27 Aug 202611 changes
Retention linkable to a person as declaredC01_linkable_retention
aggregates_only→ changed to source_ip
RAM-only diskless serversC02_ram_only
yes_declared→ changed to partial
Chronology of documented enforcement eventsP12_case_history
{"date":"2021-07","kind":"seizure","outcome":"nothing_produced","source_url":"https://windscribe.com/features/no-identifying-logs"}, {"date":"2025-04","kind":"court_order","outcome":"nothing_produced","source_url":"https://windscribe.com/features/no-identifying-logs"}, {"date":"2026-02","kind":"seizure","outcome":"nothing_produced","source_url":"https://windscribe.com/features/no-identifying-logs"}→ changed to {"date":"2021-07","kind":"seizure","outcome":"nothing_produced","source_url":"https://windscribe.com/features/no-identifying-logs"}, {"date":"2025-04","kind":"court_order","outcome":"nothing_produced","source_url":"https://windscribe.com/blog/windscribe-greek-court-case/"}, {"date":"2026-02","kind":"seizure","outcome":"nothing_produced","source_url":"https://windscribe.com/features/no-identifying-logs"}
Server fleet coverageV04_scope_servers
not on the record→ changed to sample
Auditor nameV05_audit_firm
Packetlabs (FreshScribe server stack, June 2024); Leviathan Security (earlier engagements)→ changed to Packetlabs (June 2024 retest, one production node); Leviathan Security Group (desktop 2021, mobile 2022)
Date of latest reportV08_audit_date_latest
2024-06-01→ changed to 2024-06-26
What the report states is retainedV11_audit_findings
not_stated→ changed to source_ip
Marketing versus audit findingsX02_claim_gap
none→ changed to policy_contradicts_audit
Security scoresecurity.score
59→ changed to 14
Security verdictsecurity.verdict
acceptable→ changed to not_recommended
Chronology of documented enforcement eventsP12_case_history
{"date":"2021-07","kind":"seizure","outcome":"nothing_produced","source_url":"https://windscribe.com/features/no-identifying-logs"}, {"date":"2025-04","kind":"court_order","outcome":"nothing_produced","source_url":"https://windscribe.com/blog/windscribe-greek-court-case/"}, {"date":"2026-02","kind":"seizure","outcome":"nothing_produced","source_url":"https://windscribe.com/features/no-identifying-logs"}→ changed to {"date":"2021-06","kind":"seizure","outcome":"nothing_produced","source_url":"https://en.ain.ua/2021/07/28/ukrainian-authorities-seize-windscribe-vpn-servers/"}, {"date":"2025-04","kind":"court_order","outcome":"nothing_produced","source_url":"https://windscribe.com/blog/windscribe-greek-court-case/"}, {"date":"2026-02","kind":"seizure","outcome":"nothing_produced","source_url":"https://www.tomshardware.com/software/vpn/dutch-authorities-allegedly-seize-vpn-server-without-a-warrant-company-claims-that-law-enforcement-will-return-it-after-analyzing-the-device-fully"}
Where the security score comes from
Eight channels, each asking one question of the published record and reading a named set of fields to answer it. They multiply rather than add — the factor beside a channel is what is left after the pressure it found, and open a channel to see every field it read, as it is stored. How the model works
Security fields
67 55 of them feed a channel
Established
54 10 left unknown, 3 not applicable
Completeness
84% the share the model could weigh
Citations
73 across 23 documents
Every value carries what it rests on, and the model weighs the four levels differently. Weight, then how many citations on this record sit at that level:
A weighs 1.00 · 13 hereB weighs 0.85 · 51 hereC weighs 0.70 · 9 here
The weights are methodology.json’s own; a claim seen in the artefact itself counts for more than the same claim reported second-hand. The date at the end of a row is the day that value was last read.
A channel does not price every field it reads. The ones it did are marked along their edge and carry what they added; everything else was read and cost nothing. Only a channel that composes field by field can mark a field at all — the rest price themselves by the parameters printed above their rows.
Still open on this record.
What the pentest found. The security score rests on the June 2024 Packetlabs report and reads it in the negative direction. The penetration test found the IKEv2 service storing the origin IP of connecting users along with session start and stop times, in volatile memory and also on disk, and microservice logs carrying OpenVPN credentials, WireGuard pre-shared keys and IKEv2 usernames.
The retest, and its own caveat. The retest three weeks later verified all of it remediated — but the report's own conclusion states that this "does not cover every discovery noted within the finding", and attributes part of the finding to configuration improperly deployed on the test node.
the rest of what is open — 207 more words
Why retention is priced on the finding. Retention is therefore priced on what an auditor demonstrated was reachable rather than on what the policy declares, and the integrity channel carries the distance between the two. Read that as a two-year-old finding on one node, not as a current measurement: the scope was ca-023.windscribe.com alone, and a newer engagement covering more of the fleet is what would settle it.
The list that was never read. The offered country list was never read, so neither the usability country score nor the mandate intersection can be computed — Windscribe publishes a physical/virtual distinction, which makes C09b answerable here as soon as the list is. User scale is also unestablished, which leaves the exposure band resting on less than it should.
Where the three events now cite from. AIN.UA still carries the Ukrainian servers taken on 24 June 2021, and Windscribe's own blog the Greek case dismissed on 11 April 2025. The Dutch seizure and the seizure field itself now cite Windscribe's own no-logs page rather than the affiliate-paid press that first reported it: a company account of its own seizure is primary, not somebody else's account of one. The Ukrainian event is dated to the seizure itself, not the write-up.
On the record as a whole.
Three separate demands in three jurisdictions, none of which produced data, and all three dated. This is the record the practice route was built to price: it outweighs the audit, which is a pentest rather than a no-logs engagement.
U08 is desktop_only on Windscribe's own feature page: the Firewall ships in the Windows, Mac and Linux apps, and on Android and iOS the page directs the user to the operating system's own Always-On VPN instead. That is a platform feature rather than the provider's, which is the distinction the field is counting.
U12b is partial on the same basis — the marketing page promises unblocking, while the support article states the company cannot guarantee that all streaming services will work and a second article attributes Netflix showing only Originals to Netflix's own VPN detection.
RetentionDoes a record exist that links traffic to a person, and who checked?13 fields read · 1 left unknown · 75.0 points of pressure×0.250
Composed rather than added: a prior of 0.55 on the stated branch, moved by what the paper says (0.2215) and by what the practice shows (0.85), at credence 0.9497 from the audit and 0.5652 from how the provider engaged, against a severity of 0.75 for what is actually retained.
Computed
×0.113 of a clean record completeness 84%
Where the drop comes from: Retention. It is the channel this record's risk is concentrated in — on its own it takes a clean record to ×0.250, and its bar above is filled to that.
Exposure is recorded as medium and the integrity status as caught_lying.
Against the rest of the register, this record sits furthest above on Ignorance — ×0.896 where the register averages ×0.662 — and furthest below on Retention, ×0.250 against ×0.432.
Every row above is one field of the published record, and every one of them can be challenged: every row carries Report, or raise something about the record as a whole. A correction with a source behind it is made the same day, and if it moves the score it moves the rank.
