Where the security score comes from
Eight channels, each asking one question of the published record and reading a named set of fields to answer it. They multiply rather than add — the factor beside a channel is what is left after the pressure it found, and open a channel to see every field it read, as it is stored. How the model works
Security fields
67 55 of them feed a channel
Established
22 45 left unknown, 0 not applicable
Completeness
36% the share the model could weigh
Citations
28 across 6 documents
Every value carries what it rests on, and the model weighs the four levels differently. Weight, then how many citations on this record sit at that level:
B weighs 0.85 · 28 here
The weights are methodology.json’s own; a claim seen in the artefact itself counts for more than the same claim reported second-hand. The date at the end of a row is the day that value was last read.
A channel does not price every field it reads. The ones it did are marked along their edge and carry what they added; everything else was read and cost nothing. Only a channel that composes field by field can mark a field at all — the rest price themselves by the parameters printed above their rows.
Still open on this record.
Retention and architecture. The general Pango privacy policy denies logging identity-linked session activity but sets no fixed deletion window ("as long as is needed"), and the dedicated VPN Products Privacy Notice it references could not be located as its own page this session. Who operates the exit, DNS handling, RAM-only status, IP sharing, and server ownership are all unestablished.
No audit trail found. No independent audit, transparency report or warrant canary was found on the provider's own site or in the general privacy policy; V01-V15 stand unknown rather than no, since the search covered only the pages reachable this session, not a dedicated audit-index check.
the rest of what is open — 120 more words
Fleet and protocol detail. The site claims "5900+ servers in 90+ countries" but publishes no actual country list, protocol list, kill switch, split tunneling or device-limit specification on a page this session could read; the only concrete plan limits found (5 devices, 30+ virtual locations on premium; 1 device, 1 location on free) sit inside an HTML comment with the pricing tab disabled site-wide, so they were not used as current fact.
Owner-group coupling. M15_owner_group=pango and M16_control_since=2020-07-07 are established from the provider's own privacy policy and Aura's acquisition release, but M17_brand_role and M18_shared_infrastructure — how tightly Touch VPN is bound to sibling Pango/Aura brands such as Hotspot Shield — could not be sourced to a document naming Touch VPN specifically.
On the record as a whole.
Apple's App Store lists the seller as "TOUCHVPN INC" while Google Play's developer field and the privacy policy both name "VPN Proxy Pro, LLC, a Pango Group company" as the operating entity; recorded M02 from the latter two as the fuller, converging pair.
The website's pricing tab and price section are commented out of the live markup (nav item and price block both wrapped in HTML comments) and no longer reachable through normal navigation; U04/U04b were instead read from the App Store's in-app-purchase list (Month $12.99, Year $77.99), which is live and dated to this session rather than to the dead markup.
IgnoranceHow much of this did nobody establish?5 fields read · 4 left unknown · 57.6 points of pressure×0.424
Priced from what is missing: 0.36 of the weighted record is established, on a slope of 0.9 under a cap of 0.6, with a posture of 0.0 relieved by 0.4.
Record completenessS08_completeness
36%
derived from the record itself
Warrant canary disciplinealso read by disclosureP07_warrant_canary
unknown
nothing published · recorded as
Computed
×0.079 of a clean record completeness 36%
Where the drop comes from: Ignorance. It is the channel this record's risk is concentrated in — on its own it takes a clean record to ×0.424, and its bar above is filled to that.
Exposure is recorded as high and the integrity status as unexamined.
Against the rest of the register, this record sits furthest above on Jurisdiction — ×0.902 where the register averages ×0.680 — and furthest below on Ignorance, ×0.424 against ×0.662.
Every row above is one field of the published record, and every one of them can be challenged: every row carries Report, or raise something about the record as a whole. A correction with a source behind it is made the same day, and if it moves the score it moves the rank.
