Where the security score comes from
Eight channels, each asking one question of the published record and reading a named set of fields to answer it. They multiply rather than add — the factor beside a channel is what is left after the pressure it found, and open a channel to see every field it read, as it is stored. How the model works
Security fields
67 55 of them feed a channel
Established
36 30 left unknown, 1 not applicable
Completeness
54% the share the model could weigh
Citations
52 across 12 documents
Every value carries what it rests on, and the model weighs the four levels differently. Weight, then how many citations on this record sit at that level:
A weighs 1.00 · 22 hereB weighs 0.85 · 30 here
The weights are methodology.json’s own; a claim seen in the artefact itself counts for more than the same claim reported second-hand. The date at the end of a row is the day that value was last read.
A channel does not price every field it reads. The ones it did are marked along their edge and carry what they added; everything else was read and cost nothing. Only a channel that composes field by field can mark a field at all — the rest price themselves by the parameters printed above their rows.
Still open on this record.
No-logs audit. The only independent review found, Cure53's 2021 assessment, is a source-code pentest of the Chrome and Firefox extensions; it never examined server-side retention. VeePN's no-log claim in C01_linkable_retention rests entirely on its own privacy policy, at credence B, with no auditor route to corroborate or contradict it.
Ownership. VeePN Corp.'s own about-us page names no ultimate owner, and a 2022 federal complaint against it alleged, on information and belief, control by unnamed individuals in Russia and Ukraine — an unproven allegation, not a finding, and not carried into M09_owner_ultimate or M11_owner_jurisdiction here.
the rest of what is open — 165 more words
Server locations. The published country list runs to roughly 150 entries, including several under active sanctions or severe network controls (Iran, Syria, Cuba, Turkmenistan). Nothing on the site marks any location as virtual versus physically hosted, so C09b_mandate_hosting and the true physical footprint stay open.
Transparency practices. No transparency report or warrant-canary page was located in this session; P05, P07, P08, P09 and P11 are unknown rather than none, because their absence was not independently confirmed against a full site crawl.
Circumvention. No dated, independent measurement of VeePN working against an active censorship block was found; the homepage instead lists countries where any VPN use is banned. U06_censorship_circumvention stays unknown rather than claimed.
P2P policy. Press reporting describes a 2022 settlement requiring VeePN to block BitTorrent traffic on its US servers, but the only page carrying that account answered every fetch attempt this session with an uncleared Cloudflare challenge. U12a_p2p_allowed stays unknown; a future session with a working route past that wall would close it.
On the record as a whole.
In 2022, film studios (Voltage Holdings et al.) sued VeePN Corp. in the Eastern District of Virginia (1:22-cv-00741, E.D. Va.) alleging it marketed itself as "Popcorn Time VPN" to capture piracy traffic after a prior injunction against another VPN's Popcorn Time tie-in.
The court granted an ex parte TRO on 2022-07-14 freezing VeePN's payment-processor accounts (PayPal, Paymentwall, AliPay, ES Accounting) and ordering it to stop using the Popcorn Time branding; the docket then shows a notice of tentative settlement and, on 2022-07-29, a voluntary dismissal with prejudice.
Press coverage at the time (TorrentFreak) reported the settlement required VeePN to block BitTorrent traffic and named piracy sites on its US servers, but that page answered every fetch tool this session with a Cloudflare challenge that never cleared, so it is not cited as a source here and U12a_p2p_allowed stays unknown rather than resting on an unopened page.
the rest of what is open — 190 more words
This is a civil copyright/trademark action, not a government data-disclosure or seizure event, so it is recorded under X04_owner_group_history (sanctioned_or_prosecuted) and M14_inclusion_basis (adverse_record) rather than in the P-block, which is scoped to compelled production of user data. The same court filing is the source for C08_servers_ownership (VeePN is described as "a subscriber of the data center DATACAMP LIMITED") and for the Panama incorporation already stated in VeePN's own privacy policy.
VeePN's own marketing (vpn-features/) and its Chrome Web Store listing disagree on the free offering: the main site's chrome-extension page implies a subscription is needed after installing, while the store listing advertises "unlimited free VPN Proxy" with no traffic cap, limited to a smaller server list than the paid apps. U05_free_tier is filled from the store listing (the more specific, quantified claim); the conflict is noted here rather than silently resolved.
V15_assurance_strength is unknown (the vocabulary has no n/a code) because the Cure53 report is a pentest with no ISAE/SOC2-style assurance opinion; V07_audit_standard is none for the same reason. V04_scope_servers is n/a because the engagement's subject was client-side code, not server infrastructure, so "fleet coverage" does not apply to it.
RetentionDoes a record exist that links traffic to a person, and who checked?13 fields read · 2 left unknown · 1 not applicable · 54.7 points of pressure×0.453
Composed rather than added: a prior of 0.55 on the silent branch, moved by what the paper says (0.0066) and by what the practice shows (0.0), at credence 0.0066 from the audit and 0.5652 from how the provider engaged, against a severity of 0.03 for what is actually retained.
Computed
×0.073 of a clean record completeness 54%
Where the drop comes from: Retention. It is the channel this record's risk is concentrated in — on its own it takes a clean record to ×0.453, and its bar above is filled to that.
Exposure is recorded as low and the integrity status as unexamined.
Against the rest of the register, this record sits furthest above on Jurisdiction — ×0.849 where the register averages ×0.680 — and furthest below on Integrity, ×0.468 against ×0.658.
Every row above is one field of the published record, and every one of them can be challenged: every row carries Report, or raise something about the record as a whole. A correction with a source behind it is made the same day, and if it moves the score it moves the rank.
