Where the security score comes from
Eight channels, each asking one question of the published record and reading a named set of fields to answer it. They multiply rather than add — the factor beside a channel is what is left after the pressure it found, and open a channel to see every field it read, as it is stored. How the model works
Security fields
67 55 of them feed a channel
Established
37 29 left unknown, 1 not applicable
Completeness
55% the share the model could weigh
Citations
50 across 14 documents
Every value carries what it rests on, and the model weighs the four levels differently. Weight, then how many citations on this record sit at that level:
A weighs 1.00 · 7 hereB weighs 0.85 · 38 hereC weighs 0.70 · 5 here
The weights are methodology.json’s own; a claim seen in the artefact itself counts for more than the same claim reported second-hand. The date at the end of a row is the day that value was last read.
A channel does not price every field it reads. The ones it did are marked along their edge and carry what they added; everything else was read and cost nothing. Only a channel that composes field by field can mark a field at all — the rest price themselves by the parameters printed above their rows.
Still open on this record.
The country list. The full U02 server-country list is not recorded — the servers page paginates through a directory this run did not fully enumerate, so the field is left unknown rather than published as the truncated 16-country footer subset, which would read as an exhaustive list and understate the fleet.
The infrastructure fields. C00 (who operates the exit), C08 (hardware ownership) and C12 (device identifier) are unestablished: no page read in this pass states whether PureVPN's own infrastructure is owned, rented or contractor-run, or what persistent identifier the apps hold.
An assessment never read. The no-logs assessment was never read as a document — only PureVPN's own description of it — so V04 (fleet coverage), V05 (firm name) and V15 (assurance strength) stay unknown; a PDF report, if one is ever published, would let those move past B-level trust.
the rest of what is open — 14 more words
No measurement either way. U06 (censorship circumvention) has no measurement on record either way.
On the record as a whole.
PureVPN is the catalogue's clearest documented instance of X02=denied_then_proven.
The FBI's criminal complaint against Ryan S. Lin (D. Mass., No. 17-MJ-4251-DHH, affidavit of SA Jeffrey Williams, sworn 2017-10-03) states at ¶52 that "records from PureVPN show... PureVPN was able to determine that their service was accessed by the same customer from two originating IP addresses: the RCN IP address from the home Lin was living in at the time, and the software company where Lin was employed at the time".
That is exactly the connection-metadata correlation PureVPN's privacy policy says it does not keep: "Records of IPs assigned", "A customer's original IP" and "Connection timestamps" all appear on its own list of what is never stored.
the rest of what is open — 550 more words
PureVPN's own contemporaneous blog post responding to the case (purevpn.com/blog/vpn-logs-explained/, still live, page reports a rolling "last modified" date rather than its original October 2017 date) confirms the mechanism directly: it explains that a law-enforcement subpoena or court order can obtain a "timestamp, containing the information about when an IP connected to which server and the non-VPN IP of the user" — the network log PureVPN says it does not itself hold, in the same post that also reasserts "PureVPN does not keep timestamps."
The exact legal instrument used in 2017 is not stated in the affidavit; the P12 event is recorded as kind=subpoena on the strength of PureVPN's own description of its compliance threshold ("a valid court order or subpoena"), not a citation naming the instrument itself.
A second, independent finding supports the same pattern at smaller scale: PureVPN's own account of its fourth no-logs assessment (blog, 2023-08-18) states the assessor found "origin IP addresses... in error logs of incomplete connection" for users on legacy/manually-configured protocols, plus logs of first-connection time, last-connection time and connection count — recorded in V11_audit_findings as source_ip, the worse of what C01 declares and what this finding shows, per the model's own rule.
Neither the underlying assessment report nor the firm's name is published anywhere this run could find: the no-log-assessment page's own marketing copy literally reads "Well known audit firm" where a name should be, so V06_firm_category is recorded as unnamed rather than guessed.
A partner-facing notice appended to the privacy policy page separately names KPMG as the auditor of a "KPMG-Audited No-Logs Network" — but that notice states explicitly it applies only to white-label Partner Deployments and not to the consumer service this record scores, so KPMG is not cited here for V05/V06.
Jurisdiction: PureVPN's own "About Us" page states it chose the British Virgin Islands specifically because there are "no mandatory data retention laws" there; this project's own mandate table (countries.csv) marks VG as a mandate jurisdiction with no stated basis recorded against it, and separately marks AE (UAE) — where parent group Disrupt, formerly Gaditek, is now headquartered per disrupt.com — as a mandate jurisdiction with a stated basis of "licensing and lawful-interception obligations".
IntegrityHas it been caught saying one thing and doing another?16 fields read · 6 left unknown · 88.0 points of pressure×0.120
What this channel priced on this record:Lie 0.85Implausible report 0.15Owner transparency 0.06
Computed
×0.002 of a clean record completeness 55%
Where the drop comes from: Integrity. It is the channel this record's risk is concentrated in — on its own it takes a clean record to ×0.120, and its bar above is filled to that.
Exposure is recorded as high and the integrity status as caught_lying.
Against the rest of the register, this record sits furthest above on Silence — ×1.000 where the register averages ×0.927 — and furthest below on Integrity, ×0.120 against ×0.658.
Every row above is one field of the published record, and every one of them can be challenged: every row carries Report, or raise something about the record as a whole. A correction with a source behind it is made the same day, and if it moves the score it moves the rank.
