Where the security score comes from
Eight channels, each asking one question of the published record and reading a named set of fields to answer it. They multiply rather than add — the factor beside a channel is what is left after the pressure it found, and open a channel to see every field it read, as it is stored. How the model works
Security fields
67 55 of them feed a channel
Established
44 8 left unknown, 15 not applicable
Completeness
83% the share the model could weigh
Citations
69 across 7 documents
Every value carries what it rests on, and the model weighs the four levels differently. Weight, then how many citations on this record sit at that level:
B weighs 0.85 · 52 hereC weighs 0.70 · 17 here
The weights are methodology.json’s own; a claim seen in the artefact itself counts for more than the same claim reported second-hand. The date at the end of a row is the day that value was last read.
A channel does not price every field it reads. The ones it did are marked along their edge and carry what they added; everything else was read and cost nothing. Only a channel that composes field by field can mark a field at all — the rest price themselves by the parameters printed above their rows.
Still open on this record.
The free tier. U05 is unfilled and it is the awkward one: the privacy policy prices the free tier by advertising, so a free tier exists, but no page says what its limits are - the download page offers a "Free VPN Trial" and the pricing page sells only subscriptions, and those are two different products. The Play listing for the app would settle it.
Fun facts, not coverage statements. U08 and U09 are named on the press room as fun facts rather than as coverage statements, so neither says which platforms carry them. C02, C03, C07b and C08 have nothing behind them; the site describes a fleet size and never its ownership.
the rest of what is open — 68 more words
One annotation, three silences. C09b reads mixed on one annotation - India is offered "via Singapore" - and the other three mandate countries on the list carry no such note, which is weaker evidence than it looks.
A policy six years old. The privacy policy the site actually serves is version 2.1 of 21 September 2020, so every value taken from it describes a document six years old.
On the record as a whole.
The pricing page's 12-month plan is $79.99 for the first year ($6.67/mo) and states it renews at $12.99/mo ($155.88/yr); U04b records the first-term total, per the customer-charged convention. The 1-month plan has no promotional gap: $12.99/mo first term and renewal alike, which is U04. A third plan (27 months + 3 free, $89.99 total, no stated renewal) is not priced by either field.
The operator is named four different ways across artefacts that are all live today, and this is the record's central fact.
The privacy policy the site serves in an iframe opens "We, Lemon Clove PTE. LIMITED" and gives a lemonclove.net contact address; the footer of the page that frames it says the service is powered by Innovative Connecting Pte. Limited at 8 Marina View; the press room footer says SecureGuard Group Pte. Ltd. at 61 Robinson Road and gives a secureguardpro.com press address; and Google Play lists the developer as SECUREGUARD GROUP.
the rest of what is open — 435 more words
Three companies, three addresses, one service. That is X01 at level B on the provider's own documents, independent of any research finding. The research finding is separate and heavier.
Mixon-Baca, Knockel and Crandall, "Hidden Links: Analyzing Secret Families of VPN Apps" (FOCI 2025, 14 August 2025), places VPN Proxy Master in one family with Turbo VPN and Snap VPN - nearly identical decompiled Java, shared libraries and assets, and confirmed shared server infrastructure reached with the same hard-coded Shadowsocks credentials.
M15, M17 and M18 rest on that, and so does the ownership chain behind M11 and C11. X02 is documented in both directions at once. This policy's own §1.1 lists "Addresses (including residential addresses and business addresses)" among the data it does not collect; the paper observed these apps requesting the zip code of the user's public IP from ip-api.com and uploading it to a Firebase endpoint even without location permission.
C01 is none_linkable and that is what the document says, not a verdict on it. §1.1 denies collecting IP address, outgoing VPN IP, connection timestamp and session duration, and denies activity logs by name. Nothing verifies it: there is no audit, so the model reads the claim at the market prior rather than at face value, which is the correct treatment for an unaudited denial.
U07 comes from the server table's own column headers - Open VPN, SSR, ipesc/iKEv2, V2ray. SSR is ShadowsocksR and is coded shadowsocks; V2Ray stays obfuscated per the catalogue's convention. Both were first written as obfuscated because the vocabulary had no Shadowsocks code, which flattered the list: obfuscated is graded with the modern tunnels and shadowsocks is not, so C13 read openvpn and now reads shadowsocks.
The provider's own table is the source; the FOCI 2025 paper corroborates it from the other side, having reached these servers with hard-coded Shadowsocks credentials shared across the family. "Private DNS" is a column in the same table, which is what C06 rests on.
IntegrityHas it been caught saying one thing and doing another?16 fields read · 1 left unknown · 2 not applicable · 90.0 points of pressure×0.100
What this channel priced on this record:Lie 0.85Monetisation 0.15Absolute claims 0.04Cluster contagion 0.4Incident handling 0.2Owner transparency 0.4Report concealment 0.15Owner group history 0.35
Transparency reportalso read by ignorance, silenceP05_transparency_report
Computed
×0.011 of a clean record completeness 83%
Where the drop comes from: Integrity. It is the channel this record's risk is concentrated in — on its own it takes a clean record to ×0.100, and its bar above is filled to that.
Exposure is recorded as medium and the integrity status as caught_lying.
Against the rest of the register, this record sits furthest above on Ignorance — ×0.847 where the register averages ×0.662 — and furthest below on Integrity, ×0.100 against ×0.658.
Every row above is one field of the published record, and every one of them can be challenged: every row carries Report, or raise something about the record as a whole. A correction with a source behind it is made the same day, and if it moves the score it moves the rank.
