Where the security score comes from
Eight channels, each asking one question of the published record and reading a named set of fields to answer it. They multiply rather than add — the factor beside a channel is what is left after the pressure it found, and open a channel to see every field it read, as it is stored. How the model works
Security fields
67 55 of them feed a channel
Established
39 21 left unknown, 7 not applicable
Completeness
66% the share the model could weigh
Citations
46 across 17 documents
Every value carries what it rests on, and the model weighs the four levels differently. Weight, then how many citations on this record sit at that level:
A weighs 1.00 · 7 hereB weighs 0.85 · 39 here
The weights are methodology.json’s own; a claim seen in the artefact itself counts for more than the same claim reported second-hand. The date at the end of a row is the day that value was last read.
A channel does not price every field it reads. The ones it did are marked along their edge and carry what they added; everything else was read and cost nothing. Only a channel that composes field by field can mark a field at all — the rest price themselves by the parameters printed above their rows.
Still open on this record.
Server countries. SPN publishes its exit-node map only inside the running client, not as a static page or API this record can cite; the full country list is unknown here and U02_server_countries is left blank rather than guessed from a screenshot or a forum post.
Retention has no audit behind it. The only independent review of the SPN stack is Cure53's January 2020 pentest of the Jess crypto library, which examined the secure-channel protocol, not what is retained. C01_linkable_retention rests entirely on the privacy policy's own declaration, unverified by any auditor, and no seizure or court record exists to test it in practice.
the rest of what is open — 114 more words
Device- and app-level hygiene is unfilled. RAM-only infrastructure, IP-sharing model, any persistent device identifier and whether exit traffic is modified in transit are all unestablished; none of Safing's own pages state them either way.
The ultimate owner's personal jurisdiction is unknown. Nicholas Pestell is named as sole owner of both IVPN and Safing, but no source establishes which country he is personally resident or domiciled in, so M11_owner_jurisdiction and the fields derived from it stay blank.
P2P, streaming and censorship circumvention are unmeasured. No page states whether P2P traffic is blocked on any exit node, whether major streaming platforms work through SPN, or whether the network has been tested against an active censorship regime.
On the record as a whole.
Acquired by IVPN (IVPN Limited, Gibraltar) on 2024-12-03; Safing ICS Technologies GmbH continues as the operating legal entity (Austria, FN464654S) and Nicholas Pestell owns both companies 100%. The founders (Daniel, Raphael) moved to an advisory role.
Pricing is quoted only in EUR on safing.io/pricing/; USD figures here use the EUR/USD rate Mullvad states on its own pricing page (5 EUR = 5.81 USD, i.e. 1.162), per the catalogue's own convention for EUR-only providers. Portmaster Pro is EUR 8/month or EUR 80/year (flat, no promotional first term stated); Portmaster Plus is a separate annual-only tier at EUR 40/year with a narrower feature set, not captured in the single-tier price fields.
the rest of what is open — 77 more words
The free tier (unlimited devices) excludes SPN entirely. The privacy policy's list of payment processors (PayPal, Stripe, Sparkasse Baden) does not mention the cash/Bitcoin/Monero options the current pricing page advertises; this may reflect a policy page not yet updated for the post-acquisition checkout, and is unresolved here.
SPN's exit architecture mixes servers Safing itself operates with volunteer-hosted community nodes; unencrypted (non-TLS) traffic is restricted to Safing-operated exit nodes only, while ordinary encrypted connections can exit at either.
ArchitectureWho operates the exit, and what does it do to the traffic?2 fields read · 1 left unknown · 75.0 points of pressure×0.250
What this channel priced on this record:Price 0.75
RetentionDoes a record exist that links traffic to a person, and who checked?13 fields read · 1 left unknown · 3 not applicable · 54.8 points of pressure×0.452
Composed rather than added: a prior of 0.55 on the silent branch, moved by what the paper says (0.0044) and by what the practice shows (0.0), at credence 0.0044 from the audit and 0.665 from how the provider engaged, against a severity of 0.03 for what is actually retained.
Retention linkable to a person as declaredmaterial
Computed
×0.058 of a clean record completeness 66%
Where the drop comes from: Architecture. It is the channel this record's risk is concentrated in — on its own it takes a clean record to ×0.250, and its bar above is filled to that.
Exposure is recorded as low and the integrity status as unexamined.
Against the rest of the register, this record sits furthest above on Integrity — ×1.000 where the register averages ×0.658 — and furthest below on Architecture, ×0.250 against ×0.900.
Every row above is one field of the published record, and every one of them can be challenged: every row carries Report, or raise something about the record as a whole. A correction with a source behind it is made the same day, and if it moves the score it moves the rank.
