Where the security score comes from
Eight channels, each asking one question of the published record and reading a named set of fields to answer it. They multiply rather than add — the factor beside a channel is what is left after the pressure it found, and open a channel to see every field it read, as it is stored. How the model works
Security fields
67 55 of them feed a channel
Established
22 44 left unknown, 1 not applicable
Completeness
34% the share the model could weigh
Citations
33 across 11 documents
Every value carries what it rests on, and the model weighs the four levels differently. Weight, then how many citations on this record sit at that level:
B weighs 0.85 · 33 here
The weights are methodology.json’s own; a claim seen in the artefact itself counts for more than the same claim reported second-hand. The date at the end of a row is the day that value was last read.
A channel does not price every field it reads. The ones it did are marked along their edge and carry what they added; everything else was read and cost nothing. Only a channel that composes field by field can mark a field at all — the rest price themselves by the parameters printed above their rows.
Still open on this record.
Architecture and hardware. Urban VPN's own encryption page describes "our VPN servers" as the tunnel endpoint, which is enough for who operates the exit, but nothing on the site states whether that hardware is owned or rented, whether it is RAM-only, or what identifier the mobile app attaches to a device. C02, C03, C06, C07a, C07b, C08 and C12 stayed unknown for this reason and would need the mobile app's own store privacy label read directly.
Enforcement history. No transparency report, warrant canary, court record or seizure account exists on the provider's own site, and none was found in this session's search. That is silence, not innocence — P01, P02, P03, P08, P09 and P12 stayed unknown rather than none_known because the check performed here was limited to the provider's own pages and a Cure53 index lookup, not a court-record or press search.
the rest of what is open — 170 more words
Independent verification. No audit, pentest or open-source client was found anywhere on the site, nor in Cure53's public engagement index. V01 through V15 stayed unknown rather than no: the search was not exhaustive enough to assert an audit does not exist, only that none surfaced.
Device count contradicts itself. The unlimited-devices feature page declares no limit at all, while the live pricing page caps the Premium plan at 8 devices. The record follows the concrete, purchasable number and flags the marketing copy as overstating it (X02).
A 90-day raw-data window sits inside a "we don't want to know you" policy. The privacy policy opens by disclaiming any interest in identity, then states elsewhere that Browsing and Activity Data is retained in raw form for up to 90 days before aggregation, and that Insights built from it are sometimes sold together with a unique identifier — which the same document says counts as a CCPA "sale." Both statements were read in the one document; neither is inferred from a third party.
On the record as a whole.
Urban Cyber Security Inc. runs a dual-sided business: a free VPN funded partly by selling "Insights" (aggregated, and in some cases identifier-linked, web-browsing behaviour data) to advertising and market-measurement customers, and a Premium subscription (Android/iOS/macOS/Windows) sold through Apple Pay, Google Pay and the Paddle payment processor. The free product requires no account of any kind; Premium is billed per-device through the stores or Paddle.
A 2020 compliance-overview PDF states the company "never share[s], sell[s] or process[es] information directly associated with individuals", while the 2026-09-04 privacy policy describes selling insights linked to a unique identifier in some cases — the two documents describe the same practice differently across time, which is worth a reader's attention even though it does not fit this schema's narrower lie-taxonomy cleanly.
RetentionDoes a record exist that links traffic to a person, and who checked?13 fields read · 12 left unknown · 88.0 points of pressure×0.120
Composed rather than added: a prior of 0.55 on the none branch, moved by what the paper says (0.0) and by what the practice shows (0.0), at credence 0.0 from the audit and 0.2975 from how the provider engaged, against a severity of 0.88 for what is actually retained.
How the report is publishedV02_report_publication
unknown
nothing published · recorded as
Computed
×0.009 of a clean record completeness 34%
Where the drop comes from: Retention. It is the channel this record's risk is concentrated in — on its own it takes a clean record to ×0.120, and its bar above is filled to that.
Exposure is recorded as medium and the integrity status as caught_lying.
Against the rest of the register, this record sits furthest above on Jurisdiction — ×0.849 where the register averages ×0.680 — and furthest below on Integrity, ×0.311 against ×0.658.
Every row above is one field of the published record, and every one of them can be challenged: every row carries Report, or raise something about the record as a whole. A correction with a source behind it is made the same day, and if it moves the score it moves the rank.
