Where the security score comes from
Eight channels, each asking one question of the published record and reading a named set of fields to answer it. They multiply rather than add — the factor beside a channel is what is left after the pressure it found, and open a channel to see every field it read, as it is stored. How the model works
Security fields
67 55 of them feed a channel
Established
20 36 left unknown, 11 not applicable
Completeness
39% the share the model could weigh
Citations
23 across 7 documents
Every value carries what it rests on, and the model weighs the four levels differently. Weight, then how many citations on this record sit at that level:
A weighs 1.00 · 7 hereB weighs 0.85 · 16 here
The weights are methodology.json’s own; a claim seen in the artefact itself counts for more than the same claim reported second-hand. The date at the end of a row is the day that value was last read.
A channel does not price every field it reads. The ones it did are marked along their edge and carry what they added; everything else was read and cost nothing. Only a channel that composes field by field can mark a field at all — the rest price themselves by the parameters printed above their rows.
Still open on this record.
Retention is unresolved because the provider's own site contradicts itself. The "Wirevpn Privacy Policy" article says the app does not collect original IP, connection timestamps, browsing destinations or data volume.
A second, unrelated document sits under the same label and says the opposite. It is unedited template text for a different product ("ishark", www.isharkvpn.com), and it states that IP address, browser type, access time, hardware identifiers and browsing records are collected and stored in mainland China. Both are live and reachable from the site's own footer, so C01_linkable_retention is left unknown rather than picked between them.
the rest of what is open — 180 more words
No independent audit, transparency report or seizure record exists to check either claim against. V01_audit_exists is no; the pressure block is none_known throughout on an honest search of press and the provider's own site, not on a document that rules an event out.
The fleet claim cannot be verified against the published list. The site claims 76+ countries and 4,592+ servers, but the actual server-location list on the same page stops mid-word after roughly three dozen entries. U02_server_countries stays unknown rather than publishing a list the page itself does not finish printing.
Pricing is not published anywhere reachable. The site carries no pricing page, and the App Store and Play Store listings show the app as free with in-app purchases but do not state the subscription price; only an auto-renewal agreement confirms a paid tier exists at all, without a figure. U04/U04b stay unknown.
Protocols, kill switch, split tunnelling and device limits are not documented anywhere public — these live inside the client UI, which this audit cannot install or run, so the entire technical-capability block below C07a stays unknown.
On the record as a whole.
The registered operator is WEILAI NETWORK TECHNOLOGY CO., LIMITED, a UK private limited company (Companies House #13720448, incorporated 2021-11-03), named in the site's "Automatic renewal agreement" article, not on the About page or in either privacy-policy article. Its sole director since incorporation is Sheng Zhihua, a Chinese national resident in China; no ownership change is on record.
The Google Play listing names the developer as "WIRE LTD." instead, a different name for the same product with no explanation offered anywhere. Two more pieces of the site are unedited templates from unrelated products: the Terms of Service (article /help/detail/35) is written throughout for a service called "ishark", and the /servers page's marketing copy ("PIA's global server network offers unbeatable digital privacy...") is Private Internet Access's own text, copied without changing the brand name.
the rest of what is open — 120 more words
None of this maps cleanly onto a scored field — it is not a proven false claim about Wire VPN's own behaviour, and there is no audit to compare it against — but a reader should know the site's legal and marketing copy is shared with at least two other, unrelated VPN brands before weighing anything else it says about itself.
The iOS build's App Privacy label (data not linked to identity: usage data and diagnostics only) and the Play Store's data-safety form (app info & performance, device or other IDs shared with third parties) both broadly match the privacy policy's disclosure of Google Ads and Firebase Crashlytics, which is why X12_store_data_declaration reads matches_policy despite the stores naming different categories.
RetentionDoes a record exist that links traffic to a person, and who checked?13 fields read · 3 left unknown · 9 not applicable · 55.0 points of pressure×0.450
Composed rather than added: a prior of 0.55 on the none branch, moved by what the paper says (0.0) and by what the practice shows (0.0), at credence 0.0 from the audit and 0.35 from how the provider engaged, against a severity of 0.55 for what is actually retained.
How the report is publishedV02_report_publication
not applicable
nothing published · recorded as asserted
ReportComputed
×0.105 of a clean record completeness 39%
Where the drop comes from: Retention. It is the channel this record's risk is concentrated in — on its own it takes a clean record to ×0.450, and its bar above is filled to that.
Exposure is recorded as low and the integrity status as unexamined.
Against the rest of the register, this record sits furthest above on Jurisdiction — ×0.849 where the register averages ×0.680 — and furthest below on Ignorance, ×0.451 against ×0.662.
Every row above is one field of the published record, and every one of them can be challenged: every row carries Report, or raise something about the record as a whole. A correction with a source behind it is made the same day, and if it moves the score it moves the rank.
