Where the security score comes from
Eight channels, each asking one question of the published record and reading a named set of fields to answer it. They multiply rather than add — the factor beside a channel is what is left after the pressure it found, and open a channel to see every field it read, as it is stored. How the model works
Security fields
67 55 of them feed a channel
Established
25 42 left unknown, 0 not applicable
Completeness
40% the share the model could weigh
Citations
40 across 17 documents
Every value carries what it rests on, and the model weighs the four levels differently. Weight, then how many citations on this record sit at that level:
B weighs 0.85 · 40 here
The weights are methodology.json’s own; a claim seen in the artefact itself counts for more than the same claim reported second-hand. The date at the end of a row is the day that value was last read.
A channel does not price every field it reads. The ones it did are marked along their edge and carry what they added; everything else was read and cost nothing. Only a channel that composes field by field can mark a field at all — the rest price themselves by the parameters printed above their rows.
Still open on this record.
Connection-level retention. Total Security's privacy policy is a corporate document covering the website, cookies and advertising; it never addresses what the VPN client retains about a session (IP address, timestamps, bandwidth). A help-centre marketing line promises the app "does not track, log, or store your browsing history", but that is a narrower claim than connection metadata and sits outside the privacy policy itself, so C01_linkable_retention stays unknown.
Server footprint. The provider publishes a regional count ("1,800+ servers in 80+ countries", broken down as 18 Americas / 48 Europe / 27 Asia / 5 Africa & Middle East, which itself sums to 98 rather than the headline 80+) but no actual list of country names or codes, so U02_server_countries and the fields derived from it could not be filled.
the rest of what is open — 95 more words
No audit found. Neither totalvpn.com nor the corporate totalsecurity.com site mentions an independent audit, pentest or transparency report for the VPN product itself; TotalAV's antivirus carries AV-TEST and AV-Comparatives results, but that is a different product line and is not evidence one way or the other for the VPN's own security posture.
Architecture and hardware. No document read this session states who operates the exit servers or who owns the hardware, so C00_architecture and C08_servers_ownership stay unknown; the Hydra protocol offering is the only signal tying the fleet to the wider Pango/Point Wild technology stack.
On the record as a whole.
Total VPN is sold by Total Security, part of Point Wild (the December 2024 merger of Pango Group and Total Security). Two entities are named as contracting parties depending on residency: Total Security Limited (England, no. 10161957) and Total Security U.S. LLC (Boston, MA). The provider's own promotional page claims "Unlimited Devices" while its own pricing matrix sells the base plan at 1 device license with paid add-ons for more; see X01_documented_lie.
RetentionDoes a record exist that links traffic to a person, and who checked?13 fields read · 12 left unknown · 55.0 points of pressure×0.450
Composed rather than added: a prior of 0.55 on the none branch, moved by what the paper says (0.0) and by what the practice shows (0.0), at credence 0.0 from the audit and 0.2975 from how the provider engaged, against a severity of 0.55 for what is actually retained.
How the report is publishedV02_report_publication
unknown
nothing published · recorded as asserted
ReportComputed
×0.114 of a clean record completeness 40%
Where the drop comes from: Retention. It is the channel this record's risk is concentrated in — on its own it takes a clean record to ×0.450, and its bar above is filled to that.
Exposure is recorded as low and the integrity status as caught_lying.
Against the rest of the register, this record sits furthest above on Jurisdiction — ×0.950 where the register averages ×0.680 — and furthest below on Ignorance, ×0.460 against ×0.662.
Every row above is one field of the published record, and every one of them can be challenged: every row carries Report, or raise something about the record as a whole. A correction with a source behind it is made the same day, and if it moves the score it moves the rank.
