Where the security score comes from
Eight channels, each asking one question of the published record and reading a named set of fields to answer it. They multiply rather than add — the factor beside a channel is what is left after the pressure it found, and open a channel to see every field it read, as it is stored. How the model works
Security fields
67 55 of them feed a channel
Established
42 21 left unknown, 4 not applicable
Completeness
69% the share the model could weigh
Citations
55 across 16 documents
Every value carries what it rests on, and the model weighs the four levels differently. Weight, then how many citations on this record sit at that level:
A weighs 1.00 · 13 hereB weighs 0.85 · 40 hereC weighs 0.70 · 2 here
The weights are methodology.json’s own; a claim seen in the artefact itself counts for more than the same claim reported second-hand. The date at the end of a row is the day that value was last read.
A channel does not price every field it reads. The ones it did are marked along their edge and carry what they added; everything else was read and cost nothing. Only a channel that composes field by field can mark a field at all — the rest price themselves by the parameters printed above their rows.
Still open on this record.
Server footprint has no enumerated list. Mozilla states an aggregate "500+ servers in 30+ countries" but publishes no country-by-country list of its own; its own "see our list of servers" link points to infrastructure partner Mullvad's full public fleet (563 servers, 50 countries), which is materially larger than what Mozilla itself claims to offer. Citing Mullvad's complete list would overstate the footprint actually sold under the Mozilla VPN product, so U02_server_countries stays unknown.
The 90-day IP retention may or may not touch the tunnel. The privacy notice states "your IP address is temporarily collected as part of our server logs for 90 days" under a general, cross-product data-collection section, while a separate sentence says "No logs of your network activity are maintained by either Mozilla nor our partner Mullvad ... in any circumstance." It is unclear whether the 90-day figure covers only account/API server logs or also touches active VPN connections; the record takes the worst reading available in the provider's own document.
the rest of what is open — 245 more words
Whichever reading is correct would move the score most. A clarifying statement from Mozilla about what the 90-day server logs actually contain — account/API activity only, or also live VPN sessions — would settle C01_linkable_retention and the X02_claim_gap finding at once, since both rest on the same ambiguous sentence.
No infrastructure or no-logs audit exists, only a client pentest. The one published Cure53 report (March 2021) is scoped to the five desktop/mobile apps and their APIs; it never examined server-side retention, so V11_audit_findings is not_stated rather than confirming the no-logs claim. An earlier internal review from August 2020 is mentioned in the same report but was never separately published.
Kill switch, P2P, streaming and censorship-circumvention claims could not be confirmed. Mozilla's support site (support.mozilla.org) returned repeated HTTP 429 rate-limit responses to both a headless browser and a direct fetch across three attempts in this session, so the FAQ pages that would normally answer these questions were never read. This is an access failure, not a finding, and these fields stay unknown.
The transparency report with actual government-request numbers has gone stale. Mozilla's newest published report, dated 2026-02-27, follows the EU's DSA template and covers only content-moderation statistics for the Firefox Add-ons Marketplace; it carries no personal-data or law-enforcement request counts. The last report with those numbers covers July-December 2024, and the page announcing the DSA report promised a traditional-format report with 2025's numbers "later this spring" (2026) that had not appeared as of this session.
On the record as a whole.
Mozilla VPN's exit network is operated by Mullvad under a commercial partnership ("Mozilla partners with Mullvad to privately and securely encrypt your internet traffic"), not by Mozilla's own infrastructure; C00/C08 reflect that. Pricing: $9.99/mo month-to-month, $59.88 first-term annual ($4.99/mo equivalent); the product page shows no separate renewal rate for the annual plan, so note has nothing further to add there.
Cure53's PDF conclusion describes "only one" exploitable vulnerability (Medium); Mozilla's own blog post about the same report instead says "two medium and one high severity issues" were found — the two documents disagree on the count, and the PDF (opened and read in full, level A) is treated as authoritative here.
RetentionDoes a record exist that links traffic to a person, and who checked?13 fields read · 3 left unknown · 1 not applicable · 75.0 points of pressure×0.250
Composed rather than added: a prior of 0.55 on the silent branch, moved by what the paper says (0.0067) and by what the practice shows (0.0), at credence 0.0067 from the audit and 0.5652 from how the provider engaged, against a severity of 0.75 for what is actually retained.
How the report is published
Computed
×0.089 of a clean record completeness 69%
Where the drop comes from: Retention. It is the channel this record's risk is concentrated in — on its own it takes a clean record to ×0.250, and its bar above is filled to that.
Exposure is recorded as low and the integrity status as caught_lying.
Against the rest of the register, this record sits furthest above on Integrity — ×0.900 where the register averages ×0.658 — and furthest below on Retention, ×0.250 against ×0.432.
Every row above is one field of the published record, and every one of them can be challenged: every row carries Report, or raise something about the record as a whole. A correction with a source behind it is made the same day, and if it moves the score it moves the rank.
