Where the security score comes from
Eight channels, each asking one question of the published record and reading a named set of fields to answer it. They multiply rather than add — the factor beside a channel is what is left after the pressure it found, and open a channel to see every field it read, as it is stored. How the model works
Security fields
67 55 of them feed a channel
Established
30 35 left unknown, 2 not applicable
Completeness
45% the share the model could weigh
Citations
47 across 18 documents
Every value carries what it rests on, and the model weighs the four levels differently. Weight, then how many citations on this record sit at that level:
B weighs 0.85 · 47 here
The weights are methodology.json’s own; a claim seen in the artefact itself counts for more than the same claim reported second-hand. The date at the end of a row is the day that value was last read.
A channel does not price every field it reads. The ones it did are marked along their edge and carry what they added; everything else was read and cost nothing. Only a channel that composes field by field can mark a field at all — the rest price themselves by the parameters printed above their rows.
Still open on this record.
No independent audit. No third-party no-logs, security or application audit could be found anywhere on PrivadoVPN's own site, sitemap or in press coverage; the V-block stands entirely unknown rather than no, since the only basis for an absence is that nothing was found, not a document saying so.
No transparency report or warrant canary, and behaviour under a real demand is untested. The sitemap carries no such page and none could be found. No seizure, court order or hand-over of user data of any kind is on record for this provider, which is recorded as none_known rather than a favourable finding — an untested provider and a provider that resisted a real order are not the same thing, and nothing here distinguishes them.
the rest of what is open — 255 more words
Jurisdiction moved between two entities of the same brand. As of 2026-05-01, PrivadoVPN's Terms of Service name Privado Networks ehf (Iceland) as operator, replacing the Swiss Privado Networks AG. The About page and structured company data still carry the old Zug, Switzerland address. Both jurisdictions carry a mandate basis here, so exposure is similar either way, but a reader relying on the marketing page alone would not know the controlling entity changed.
Server-fleet virtual/physical split is undocumented. The provider's own server-location page lists 49 countries but does not mark any location as virtual, and the app description separately claims 48 countries — the two of the provider's own pages disagree by one, and neither states which locations (several under a mandate jurisdiction, e.g. the US, UK, Canada) are physically hosted there versus routed virtually.
Payment methods could not be confirmed from a primary page. No checkout or payment-methods page could be reached with the pricing or support pages available in this session; whether an anonymous payment option (cash, direct crypto) exists is left unknown rather than assumed from third-party review sites, which are forbidden as sources here.
A breach claim exists only on a low-credibility aggregator and was not recorded. A site (insecureweb.com) describes a September 2023 breach of PrivadoVPN's in-app chat exposing user emails, in near-identical templated wording used for several unrelated VPNs the same date — a pattern more consistent with a content farm than independent reporting. It could not be corroborated against a primary source and is not entered into the record.
On the record as a whole.
PrivadoVPN offers a limited free tier (10GB/month, one device, a subset of servers) alongside paid plans; U04b_price_yearly (15.96) is the 12-month plan's first-term total ($1.33/mo x 12) as displayed on the pricing page, no separate renewal rate is shown anywhere the pricing or terms pages state.
The company relocated its operating entity from Privado Networks AG (Zug, Switzerland) to Privado Networks ehf (Gardabaer, Iceland) effective 2026-05-01, per its own Terms of Service; the site's About page and Organization structured data still show the old Zug, Switzerland address.
Payment processing is handled by Privado Networks LLC (Wilmington, Delaware, US) and/or Privado Networks AG (Switzerland) depending on method, per the privacy policy, but the controlling/contracting entity for the service itself is now the Icelandic one. C10/C11 (mandate exposure) are both yes because Iceland itself carries a mandate basis in this catalogue's country table, not because of any adverse event.
JurisdictionCan someone compel what exists, without the provider getting a say?5 fields read · 3 left unknown · 62.0 points of pressure×0.380
Where the company sits 0.6, where its owner sits 0.45, the exits it offers 0.05, the gag-order regime 0.05 — one circumstance, priced once rather than compounded.
Response to a national logging mandatealso read by ignoranceP04_mandate_response
unknown
nothing published · recorded as asserted
Computed
×0.059 of a clean record completeness 45%
Where the drop comes from: Jurisdiction. It is the channel this record's risk is concentrated in — on its own it takes a clean record to ×0.380, and its bar above is filled to that.
Exposure is recorded as low and the integrity status as unexamined.
Against the rest of the register, this record sits furthest above on Integrity — ×0.902 where the register averages ×0.658 — and furthest below on Jurisdiction, ×0.380 against ×0.680.
Every row above is one field of the published record, and every one of them can be challenged: every row carries Report, or raise something about the record as a whole. A correction with a source behind it is made the same day, and if it moves the score it moves the rank.
