Where the security score comes from
Eight channels, each asking one question of the published record and reading a named set of fields to answer it. They multiply rather than add — the factor beside a channel is what is left after the pressure it found, and open a channel to see every field it read, as it is stored. How the model works
Security fields
67 55 of them feed a channel
Established
45 18 left unknown, 4 not applicable
Completeness
73% the share the model could weigh
Citations
66 across 12 documents
Every value carries what it rests on, and the model weighs the four levels differently. Weight, then how many citations on this record sit at that level:
A weighs 1.00 · 13 hereB weighs 0.85 · 53 here
The weights are methodology.json’s own; a claim seen in the artefact itself counts for more than the same claim reported second-hand. The date at the end of a row is the day that value was last read.
A channel does not price every field it reads. The ones it did are marked along their edge and carry what they added; everything else was read and cost nothing. Only a channel that composes field by field can mark a field at all — the rest price themselves by the parameters printed above their rows.
Still open on this record.
Audit scope. The one published third-party review, X41 D-Sec's 2026 penetration test, is a white-box code review and hardware pentest of the shared AzireVPN/Malwarebytes infrastructure, not a dedicated no-logs engagement; it found two critical and eight medium vulnerabilities, mostly patched, and its only relevant finding is that server images discard log messages and disable local/SSH access. It does not state what a session retains, so V11_audit_findings is not_stated rather than the marketing page's stronger claim.
A quoted line could not be verified in its own document. Malwarebytes' blog post on the audit quotes the "final report" saying testers "did not observe evidence of user activity logging;" neither that phrase nor a close paraphrase appears anywhere in the 55-page public PDF linked from the same post, whose own executive summary says only that images discard log messages. Recorded as X02_claim_gap = marketing_overstates.
the rest of what is open — 150 more words
Ownership and scale are open. No page found this session discloses Malwarebytes' ultimate beneficial owner, investor cap table, or a VPN-specific user count, so M09, M11, M07 and M08 stay unknown; C11_owner_under_mandate and P11_gag_order_regime follow from M11 and were not established either.
A documented legal request has no month-level date. AzireVPN's transparency report shows two valid legal requests in 2023 that yielded zero data, supporting P02_disclosure_history = none_known and P03_court_record = unable_to_produce, but it gives only the year. P12_case_history needs at least a year-month, so no dated event could be written and the retention channel earns no practice credit here; a session with AzireVPN's own blog or incident archive might find the specific month.
Several fields were not reached this session. C03_ip_sharing, C07a_app_sdk, C14_traffic_modification, U06_censorship_circumvention, U09_split_tunneling, U12b_streaming_works and X12_store_data_declaration would need the Play Store data-safety form and App Store privacy label read in full, which this session did not reach.
On the record as a whole.
Malwarebytes Privacy VPN runs on AzireVPN's infrastructure since Malwarebytes acquired AzireVPN in November 2024 (previously the product was built on a different partner's network); AzireVPN keeps its own Stockholm team and brand. The X41 D-Sec penetration test (2026-03-31) covers the shared infrastructure behind both AzireVPN and Malwarebytes Privacy VPN.
U04b_price_yearly ($49.99) is Malwarebytes Privacy VPN standalone, 3 devices, first term; the checkout states the renewal fee is the same $49.99, so there is no promotional discount gap on this plan. U10_simultaneous_devices (20) is the marketing page's stated ceiling ('up to 20 devices depending on your plan'), not the 3-device entry tier priced above.
JurisdictionCan someone compel what exists, without the provider getting a say?5 fields read · 3 left unknown · 1 not applicable · 63.1 points of pressure×0.369
Where the company sits 0.6, where its owner sits 0.03, the exits it offers 0.0, the gag-order regime 0.05.
Response to a national logging mandatealso read by ignoranceP04_mandate_response
Computed
×0.103 of a clean record completeness 73%
Where the drop comes from: Jurisdiction. It is the channel this record's risk is concentrated in — on its own it takes a clean record to ×0.369, and its bar above is filled to that.
Exposure is recorded as low and the integrity status as caught_lying.
Against the rest of the register, this record sits furthest above on Ignorance — ×0.820 where the register averages ×0.662 — and furthest below on Jurisdiction, ×0.369 against ×0.680.
Every row above is one field of the published record, and every one of them can be challenged: every row carries Report, or raise something about the record as a whole. A correction with a source behind it is made the same day, and if it moves the score it moves the rank.
