Where the security score comes from
Eight channels, each asking one question of the published record and reading a named set of fields to answer it. They multiply rather than add — the factor beside a channel is what is left after the pressure it found, and open a channel to see every field it read, as it is stored. How the model works
Security fields
67 55 of them feed a channel
Established
18 46 left unknown, 3 not applicable
Completeness
27% the share the model could weigh
Citations
25 across 6 documents
Every value carries what it rests on, and the model weighs the four levels differently. Weight, then how many citations on this record sit at that level:
B weighs 0.85 · 24 hereC weighs 0.70 · 1 here
The weights are methodology.json’s own; a claim seen in the artefact itself counts for more than the same claim reported second-hand. The date at the end of a row is the day that value was last read.
A channel does not price every field it reads. The ones it did are marked along their edge and carry what they added; everything else was read and cost nothing. Only a channel that composes field by field can mark a field at all — the rest price themselves by the parameters printed above their rows.
Still open on this record.
Ownership. VPNBook discloses no legal entity, ownership, or headquarters beyond a repeated "Located in Zurich, Switzerland" line with no company name attached to it anywhere on the site; no jurisdiction, incorporation, or beneficial owner could be established from the provider's own pages, Wikipedia, or a general search, so M02, M06, M08-M11 and M15-M18 stay unknown.
No independent audit. No no-logs audit, security assessment, or penetration test covering VPNBook could be found on its own site or anywhere else, so the whole V-block stays unknown; the retention picture below rests entirely on the provider's own word, unverified.
the rest of what is open — 91 more words
Retention window disagrees with itself. The privacy policy at /contact states connection logs (IP address and connection time) are "automatically deleted every week," while /features says the same logs are "automatically removed every day"; both are the provider's own current pages, neither is dated, and which window actually applies is unresolved.
Client-side fields. U08_kill_switch, U09_split_tunneling, U10_simultaneous_devices and U12b_streaming_works are undocumented anywhere on the site: there is no first-party client, only manual configuration guides for third-party OpenVPN, WireGuard, PPTP and Outline clients, and none of the guides addresses any of the four.
On the record as a whole.
No first-party mobile app is published; the setup guides link only to the official WireGuard and Cloudflare 1.1.1.1 apps for manual configuration. A Google Play listing titled "VPNBook VPN" (package com.vpnbook.vpnalsoanyoneasthisse) is not linked from vpnbook.com anywhere and should not be assumed to be the provider's own app. Ads on the site are served by Playwire LLC per the provider's own advertising disclosure; the service also accepts BTC/ETH/LTC/DOGE donations, both optional and not required to use the free service.
RetentionDoes a record exist that links traffic to a person, and who checked?13 fields read · 12 left unknown · 75.0 points of pressure×0.250
Composed rather than added: a prior of 0.55 on the none branch, moved by what the paper says (0.0) and by what the practice shows (0.0), at credence 0.0 from the audit and 0.2975 from how the provider engaged, against a severity of 0.75 for what is actually retained.
How the report is publishedV02_report_publication
unknown
nothing published · recorded as asserted
Computed
×0.040 of a clean record completeness 27%
Where the drop comes from: Retention. It is the channel this record's risk is concentrated in — on its own it takes a clean record to ×0.250, and its bar above is filled to that.
Exposure is recorded as low and the integrity status as unexamined.
Against the rest of the register, this record sits furthest above on Jurisdiction — ×0.950 where the register averages ×0.680 — and furthest below on Ignorance, ×0.400 against ×0.662.
Every row above is one field of the published record, and every one of them can be challenged: every row carries Report, or raise something about the record as a whole. A correction with a source behind it is made the same day, and if it moves the score it moves the rank.
