Where the security score comes from
Eight channels, each asking one question of the published record and reading a named set of fields to answer it. They multiply rather than add — the factor beside a channel is what is left after the pressure it found, and open a channel to see every field it read, as it is stored. How the model works
Security fields
67 55 of them feed a channel
Established
51 15 left unknown, 1 not applicable
Completeness
77% the share the model could weigh
Citations
86 across 14 documents
Every value carries what it rests on, and the model weighs the four levels differently. Weight, then how many citations on this record sit at that level:
A weighs 1.00 · 62 hereB weighs 0.85 · 24 here
The weights are methodology.json’s own; a claim seen in the artefact itself counts for more than the same claim reported second-hand. The date at the end of a row is the day that value was last read.
A channel does not price every field it reads. The ones it did are marked along their edge and carry what they added; everything else was read and cost nothing. Only a channel that composes field by field can mark a field at all — the rest price themselves by the parameters printed above their rows.
Still open on this record.
The owner group's record. X04 is the deliberate hole. The Form 20-F establishes that Opera itself is not party to any material proceeding, but the field asks about the owner group, and Kunlun's own record was not chased to a primary document this run.
The two proceedings nobody opened. The reported CFIUS-mandated divestiture of Grindr and the 2020 securities class action that followed a short-seller report are both widely described and neither was opened here. Grindr's first post-listing Form 10-K does not recount it.
Why the score does not turn on it. Both clean and unknown price at 0.000, so nothing in the score turns on this; what is missing is the record, not the number, and the next run should start at the Kunlun filings and the federal docket rather than at a summary of them.
the rest of what is open — 264 more words
The report that would move four fields. The Deloitte report is the other document that would move several fields at once: V04, V07, V11 and V15 are all unknown only because it is not published, and V11 in particular is the field the whole no-log claim rests on.
What has no document. U07 has no document and neither does C13 behind it: Opera names AES-256 and a "secure tunnel" and never a protocol, so the weakest transport on offer is unestablished. U08, U09 and U12b are unfilled for the same reason - the feature comparison table on the product page marks rows with ticks that the fetched markup does not carry, and reading ticks off a rendered image is not a source.
Servers described, not evidenced. C02, C06 and C08 have nothing behind them: Opera says the servers are physical and its own, which settles neither disk nor DNS nor who owns the hardware. C09b cannot be answered while U02 is unknown.
One store, not two. Only the Google Play data-safety form was read; the App Store privacy labels for the iOS browser were not, so X12 rests on one store rather than the worse of two.
Two readings rather than statements. Linux in U01 is inferred from the desktop help manual, which documents the VPN and covers Windows, macOS and Linux together without splitting by platform; Android and iOS are named explicitly in the audit announcement. U10 is unlimited because there is no account and no device cap to enforce one, which is a reading of the product rather than a stated figure.
On the record as a whole.
Scope. This record is Opera's free VPN built into the browser, which is what makes it a browser_proxy: Opera states plainly that it "only protects your browsing within the Opera browser, and not your entire device".
The paid sibling VPN Pro is a different product and is not scored here - the privacy statement says VPN Pro "is provided by a third-party service provider which owns, operates, and maintains the infrastructure", it costs from $4 a month, covers up to six devices and 48 countries, and the free VPN by contrast runs on Opera's own infrastructure.
Who that third party is has moved: the 2024 audit announcement says VPN Pro servers are "provided in collaboration with Nord", and the 2026 explainer says VPN Pro is "equipped with the next-gen Lightway protocol", which is ExpressVPN's. Neither document says the arrangement changed.
the rest of what is open — 1047 more words
X02 is the load-bearing finding, and both documents behind it are Opera's own. The 2024 announcement quotes Deloitte's opinion as "the configuration of IT systems and management of the supporting IT operations was suitably designed and implemented, in all material respects, based on the criteria described in Opera's Management Assertion, as of 10th August 2024", and separately attributes the sentence "There is no data logging functionality built into the VPN service, and no data whatsoever is collected" to Opera's own Management Assertion.
The 2026 post re-tells the same engagement as Deloitte having done the finding: "we gave Deloitte's team complete access to our VPN and server infrastructure, and they were able to verify our claim ... In fact, a data logging function is not even built into the VPN in the first place." The same post upgrades a window the 2024 post dates as 18 June to 10 August 2024 into "complete access".
Opera is describing its own assertion as its auditor's conclusion. That is why the VERIFY block splits the way it does. V01 is yes_verified on the strength of a report actually opened - Cure53's own published management summary of its March 2022 assessment - not on the strength of the Deloitte announcement.
The Deloitte report itself is not published anywhere, so V02 is press_only, and every field that is a finding of that report rather than a fact about the engagement stays unknown: fleet coverage (V04), assurance standard (V07), what the report states is retained (V11) and the strength of the opinion (V15).
Engagement facts - the firm, its category, the date, what was listed as tested - are taken from the announcement. A vendor that has demonstrably re-characterised this audit once is not a source for what the audit concluded. C01 is none_linkable because that is the declaration in the privacy statement; V11 is the finding, and there is no finding to read.
Cure53's report is real and is the reason V14 is yes_verified: seven testers, twenty-four person-days, white-box across four work packages covering the VPN clients, the server configuration and infrastructure, and the Opera Mini protocol used to deliver VPN config. Fourteen security-relevant issues, eight of them actual vulnerabilities, five rated high severity and none critical.
RetentionDoes a record exist that links traffic to a person, and who checked?13 fields read · 4 left unknown · 75.0 points of pressure×0.250
Composed rather than added: a prior of 0.55 on the silent branch, moved by what the paper says (0.0118) and by what the practice shows (0.0), at credence 0.0118 from the audit and 0.595 from how the provider engaged, against a severity of 0.03 for what is actually retained.
At least one independent auditmaterialV01_audit_exists
yes_verified
Acure53.de
Computed
×0.044 of a clean record completeness 77%
Where the drop comes from: Retention. It is the channel this record's risk is concentrated in — on its own it takes a clean record to ×0.250, and its bar above is filled to that.
Exposure is recorded as high and the integrity status as caught_lying.
Against the rest of the register, this record sits furthest above on Ignorance — ×0.851 where the register averages ×0.662 — and furthest below on Retention, ×0.250 against ×0.432.
Every row above is one field of the published record, and every one of them can be challenged: every row carries Report, or raise something about the record as a whole. A correction with a source behind it is made the same day, and if it moves the score it moves the rank.
