Where the security score comes from
Eight channels, each asking one question of the published record and reading a named set of fields to answer it. They multiply rather than add — the factor beside a channel is what is left after the pressure it found, and open a channel to see every field it read, as it is stored. How the model works
Security fields
67 55 of them feed a channel
Established
37 29 left unknown, 1 not applicable
Completeness
58% the share the model could weigh
Citations
50 across 15 documents
Every value carries what it rests on, and the model weighs the four levels differently. Weight, then how many citations on this record sit at that level:
B weighs 0.85 · 47 hereD weighs 0.35 · 3 here
The weights are methodology.json’s own; a claim seen in the artefact itself counts for more than the same claim reported second-hand. The date at the end of a row is the day that value was last read.
A channel does not price every field it reads. The ones it did are marked along their edge and carry what they added; everything else was read and cost nothing. Only a channel that composes field by field can mark a field at all — the rest price themselves by the parameters printed above their rows.
Still open on this record.
Full audit report. X-VPN's February–June 2026 ISAE 3000 no-logs audit by an unnamed Big Four firm is gated behind an X-VPN account login; the engagement's fleet coverage, exact assurance level and actual findings on retention (V04, V07, V11, V15) could not be read and stay unknown, so credence rests on a declared audit rather than a verified one.
Ultimate beneficial owner. X-VPN names its operating entity, LIGHTNINGLINK NETWORKS PTE. LTD. in Singapore, but no natural person or parent company is disclosed anywhere on the site; a corporate-registry search would close this.
Device identifiers on the free, ad-supported app. The privacy policy names a Firebase installation ID but does not say whether the AdMob/InMobi/Chartboost/Liftoff ad SDKs on the free tier also collect a resettable advertising ID; the Play Store data-safety form could not be reached this session to check.
the rest of what is open — 38 more words
DNS operation and server ownership. The policy states DNS queries are not logged but never says whether X-VPN runs its own resolvers in the tunnel, and no page states whether server hardware is owned or leased from datacenters.
On the record as a whole.
Third-party coverage (a VPN review aggregator) claims X-VPN's jurisdiction moved from Hong Kong to Singapore under the current owner at an unstated date; this could not be verified against a primary document and is not reflected in M16_control_since. A Macworld piece on the 2026 audit is marked 'Sponsored by X-VPN'; it is not used as a source here, and the outlets covering the audit could not otherwise be confirmed as independent within this session.
RetentionDoes a record exist that links traffic to a person, and who checked?13 fields read · 4 left unknown · 54.7 points of pressure×0.453
Composed rather than added: a prior of 0.55 on the silent branch, moved by what the paper says (0.0053) and by what the practice shows (0.0), at credence 0.0053 from the audit and 0.2082 from how the provider engaged, against a severity of 0.03 for what is actually retained.
How the report is published
Computed
×0.151 of a clean record completeness 58%
Where the drop comes from: Retention. It is the channel this record's risk is concentrated in — on its own it takes a clean record to ×0.453, and its bar above is filled to that.
Exposure is recorded as medium and the integrity status as unexamined.
Against the rest of the register, this record sits furthest above on Integrity — ×0.940 where the register averages ×0.658 — and furthest below on Hygiene, ×0.720 against ×0.808.
Every row above is one field of the published record, and every one of them can be challenged: every row carries Report, or raise something about the record as a whole. A correction with a source behind it is made the same day, and if it moves the score it moves the rank.
