Where the security score comes from
Eight channels, each asking one question of the published record and reading a named set of fields to answer it. They multiply rather than add — the factor beside a channel is what is left after the pressure it found, and open a channel to see every field it read, as it is stored. How the model works
Security fields
67 55 of them feed a channel
Established
23 44 left unknown, 0 not applicable
Completeness
36% the share the model could weigh
Citations
27 across 7 documents
Every value carries what it rests on, and the model weighs the four levels differently. Weight, then how many citations on this record sit at that level:
B weighs 0.85 · 27 here
The weights are methodology.json’s own; a claim seen in the artefact itself counts for more than the same claim reported second-hand. The date at the end of a row is the day that value was last read.
A channel does not price every field it reads. The ones it did are marked along their edge and carry what they added; everything else was read and cost nothing. Only a channel that composes field by field can mark a field at all — the rest price themselves by the parameters printed above their rows.
Still open on this record.
Fleet and protocols. The site claims "multi-protocols" and "5000 global servers" but names no specific transport and publishes no server-country list; U02, U07, U06, U08, U09, U10 and U12 stand unknown because the provider's own domain never states them outside marketing adjectives.
Free tier mechanics. The brand and app-store listing describe an ad-supported free tier limited to a handful of countries, but potatovpn.com's own pricing page shows only two paid plans and never describes free-tier mechanics itself; store descriptions are out of scope for U05 under this catalogue's sourcing rules, so the field stays unknown rather than resting on marketing copy from a host reserved for other fields.
the rest of what is open — 101 more words
Audit and ownership depth. No audit, pentest or transparency report of any kind is referenced anywhere on the site, and nothing beyond the operating entity's name and Singapore jurisdiction is disclosed about ownership — no ultimate beneficial owner, no other business lines, no founding year.
Legal-entity naming is inconsistent across the provider's own channels. The privacy policy and terms name the entity "FASTPOTATO PTE. LTD."; the same operator's Apple and Google Play listings name the developer "FREE VPN POTATO PTE. LTD." Neither channel explains the difference, and it was not established which, if either, is a trading name of the other.
On the record as a whole.
Apple App Store and Google Play both list the publishing entity as "FREE VPN POTATO PTE. LTD.", while the privacy policy and terms of service on potatovpn.com name "FASTPOTATO PTE. LTD." as the data controller and contracting party; both are treated here as the same operator absent evidence otherwise, but the discrepancy is unresolved.
The homepage states "We do not log how you Utilize VPN connection" while the privacy policy's own Client Data table lists connection timestamp, network type and choice of protocol as collected usage data (retained up to 48 hours) — recorded as X02_claim_gap=marketing_overstates rather than X01_documented_lie, since the retained fields are metadata about the connection rather than its content or IP address.
IgnoranceHow much of this did nobody establish?5 fields read · 4 left unknown · 57.6 points of pressure×0.424
Priced from what is missing: 0.36 of the weighted record is established, on a slope of 0.9 under a cap of 0.6, with a posture of 0.0 relieved by 0.4.
Record completenessS08_completeness
36%
derived from the record itself
Warrant canary disciplinealso read by disclosureP07_warrant_canary
unknown
nothing published · recorded as
Computed
×0.111 of a clean record completeness 36%
Where the drop comes from: Ignorance. It is the channel this record's risk is concentrated in — on its own it takes a clean record to ×0.424, and its bar above is filled to that.
Exposure is recorded as low and the integrity status as caught_lying.
Against the rest of the register, this record sits furthest above on Jurisdiction — ×0.894 where the register averages ×0.680 — and furthest below on Ignorance, ×0.424 against ×0.662.
Every row above is one field of the published record, and every one of them can be challenged: every row carries Report, or raise something about the record as a whole. A correction with a source behind it is made the same day, and if it moves the score it moves the rank.
