Where the security score comes from
Eight channels, each asking one question of the published record and reading a named set of fields to answer it. They multiply rather than add — the factor beside a channel is what is left after the pressure it found, and open a channel to see every field it read, as it is stored. How the model works
Security fields
67 55 of them feed a channel
Established
35 32 left unknown, 0 not applicable
Completeness
55% the share the model could weigh
Citations
63 across 24 documents
Every value carries what it rests on, and the model weighs the four levels differently. Weight, then how many citations on this record sit at that level:
B weighs 0.85 · 58 hereC weighs 0.70 · 5 here
The weights are methodology.json’s own; a claim seen in the artefact itself counts for more than the same claim reported second-hand. The date at the end of a row is the day that value was last read.
A channel does not price every field it reads. The ones it did are marked along their edge and carry what they added; everything else was read and cost nothing. Only a channel that composes field by field can mark a field at all — the rest price themselves by the parameters printed above their rows.
Still open on this record.
No independent audit. No no-logs audit, penetration test, or client source-code review by an outside firm was found on StrongVPN's own site or in third-party coverage; every V-field is unfilled. The record's retention finding rests entirely on the provider's own privacy policy and a journalist's account of one support conversation, not on an inspection.
PPTP is still live on the exit fleet. StrongVPN's dedicated protocols page (WireGuard, IKEv2, OpenVPN, legacy IPSec) omits PPTP, but the live server list tags a PPTP endpoint in nearly every city alongside the OpenVPN one, and setup guides for older devices (Kindle Fire, Synology, webOS, Symbian) still walk through configuring it. The two pages disagree, and the live table is read as authoritative.
the rest of what is open — 168 more words
Marketing undercounts the fleet. Plans and press pages advertise "30+ countries"; the live server list names exit locations in 41. The gap runs in the safe direction for a reader but is still a discrepancy between two of the provider's own pages.
No transparency report or warrant canary. Neither appears anywhere in the site's sitemap or its legal pages (subpoenas, ToS, DMCA, export policy), so both are recorded none rather than unknown on the strength of that comprehensive absence, not a single missed search.
Whether StrongVPN's own DNS resolves in-tunnel is not stated. The privacy policy is silent on DNS handling for the VPN connection itself; "StrongDNS" is a separate, unencrypted smart-DNS product for geo-unblocking and does not answer the question.
Cluster exposure is only partly known. StrongVPN has been owned by Ziff Davis (as Strong Technology, LLC) since the April 2019 J2 Global acquisition from StackPath, alongside sibling brand IPVanish, but no source establishes whether the two share backend infrastructure, so M18_shared_infrastructure stays unknown rather than guessed.
On the record as a whole.
PCMag, owned by StrongVPN's own parent Ziff Davis, reviews StrongVPN without disclosing the ownership tie on the review page itself (checked 2026-09-14).
Founding-date marketing is inconsistent across the provider's own properties: the site's About page dates the VPN service to 2005 (company founded 1994 selling PCs), while the App Store listing says "Established in 1995" — neither figure is disputed as false, just inconsistent.
The Terms of Service designate Florida (Orange County) as governing law and venue, while the Subpoenas page references California and the company's own letterhead address is New York; all three point to different US states but agree on the country.
RetentionDoes a record exist that links traffic to a person, and who checked?13 fields read · 11 left unknown · 55.0 points of pressure×0.450
Composed rather than added: a prior of 0.55 on the none branch, moved by what the paper says (0.0) and by what the practice shows (0.0), at credence 0.0 from the audit and 0.2975 from how the provider engaged, against a severity of 0.03 for what is actually retained.
How the report is published
Computed
×0.111 of a clean record completeness 55%
Where the drop comes from: Retention. It is the channel this record's risk is concentrated in — on its own it takes a clean record to ×0.450, and its bar above is filled to that.
Exposure is recorded as medium and the integrity status as unexamined.
Against the rest of the register, this record sits furthest above on Integrity — ×1.000 where the register averages ×0.658 — and furthest below on Silence, ×0.700 against ×0.927.
Every row above is one field of the published record, and every one of them can be challenged: every row carries Report, or raise something about the record as a whole. A correction with a source behind it is made the same day, and if it moves the score it moves the rank.
