Where the security score comes from
Eight channels, each asking one question of the published record and reading a named set of fields to answer it. They multiply rather than add — the factor beside a channel is what is left after the pressure it found, and open a channel to see every field it read, as it is stored. How the model works
Security fields
67 55 of them feed a channel
Established
36 28 left unknown, 3 not applicable
Completeness
52% the share the model could weigh
Citations
45 across 17 documents
Every value carries what it rests on, and the model weighs the four levels differently. Weight, then how many citations on this record sit at that level:
A weighs 1.00 · 11 hereB weighs 0.85 · 33 hereC weighs 0.70 · 1 here
The weights are methodology.json’s own; a claim seen in the artefact itself counts for more than the same claim reported second-hand. The date at the end of a row is the day that value was last read.
A channel does not price every field it reads. The ones it did are marked along their edge and carry what they added; everything else was read and cost nothing. Only a channel that composes field by field can mark a field at all — the rest price themselves by the parameters printed above their rows.
Still open on this record.
Audit scope. The only independent assessment found is a DEKRA/App Defense Alliance MASA report on the Android client's app security (session handling, TLS, permissions), read in full; it says nothing about server infrastructure or the no-logs claim, so V01 rests on app_security rather than no_logs, and no engagement covering retention or the server fleet exists.
Marketing versus retention. Speedify's feature pages advertise a "strict no log" policy, while its own privacy policy discloses retaining IP address, device ID, connection start time, duration and data volume for six months — a declared gap recorded in X02_claim_gap, not an audit finding, since no auditor has examined what the servers actually keep.
the rest of what is open — 92 more words
Ownership and hygiene. Beyond the named CEO and a Philadelphia address, no source establishes the ultimate beneficial owner, server hardware ownership, RAM-only status, in-tunnel DNS handling, or third-party trackers in the app and on the site; all are left unknown rather than guessed.
Enforcement record. No transparency report or warrant canary appears in the site's sitemap, and a targeted search for a seizure, subpoena or court record found nothing dated, so P04, P07, P08, P09 and P12 stay unknown rather than resolved to a favourable code with no dated event behind it.
On the record as a whole.
MASA report 81503RCS.014: tested 2024-11-22 to 2024-12-12, issued 2025-03-03 by DEKRA Testing and Certification S.A.U. for the App Defense Alliance's Google MASA program; a limited set of OWASP MASVS controls, summary "IN COMPLIANCE", client named as Connectify Inc.
Google Play's data safety form declares "Device or Other IDs" as required (purpose: fraud prevention/security/compliance), email as optional, and crash logs as required; it does not name an advertising identifier explicitly, so C12 is read at the app_scoped_id floor rather than higher. Yearly price is a flat $89.99 with no stated promotional/renewal split found on the pricing page.
RetentionDoes a record exist that links traffic to a person, and who checked?13 fields read · 2 left unknown · 1 not applicable · 75.0 points of pressure×0.250
Composed rather than added: a prior of 0.55 on the silent branch, moved by what the paper says (0.0519) and by what the practice shows (0.0), at credence 0.0519 from the audit and 0.7268 from how the provider engaged, against a severity of 0.75 for what is actually retained.
At least one independent auditmaterialV01_audit_exists
yes_verified
Computed
×0.020 of a clean record completeness 52%
Where the drop comes from: Retention. It is the channel this record's risk is concentrated in — on its own it takes a clean record to ×0.250, and its bar above is filled to that.
Exposure is recorded as high and the integrity status as caught_lying.
Against the rest of the register, this record sits furthest above on Integrity — ×0.900 where the register averages ×0.658 — and furthest below on Jurisdiction, ×0.295 against ×0.680.
Every row above is one field of the published record, and every one of them can be challenged: every row carries Report, or raise something about the record as a whole. A correction with a source behind it is made the same day, and if it moves the score it moves the rank.
