Where the security score comes from
Eight channels, each asking one question of the published record and reading a named set of fields to answer it. They multiply rather than add — the factor beside a channel is what is left after the pressure it found, and open a channel to see every field it read, as it is stored. How the model works
Security fields
67 55 of them feed a channel
Established
43 21 left unknown, 3 not applicable
Completeness
68% the share the model could weigh
Citations
69 across 16 documents
Every value carries what it rests on, and the model weighs the four levels differently. Weight, then how many citations on this record sit at that level:
A weighs 1.00 · 11 hereB weighs 0.85 · 58 here
The weights are methodology.json’s own; a claim seen in the artefact itself counts for more than the same claim reported second-hand. The date at the end of a row is the day that value was last read.
A channel does not price every field it reads. The ones it did are marked along their edge and carry what they added; everything else was read and cost nothing. Only a channel that composes field by field can mark a field at all — the rest price themselves by the parameters printed above their rows.
Still open on this record.
Audit scope, not retention. Cure53's July 2024 engagement (56 person-days, six senior testers) tested source code and infrastructure for exploitable bugs and fixed all Critical/High findings, but its own conclusion states a decentralized network 'can not be meaningfully subjected to a no-logs audit.' No independent examination of what any given node retains exists; C01 rests on the provider's architecture description, not an audit finding.
Exit fleet is unverifiable by design. U02_server_countries stays unknown: the provider advertises '70+ countries' in app-store copy, but no published, per-country server or gateway list was found on nym.com or its docs to check that figure against, and the operator set changes as independent node operators join or leave.
the rest of what is open — 143 more words
Traffic modification is undocumented rather than denied. C14_traffic_modification stays unknown: Nym's own exit-gateway documentation describes what an Exit Gateway can see after stripping the mixnet's Sphinx layers, but nowhere states that gateways do not inject headers or content -- an absence of a claim, not a claim of absence.
Ownership is diffuse rather than opaque. M09/M11 could not resolve to a single controlling owner: the about page names venture investors (Binance Labs, Polychain, a16z) alongside a named founding team, but no filing establishes a controlling shareholder, so C11_owner_under_mandate and M16_control_since stay unknown rather than guessed.
Kill switch and DNS scope are asserted, not detailed. The app description and feature page both mention a kill switch and custom DNS, but neither states which platforms carry the kill switch or whether Nym runs its own in-tunnel resolver by default, so U08 and C06 stay unknown.
On the record as a whole.
NymVPN routes traffic through the Nym mixnet, operated by independent, permissionless node operators who stake NYM tokens and sign terms (operators-validators-terms) contractually barring them from logging user traffic; Nym Technologies SA cannot audit or enforce this on hardware it does not own.
Two client modes exist: a 2-hop 'Fast Mode' (AmneziaWG/WireGuard-derived) and a 5-hop 'Anonymous Mode' (Nym's own Sphinx-based mixnet protocol). Nym's own commissioned auditor, Cure53, states in its July 2024 report that 'even decentralized servers can not be meaningfully subjected to a no-logs audit' -- the engagement was a code security pentest (mobile/desktop apps, backend API, VPN software, cryptography), not a retention/logging audit, so V11_audit_findings is not_stated rather than a cleared no-logs claim.
JurisdictionCan someone compel what exists, without the provider getting a say?5 fields read · 4 left unknown · 65.0 points of pressure×0.350
Where the company sits 0.6, where its owner sits 0.03, the exits it offers 0.05, the gag-order regime 0.05.
Response to a national logging mandatealso read by ignoranceP04_mandate_response
unknown
nothing published · recorded as asserted
ReportComputed
×0.080 of a clean record completeness 68%
Where the drop comes from: Jurisdiction. It is the channel this record's risk is concentrated in — on its own it takes a clean record to ×0.350, and its bar above is filled to that.
Exposure is recorded as low and the integrity status as caught_lying.
Against the rest of the register, this record sits furthest above on Integrity — ×0.864 where the register averages ×0.658 — and furthest below on Jurisdiction, ×0.350 against ×0.680.
Every row above is one field of the published record, and every one of them can be challenged: every row carries Report, or raise something about the record as a whole. A correction with a source behind it is made the same day, and if it moves the score it moves the rank.
