Where the security score comes from
Eight channels, each asking one question of the published record and reading a named set of fields to answer it. They multiply rather than add — the factor beside a channel is what is left after the pressure it found, and open a channel to see every field it read, as it is stored. How the model works
Security fields
67 55 of them feed a channel
Established
44 6 left unknown, 17 not applicable
Completeness
86% the share the model could weigh
Citations
88 across 9 documents
Every value carries what it rests on, and the model weighs the four levels differently. Weight, then how many citations on this record sit at that level:
A weighs 1.00 · 47 hereB weighs 0.85 · 41 here
The weights are methodology.json’s own; a claim seen in the artefact itself counts for more than the same claim reported second-hand. The date at the end of a row is the day that value was last read.
A channel does not price every field it reads. The ones it did are marked along their edge and carry what they added; everything else was read and cost nothing. Only a channel that composes field by field can mark a field at all — the rest price themselves by the parameters printed above their rows.
Still open on this record.
The relay list. U02 is the gap with a known shape: the site publishes a rotating top-100 slice of its 4,189 relays, through the HTML table and the CSV endpoint alike, and no full list is published anywhere a reader can reach. The fourteen countries recorded are what that slice held on 2026-08-30 and a later read will differ. C09b does not depend on it, but the usability country score does.
Hardware the vocabulary cannot name. C08 has no token for what is true here. The relay hardware belongs to the volunteers - neither owned by the project nor rented by it - and the vocabulary offers owned, mixed or rented. C00 already carries the architecture, so the hygiene field was left unknown rather than forced into a wrong one.
the rest of what is open — 284 more words
Software the project did not write. C06 and C07a have no document at all: the project distributes a Windows and Mac client and, on every other platform, tells the user to connect with the operating system's own L2TP, OpenVPN or SSTP client, so DNS behaviour inside the tunnel and any SDK in a client are properties of software the project did not write.
The fields that follow from it. U08, U09, U12a and U12b are unfilled for the same reason, and X12 is not applicable because there is no first-party mobile app carrying a store data declaration to compare against the policy.
Not searched. X04 was not searched: neither the University of Tsukuba's nor SoftEther Corporation's record was chased to any document, and X03 is clear only because the project names its institution, its site administrator by name and title, and its corporate partner.
A logging policy nobody verifies. The per-relay logging policy is self-declared. Every server in the published sample says 2 Weeks, the site prints what the volunteer's server reports, and nothing verifies it - which cuts both ways, since a volunteer who kept more would report the same string.
A count that would be worth having. P05 is none because nothing on the site counts law-enforcement or private requests for logs, and P02 and P03 are none_known because no instance of either is documented - which is why the channel they feed prices at nothing here.
Why that count would be worth having. A project that says in advance it will hand logs to police and, in some cases, to private claimants is exactly the one whose count of actual handovers would be worth having, and there is none to read.
On the record as a whole.
VPN Gate is an academic experiment at the University of Tsukuba, run as joint research with SoftEther Corporation and launched on 2013-03-08. The university hosts only www.vpngate.net; every exit is a volunteer's own computer, 4,189 of them live when this record was written, and the about page says that where a volunteer supplies no contact address "even we cannot contact to him".
That is what C00 = p2p_exit_nodes means here, and it is the second record to occupy it. C01 is activity because the project publishes exactly what it keeps.
A VPN Connection Log entry contains the date and time, the destination server's ID, IP and hostname, connect or disconnect, the "Raw IP address and hostname of the source VPN client computer", the protocol, the client software name, version and id, packet and byte counts, and "Log records of destination HTTP/HTTPS hostnames (FQDNs), IP addresses, host names and port numbers of VPN Gate communications through VPN sessions". These are kept "for three or more months".
the rest of what is open — 968 more words
Source IP and destinations both, so the rung is the worse of the two: activity, not source_ip. Underneath the central log there is a second one.
Each volunteer's relay "always records packet-headers for every VPN users", holding "all TCP/IP headers of all communication initiated by VPN users" for two or more weeks on that volunteer's disk, and every server in the published list declares Logging policy: 2 Weeks. C02 is therefore a documented no rather than an unfilled field.
And the relay does not only observe: "a part of the VPN Session ID will be appended on the User-Agent value on the HTTP request header" of traffic passing through, so that a session can later be tied to an abuse report. The catalogue has no field for a provider that tags its users' outbound requests, so it is written here.
Disclosure is a standing offer rather than an exception. The policy names policemen, prosecutors, lawyers and courts, and then goes further than any other record in this catalogue: under the Japanese Act on Measures against Infringement of Rights arising from the Distribution of Information by Specified Telecommunications, the administrators may give a source IP address and port to a private person claiming to be a victim, subject to two stated conditions.
P02 and P03 are none_known all the same, because those fields record disclosures that happened and none is documented. A willingness is not a history, and the willingness is here in the note.
The project also publishes user connection metadata to the world. lastlog.aspx carries "Latest VPN connection logs of all VPN Gate Public VPN Servers", refreshed every sixty seconds, listing session ID, start time, source country, destination country, destination server and protocol, with raw IP addresses masked. The same feed runs on the front page.
RetentionDoes a record exist that links traffic to a person, and who checked?13 fields read · 9 not applicable · 88.0 points of pressure×0.120
Composed rather than added: a prior of 0.55 on the none branch, moved by what the paper says (0.0) and by what the practice shows (0.0), at credence 0.0 from the audit and 0.35 from how the provider engaged, against a severity of 0.88 for what is actually retained.
Computed
×0.008 of a clean record completeness 86%
Where the drop comes from: Retention. It is the channel this record's risk is concentrated in — on its own it takes a clean record to ×0.120, and its bar above is filled to that.
Exposure is recorded as medium and the integrity status as clean.
Against the rest of the register, this record sits furthest above on Ignorance — ×0.874 where the register averages ×0.662 — and furthest below on Architecture, ×0.250 against ×0.900.
Every row above is one field of the published record, and every one of them can be challenged: every row carries Report, or raise something about the record as a whole. A correction with a source behind it is made the same day, and if it moves the score it moves the rank.
