Where the security score comes from
Eight channels, each asking one question of the published record and reading a named set of fields to answer it. They multiply rather than add — the factor beside a channel is what is left after the pressure it found, and open a channel to see every field it read, as it is stored. How the model works
Security fields
67 55 of them feed a channel
Established
33 31 left unknown, 3 not applicable
Completeness
54% the share the model could weigh
Citations
49 across 18 documents
Every value carries what it rests on, and the model weighs the four levels differently. Weight, then how many citations on this record sit at that level:
B weighs 0.85 · 39 hereC weighs 0.70 · 10 here
The weights are methodology.json’s own; a claim seen in the artefact itself counts for more than the same claim reported second-hand. The date at the end of a row is the day that value was last read.
A channel does not price every field it reads. The ones it did are marked along their edge and carry what they added; everything else was read and cost nothing. Only a channel that composes field by field can mark a field at all — the rest price themselves by the parameters printed above their rows.
Still open on this record.
Traffic modification. The exit-node terms (TERMS_EXIT_NODE.md) bind node operators to net neutrality — they may not filter, restrict or obstruct lawful traffic, and may monitor only for destination whitelisting — but no document states plainly that nothing is injected or altered in passing traffic. That is close to "none" without quite saying it, so C14_traffic_modification stays unknown rather than assumed.
Server country list. The site advertises "100+ countries" and, on the Basic tier, "57 supported countries" against "100+" on Plus/Pro, but no page publishes the actual ISO list the way a server-status page would. U02_server_countries stays unknown; closing it needs the app's own location picker or a node-explorer export, not the marketing count.
the rest of what is open — 207 more words
Three names, one brand. The VPN's own Terms name UAB MN Intelligence as the contracting party; its checkout authorizes charges through UAB MN Technologijos; the wider network's own site names BlockDev AG (Switzerland) as developer and NetSys Inc. (Panama) as the operator of network discovery. No document ties these four names into one ownership chain, which is why M09, M15 particulars and M17 stay unknown rather than assumed to be one group.
The only audit found is of the token, not the service. CertiK's code review (delivered 2022-05-20) covers the MYST payment smart contracts, not the VPN app, the exit-node software, or any no-logs claim. It is recorded as such — V03_audit_subject: protocol, V11_audit_findings: not_stated — so it earns nothing in the retention channel; treating it as a security or privacy audit would be exactly the error AUDITOR.md forbids.
Jurisdiction is split three ways and none of it was resolved this session. The consumer contract is Lithuanian by entity and Panamanian by governing law and forum; the network layer's terms are also Panama-governed under a separate Panama-sounding entity. Whether either jurisdiction runs a secret-order regime (P11) was not researched here — it needs dedicated legal review, not a marketing page, and is left unknown rather than guessed.
On the record as a whole.
Mysterium VPN is the retail product built on top of the Mysterium Network, a permissionless marketplace of independently run exit nodes (residential ISP connections and self-hosted nodes) that node operators install voluntarily and get paid for in MYST tokens.
The consumer app's own help center describes a "DoubleVPN" default: traffic is routed through two nodes in the network before reaching the internet, and per the provider's own explanation "the pool operator cannot view any of your information" and the user's real originating IP is never exposed to the pool.
The privacy policy's marketing "NO LOGS PLEDGE" (session data auto-deleted "within minutes") sits awkwardly beside the same document's itemised data-collection clause, which lists email address, bandwidth usage, and session timestamps as processed "to provide the Service" with no stated deletion window for that specific item — the two claims are not the same statement, and C01 is coded to the itemised clause (the worse of the two) rather than the marketing pledge, per AUDITOR.md §5's max rule.
the rest of what is open — 94 more words
C08_servers_ownership reflects the network's node model even though one features page also mentions "datacenter IPs and residential IPs" without explaining who owns the datacenter side; the weight of the provider's own description (about-us, docs.mysterium.network) is residential/node-run, so that is what is recorded, and the inconsistency is left here rather than resolved by guessing.
The GitHub repository confirmed open source (GPLv3) is the network node/client-cli stack; it does not by itself establish that the polished consumer apps distributed for Windows/macOS/iOS/Android are built from that same published source, so V12_client_open_source is coded partial rather than all.
ArchitectureWho operates the exit, and what does it do to the traffic?2 fields read · 1 left unknown · 75.0 points of pressure×0.250
What this channel priced on this record:Price 0.75
RetentionDoes a record exist that links traffic to a person, and who checked?13 fields read · 2 left unknown · 1 not applicable · 55.0 points of pressure×0.450
Composed rather than added: a prior of 0.55 on the silent branch, moved by what the paper says (0.001) and by what the practice shows (0.0), at credence 0.001 from the audit and 0.7268 from how the provider engaged, against a severity of 0.45 for what is actually retained.
Computed
×0.043 of a clean record completeness 54%
Where the drop comes from: Architecture. It is the channel this record's risk is concentrated in — on its own it takes a clean record to ×0.250, and its bar above is filled to that.
Exposure is recorded as low and the integrity status as unexamined.
Against the rest of the register, this record sits furthest above on Integrity — ×0.902 where the register averages ×0.658 — and furthest below on Architecture, ×0.250 against ×0.900.
Every row above is one field of the published record, and every one of them can be challenged: every row carries Report, or raise something about the record as a whole. A correction with a source behind it is made the same day, and if it moves the score it moves the rank.
