Where the security score comes from
Eight channels, each asking one question of the published record and reading a named set of fields to answer it. They multiply rather than add — the factor beside a channel is what is left after the pressure it found, and open a channel to see every field it read, as it is stored. How the model works
Security fields
67 55 of them feed a channel
Established
20 47 left unknown, 0 not applicable
Completeness
29% the share the model could weigh
Citations
27 across 9 documents
Every value carries what it rests on, and the model weighs the four levels differently. Weight, then how many citations on this record sit at that level:
B weighs 0.85 · 27 here
The weights are methodology.json’s own; a claim seen in the artefact itself counts for more than the same claim reported second-hand. The date at the end of a row is the day that value was last read.
A channel does not price every field it reads. The ones it did are marked along their edge and carry what they added; everything else was read and cost nothing. Only a channel that composes field by field can mark a field at all — the rest price themselves by the parameters printed above their rows.
Still open on this record.
Retention declaration is stale. The only document stating what Steganos VPN Online Shield logs is sos_privacy_en.txt, still linked from the App Store listing as the app's current privacy policy, but last modified 2018-01-16. It predates the company's current Karlsruhe registration and describes a MAC-address-derived pseudonym scheme written for the desktop client; whether it accurately describes the mobile apps was not established.
No independent audit found. The press center and site carry no mention of a security audit, penetration test, or open-source client. A general web search for third-party verification returned nothing beyond affiliate review sites, which are not citable here.
the rest of what is open — 197 more words
Protocol list could not be established. No page on steganos.com states which VPN protocols the apps offer. The only protocol claim found (IKEv2/IPsec, for the Android app) sits in a Google Play store description, a host this catalogue restricts to X12 and U01 citations only, so it could not be used to fill U07_protocols.
Ownership beyond the registered entity is unclear. The German commercial register shows Steganos Software GmbH renamed from a shelf company in 2010, with a 2013 shareholder record (Alta Vista Corporate Finance Beratung GmbH) behind the register's own paywall for anything more recent. The current ultimate beneficial owner was not established.
Device identifier rung unresolved. Both app stores declare a device identifier, but the category alone does not settle which rung of C12 applies, and the store pages cannot be cited outside X12/U01. Whether the apps hold an app-scoped ID, a resettable ad ID, or a hardware ID stays open.
Free tier terms not established from a citable source. Third-party listings describe a 7-day trial, but that claim traces to app store description text, which this catalogue does not accept as a source for U05_free_tier; no page on steganos.com itself states the trial terms.
On the record as a whole.
Steganos Software GmbH also publishes a second VPN brand, OkayFreedom, and several other consumer apps (password manager, encryption tools) under the same legal entity; OkayFreedom is not in this catalogue, so M15_owner_group is recorded as independent rather than a cluster key.
The yearly price is the discounted first-term rate ($34.95, struck from $59.95); the vendor's own comparison table claims the renewal price is unchanged year to year ("no teaser price"), unlike the flagship competitors it names, but no renewal invoice or third-party account was available to confirm that claim directly.
JurisdictionCan someone compel what exists, without the provider getting a say?5 fields read · 4 left unknown · 65.0 points of pressure×0.350
Where the company sits 0.6, where its owner sits 0.03, the exits it offers 0.05, the gag-order regime 0.05.
Computed
×0.039 of a clean record completeness 29%
Where the drop comes from: Jurisdiction. It is the channel this record's risk is concentrated in — on its own it takes a clean record to ×0.350, and its bar above is filled to that.
Exposure is recorded as low and the integrity status as unexamined.
Against the rest of the register, this record sits furthest above on Integrity — ×0.767 where the register averages ×0.658 — and furthest below on Jurisdiction, ×0.350 against ×0.680.
Every row above is one field of the published record, and every one of them can be challenged: every row carries Report, or raise something about the record as a whole. A correction with a source behind it is made the same day, and if it moves the score it moves the rank.
