Where the security score comes from
Eight channels, each asking one question of the published record and reading a named set of fields to answer it. They multiply rather than add — the factor beside a channel is what is left after the pressure it found, and open a channel to see every field it read, as it is stored. How the model works
Security fields
67 55 of them feed a channel
Established
36 29 left unknown, 2 not applicable
Completeness
55% the share the model could weigh
Citations
49 across 11 documents
Every value carries what it rests on, and the model weighs the four levels differently. Weight, then how many citations on this record sit at that level:
A weighs 1.00 · 5 hereB weighs 0.85 · 44 here
The weights are methodology.json’s own; a claim seen in the artefact itself counts for more than the same claim reported second-hand. The date at the end of a row is the day that value was last read.
A channel does not price every field it reads. The ones it did are marked along their edge and carry what they added; everything else was read and cost nothing. Only a channel that composes field by field can mark a field at all — the rest price themselves by the parameters printed above their rows.
Still open on this record.
Protocols. U07_protocols is left unknown: the app auto-selects transports with no user-facing picker, and no page names WireGuard, Shadowsocks or any other transport explicitly. The public repository's own build manifest lists WireGuard, Shadowsocks and several obfuscation layers as compiled in, but that is a dependency list, not a customer-facing statement, so it is not enough to fill the field.
Corporate history. The 2022 court correspondence names the operating entity as "Innovate Labs, LLC", while the current site names "Brave New Software Project, Inc." throughout. Nothing on the site documents a transition between the two, so M16_control_since and the clean read on X03_owner_transparency rest on the current site only, not on a reconciliation of the two names.
the rest of what is open — 85 more words
No audit found. No independent audit, pentest or reproducible-build claim appears anywhere on the site, the FAQ or the transparency report. This was searched for, not merely absent from the fields checked, so the whole V block reads unknown rather than no.
Fleet and countries. Lantern does not let a customer pick or see an exit country ("users are automatically assigned to specific servers"), and no server-country list is published anywhere found, so U02_server_countries and everything derived from it stay unknown rather than assumed empty.
On the record as a whole.
Lantern is a censorship-circumvention tool operated by Brave New Software Project, Inc., a US 501(c)(3) nonprofit, rather than a conventional commercial VPN; M12_service_class = censorship_tool follows AUDITOR.md's rule that what the product is for outranks the fact that it also sells a paid "Pro" tier (the same reasoning the record book applies to Psiphon).
The Google Play data-safety form declares approximate location is shared with third parties for "Analytics, Advertising or marketing" purposes; this appears nowhere in the privacy policy, which states the opposite ("We do not sell or share your personal information with advertisers") and never mentions location at all — the basis for X12_store_data_declaration = undisclosed_behaviour and C07a_app_sdk = ads.
the rest of what is open — 108 more words
Two documented legal demands exist in eleven years of transparency reporting (a 2020 US grand-jury subpoena and a 2022 French MLAT request relayed through the US DOJ), both resolved as "no information disclosed" with the underlying court records read directly; the 2022 matter also documents a two-year non-disclosure order attached to the underlying 18 U.S.C. §2703(d) order, which is the basis for P11_gag_order_regime = nsl_equivalent.
The transparency report/warrant-canary page is structured as a running canary but its most recent period covers only through 2025-07-30, more than a year before this audit, with no newer period posted — read as stale on both P05 and P07 rather than fresh.
JurisdictionCan someone compel what exists, without the provider getting a say?5 fields read · 2 left unknown · 62.0 points of pressure×0.380
Where the company sits 0.6, where its owner sits 0.45, the exits it offers 0.05, the gag-order regime 0.2 — one circumstance, priced once rather than compounded.
Response to a national logging mandatealso read by ignoranceP04_mandate_response
unknown
nothing published · recorded as asserted
ReportComputed
×0.086 of a clean record completeness 55%
Where the drop comes from: Jurisdiction. It is the channel this record's risk is concentrated in — on its own it takes a clean record to ×0.380, and its bar above is filled to that.
Exposure is recorded as high and the integrity status as unexamined.
Against the rest of the register, this record sits furthest above on Retention — ×0.716 where the register averages ×0.432 — and furthest below on Jurisdiction, ×0.380 against ×0.680.
Every row above is one field of the published record, and every one of them can be challenged: every row carries Report, or raise something about the record as a whole. A correction with a source behind it is made the same day, and if it moves the score it moves the rank.
