnel
unknown+0.012
nothing published · recorded as asserted
Worst third-party SDK category in the appC07a_app_sdk
ads+0.040
Bapps.apple.com13 Sep 2026
Report a problem with C07a_app_sdkWorst third-party tracker category on the siteC07b_site_trackers
ads+0.020
Bhoxx.com13 Sep 2026
Report a problem with C07b_site_trackersWho owns the hardwareC08_servers_ownership
unknown+0.009
nothing published · recorded as asserted
Weakest protocol still offeredC13_weakest_protocol
unknown
nothing published · recorded as asserted
Client source code publishedV12_client_open_source
unknown+0.018
nothing published · recorded as asserted
Reproducible buildsV13_reproducible_builds
unknown+0.014
nothing published · recorded as asserted
Separate client or infrastructure pentestV14_pentest_exists
unknown+0.007
nothing published · recorded as asserted
12 years in operation at 0.015 a year under a cap of 0.3, weighted 1.0: the rule fired.
Year the service launchedM07_launch_year
2014
Bhoxx.com13 Sep 2026
Report a problem with M07_launch_yearUser base scale (mass >=10M, mid >=1M, niche <1M)also read by integrityM08_user_scale
mid
Bhoxx.com13 Sep 2026
Report a problem with M08_user_scaleServer seizure by law enforcementalso read by disclosureP01_seizure_event
none_known
nothing published · recorded as asserted
Court record of compelled productionalso read by disclosureP03_court_record
none_known
nothing published · recorded as asserted
Transparency reportalso read by ignorance, integrityP05_transparency_report
unknown
nothing published · recorded as asserted
What this channel priced on this record:Lie 0.15
User base scale (mass >=10M, mid >=1M, niche <1M)also read by silenceM08_user_scale
mid
Bhoxx.com13 Sep 2026
Report a problem with M08_user_scaleOther businesses of the owner groupM10_owner_other_business
none_disclosed
Transparency reportalso read by ignorance, silenceP05_transparency_report
unknown
nothing published · recorded as asserted
Reported numbers plausible for this scalealso read by ignoranceP06_report_plausibility
unknown
nothing published · recorded as asserted
Documented gap between claim and behaviourX01_documented_lie
lie_about_features
Marketing versus audit findingsX02_claim_gap
unknown
nothing published · recorded as asserted
Ownership structure transparencyX03_owner_transparency
clear
Adverse events on the owner group recordX04_owner_group_history
unknown
nothing published · recorded as asserted
How the service is paid forX05_monetisation_model
freemium_funded
Bhoxx.com13 Sep 2026
Report a problem with X05_monetisation_modelClaims of 100% anonymity or military-grade cryptoX06_absolute_claims
unknown
nothing published · recorded as asserted
Aggressive lifetime subscriptionsX07_lifetime_push
no
Bhoxx.com13 Sep 2026
Report a problem with X07_lifetime_pushCoverage exists only on affiliate sitesX08_affiliate_only_reviews
no
Bhoxx.com13 Sep 2026
Report a problem with X08_affiliate_only_reviewsSecurity incident and how it was disclosedalso read by ignoranceX09_incident_handling
none_known
nothing published · recorded as asserted
Affiliate programme and payout tierX10_affiliate_program
none
Bhoxx.com13 Sep 2026
Report a problem with X10_affiliate_programOwner-run review media discloses the tieX11_review_media_disclosure
not applicable
nothing published · recorded as asserted
App store data declaration against the provider's own policyX12_store_data_declaration
matches_policy
Bhoxx.comBapps.apple.com13 Sep 2026
Report a problem with X12_store_data_declarationContagion from the owner groupS18_cluster_contagion
0.0
no owner group on this record, so nothing to carry
What this channel priced on this record:Price 0.05
Who operates the exitC00_architecture
provider_operated+0.000
Bhoxx.com13 Sep 2026
Report a problem with C00_architectureWhat the exit does to passing trafficC14_traffic_modification
unknown+0.050
nothing published · recorded as asserted
Server seizure by law enforcementalso read by silenceP01_seizure_event
none_known
nothing published · recorded as asserted
Actual disclosure historyP02_disclosure_history
none_known
nothing published · recorded as asserted
Court record of compelled productionalso read by silenceP03_court_record
none_known
nothing published · recorded as asserted
Warrant canary disciplinealso read by ignoranceP07_warrant_canary
unknown
nothing published · recorded as asserted
Requests received in periodP08_requests_received
unknown
nothing published · recorded as asserted
Requests where data was providedP09_data_provided
unknown
nothing published · recorded as asserted
