Where the security score comes from
Eight channels, each asking one question of the published record and reading a named set of fields to answer it. They multiply rather than add — the factor beside a channel is what is left after the pressure it found, and open a channel to see every field it read, as it is stored. How the model works
Security fields
67 55 of them feed a channel
Established
37 28 left unknown, 2 not applicable
Completeness
60% the share the model could weigh
Citations
57 across 15 documents
Every value carries what it rests on, and the model weighs the four levels differently. Weight, then how many citations on this record sit at that level:
A weighs 1.00 · 13 hereB weighs 0.85 · 44 here
The weights are methodology.json’s own; a claim seen in the artefact itself counts for more than the same claim reported second-hand. The date at the end of a row is the day that value was last read.
A channel does not price every field it reads. The ones it did are marked along their edge and carry what they added; everything else was read and cost nothing. Only a channel that composes field by field can mark a field at all — the rest price themselves by the parameters printed above their rows.
Still open on this record.
Ownership chain. The Cure53 report names McAfee ULC as the party that commissioned this audit, which is solid evidence of current control, but no primary document in reach dates when McAfee took control or names the exact entity that holds the equity. TunnelBear's own site never mentions McAfee at all. M16_control_since and the precise M11_owner_jurisdiction stay open.
Device identifier disagrees across stores. Apple's own privacy label declares an Identifiers category (Device ID, User ID) linked to the user for analytics and marketing; the Play data-safety form for the same app declares no device or other IDs at all, and the privacy policy names neither. Which rung C12_device_identifier sits on cannot be settled from either store category alone.
the rest of what is open — 94 more words
No document examines the no-logs claim. Eight consecutive Cure53 engagements are white-box application and infrastructure pentests; none of the material read this session states what, if anything, a server-seizure or code review found about retained connection data. The no-logs claim in C01 rests on the privacy policy's own wording, not on an audit finding.
Full server-country list and launch year unestablished. Marketing copy claims 8,000 servers and 47 countries and the about page claims a Toronto base, but no page enumerating every offered exit country was found, and no page states a founding year.
On the record as a whole.
TunnelBear LLC is the entity named throughout the site's own legal pages, but no page states a country of incorporation; the privacy policy commits to keeping Personal Data inside Canada's borders and the about page places the team in Toronto, which is why M06 is left unknown rather than inferred from operational HQ.
V01/V02 disagree by design: the full, readable Cure53 PDF on file is the 2023 (TB-11) cycle, while the most recent cycle the provider describes (tested Oct-Nov 2024, blog post published Nov 2025) is only narrated in a blog summary with real vulnerability counts, not linked to a full PDF on Cure53's own publication index as of this session.
the rest of what is open — 70 more words
The Cure53 2023 report separately states it is itself "the eleventh security review" of TunnelBear, against the provider's own "8th annual" count -- the two are not necessarily contradictory (annual vs. total engagements) but neither page reconciles them.
U04b's $69.99/year is the standing yearly-plan price as billed every 12 months per the checkout page, set against a $119.88 (=$9.99x12) comparison anchor labelled "42% discount"; no separate renewal price is shown.
RetentionDoes a record exist that links traffic to a person, and who checked?13 fields read · 4 left unknown · 54.0 points of pressure×0.460
Composed rather than added: a prior of 0.55 on the silent branch, moved by what the paper says (0.0199) and by what the practice shows (0.0), at credence 0.0199 from the audit and 0.5652 from how the provider engaged, against a severity of 0.03 for what is actually retained.
How the report is publishedV02_report_publication
Computed
×0.120 of a clean record completeness 60%
Where the drop comes from: Retention. It is the channel this record's risk is concentrated in — on its own it takes a clean record to ×0.460, and its bar above is filled to that.
Exposure is recorded as medium and the integrity status as unexamined.
Against the rest of the register, this record sits furthest above on Jurisdiction — ×0.902 where the register averages ×0.680 — and furthest below on Disclosure, ×0.750 against ×0.970.
Every row above is one field of the published record, and every one of them can be challenged: every row carries Report, or raise something about the record as a whole. A correction with a source behind it is made the same day, and if it moves the score it moves the rank.
