How the comparison map is scored

The comparison map places twenty-two networks, URnetwork and every product in the twenty-one head-to-head pages, on two 0–10 indexes: verifiable anonymization across, connection quality up. This page is the method: what the two indexes measure, the rule for which products are on the map at all, the weights and why they are what they are, how the anchor ladders work, the dated record of every change since the rubric was frozen, and the limits a reader should hold against all of it. The intent is that a reader who doubts any coordinate can recompute it, and, where a score is a judgement call rather than a sourced fact, see it labeled as one.

The working-out lives in two appendices. The scores page holds the complete matrix: all 198 sub-scores, the anchor ladders they were assigned against, per-product reasoning for every number, and the disclosed rescores. The sensitivity page holds the Monte Carlo record: rank intervals under weight and score uncertainty, the head-to-head crossing statistics, a withdrawn claim, and a reproduction script. The audit trail behind all three sits in the documentation repository under review/index/: METHOD.md (the rubric, frozen before any product was scored), SCORES.md (the recomputable matrix), and NOTES.md (per-score reasoning with citations). The published pages and that record are kept in agreement; if they ever disagree, one of them has a bug, and the end of this page says where to report it.

The change ledger

A scored comparison that never changes is stale, and one that changes silently is worthless. This is the dated ledger of every change to the method or to its published claims since the rubric was frozen on 2026-08-07, each marked with the direction it cuts, because a reader auditing a self-scored index should be able to see at a glance whether the corrections keep landing in the scorer's favour.

What has not changed: no weight, no anchor, and no sub-score other than the two disclosed rescores, Apple Private Relay's and URnetwork's own when its sealed session went default-on.

The standing verdict this ledger operates under is the peer review's: the index is "transparent but not validated". Transparency is what this page has always sold: every weight, anchor and sub-score published so a disagreeing reader can recompute. And the first serious reader who did recompute found a circular robustness claim and a classification-material factual error. Transparency is not validity. The index remains a single-scorer exercise with a declared conflict of interest, aggregating ordinal judgements as if they were interval measurements, validated against no outside measurement of URnetwork. No independent audit covers URnetwork's protocol, its connect engine, or the operator's server code, which is the layer the whole argument rests on. (Two third-party assessments do exist, of other surfaces: a third-party penetration test of the web application and API in April–May 2025, and a Leviathan Security Group assessment of the Android app under Google's App Defense Alliance MASA programme at assurance level AL2, completed May 2025, which it passed and which Leviathan itself scopes as not a holistic security evaluation. Neither examined logging, retention, or the data path.) What would raise the index's standing is known and none of it is writing: independent scorers with published inter-rater agreement, an outside measurement campaign, an audit of the protocol and the server. Until then, read the map as our argument made checkable, not as a measurement.

What the two indexes measure

X, verifiable anonymization. The first question of the whole corpus: what can the service see about you, and how would you know? The axis rewards two things, deliberately in this order. Structure: a design in which no single party can hold your identity and your activity together, or read your traffic in transit. And verification: the evidence that lets an outsider check the claim, meaning open source, independent audits, court and raid outcomes, and outside measurement. The quadrant names on the map state the same distinction: right of the line the see-nothing claim can be checked; left of it, however good the operator's conduct, the claim rests on trust.

Y, connection quality. The second question: is the connection good enough to live on? Latency and throughput class, whether the exit actually delivers the location it claims, how many ways in exist when networks are hostile, and whether you can get and keep the service at all.

Why these parts and not others. The X parts are the four properties that bear directly on "who can see, and how would you know"; anything else would dilute the axis with proxies. Jurisdiction and ownership, the usual VPN-marketing shorthand, are excluded on purpose: they are priors about future behavior, not verifiable properties of the system, and they resist 0–10 anchoring (the per-product pages carry them as prose, with dates and owners named). RAM-only fleets, kill switches, and app polish are likewise real but belong to product reviews, not to an anonymization index. On Y, price and device limits are excluded because they are purchasing factors, not properties of the connection; torrenting policy and port forwarding appear only insofar as they are egress restrictions, and the first of those costs URnetwork part of a point on the scores page. Two axes cannot hold everything, and these two do not try.

Which products are on the map: the selection rule

The original twenty comparators were chosen ad hoc, market share plus a wish to cover every architecture class, and no inclusion rule was published. Independent peer review called that out and supplied the proof of why it matters: Obscura, the closest architectural competitor to URnetwork, was missing until a reviewer named it. "We noticed it" is not a method. The rule below exists so the next omission is a rule-failure anyone can point to, not a judgement nobody can inspect.

A product qualifies if it meets all three conditions:

1. It is an operated intermediary service. A shipping service an ordinary consumer can obtain today, whose core function is to place an operated intermediary between the user and the destination for privacy, anonymity, or location change: commercial VPNs, platform relays, onion and mix networks, dVPNs, proxy networks. Self-hosted software where the user is the operator (a bare WireGuard server, Outline) is out of scope. There is no second party whose visibility is in question, which is the question both axes score.
2. It clears at least one of four reach-or-relevance bars: - (a) adoption: top tier of consumer VPN adoption by installs or market share in current, dated public market data; - (b) archetype flagship: the flagship or most-adopted implementation of a distinct architecture class (onion routing: Tor; mixnet: NymVPN; platform relay: Apple Private Relay; edge relay: Cloudflare WARP; mesh overlay: Tailscale; dVPN marketplace: Orchid, Mysterium, Sentinel; residential P2P proxy: Hola); - (c) evaluator recommendation: a current recommendation of a major independent privacy evaluator. This is the bar IVPN enters under: its market share is niche, but independent evaluators single it out for its verification record, which is exactly what the X axis scores; - (d) architectural competitor: a split-trust or no-single-party claim comparable to URnetwork's own headline claim. This is the bar Obscura enters under, and the bar every reviewer or reader nomination is tested against first.
3. It is scorable. Enough public evidence exists, in documentation, audits, measurements, and policies, to assign all nine sub-scores against the frozen ladders. A product that qualifies on reach but cannot be scored from that evidence is listed as pending, not scored on impression.

Disqualifiers: discontinued or unobtainable products (Google One VPN); enterprise-only offerings an individual cannot buy; white-label rebrands of an already-included stack (Betternet is not scored because Hotspot Shield already represents the Hydra stack); and self-hosted tools per condition 1.

How the set is revisited. The qualification checklist is re-run against dated market data at every corpus revision and at least every six months. Out-of-cycle triggers, any of which forces an immediate check: a product ships a no-single-party design (bar d); a product crosses an adoption bar; a reviewer or reader names a candidate. The nomination, date, and outcome get recorded whether or not the candidate passes, which is how Obscura's entry is recorded. Products that stop shipping are archived with their last-scored date, never silently removed.

The rule applied to the current set (2026-08-07). All twenty-two members qualify: Windscribe, PIA, ExpressVPN, Proton VPN, NordVPN, Surfshark, TunnelBear, IPVanish, Hotspot Shield and Hola under (a); Tor, NymVPN, Apple Private Relay, Cloudflare WARP, Tailscale, Orchid, Mysterium and Sentinel under (b); IVPN under (c); Mullvad under (a) and (c); URnetwork and Obscura, the latter scored 2026-08-07, the same day its comparison page was published, under (d). One borderline is named rather than glossed: Orchid is the member closest to the discontinued disqualifier (its mobile apps are years stale), stays while its shipped clients still function, and is the first row the revisit rule would archive.

What the rule says we are missing. A selection rule that never names a gap is decoration. Applying the same bars today names two products this corpus does not compare:

• CyberGhost clears (a) outright: it is among the largest consumer VPN brands by claimed user count, and our own evidence base already measures it (the IPinfo location study behind the egress scores includes CyberGhost, and the scoring notes cite its result). There is no principled reason it is absent while every sibling-scale major is in.
• Psiphon clears (b) as the most widely deployed dedicated censorship-circumvention service outside Tor, with documented mass adoption during national blocking events. The availability and anti-censorship part of the Y axis is its home ground, which makes the omission worse, not better.

Both are recorded as selection debt: they qualify, and until their pages and scores exist, this map's field is incomplete by its own published rule.

The weights, and why

Each index is a weighted sum of its parts; weights sum to 1.00 per axis.

X: verifiable anonymization index

The deliberate stance inside these numbers: structure (S + E = 0.60) outweighs verification (V = 0.30), on the reasoning that structure is the thing verification exists to check. An audited promise is still a promise, while a design that removes the ability to see needs less trusting. A reader who weighs the evidence record above the architecture will reorder the top of the axis, and the sensitivity page works that alternative through rather than hiding it.

Y: connection quality index

The freeze

The weights and the anchor ladders were written down and frozen on 2026-08-07, before any product was scored, and were not adjusted afterward. That is the first thing a skeptic should test, and the frozen rubric text with its date sits in the repository at review/index/METHOD.md. The rubric also pre-committed, in writing, to the outcomes most tempting to soften: URnetwork's verifiability score must be penalized for having no third-party audit; its sealed session must be scored as the opt-in it then was; and Mullvad, IVPN, Tor and NymVPN score whatever the evidence says, even where that places them above URnetwork on a part or, for Mullvad and IVPN, in the same quadrant. The frozen wording on the first of those is left as written, and it was factually wrong in our own disfavour: two third-party assessments existed at the time (the ledger row above, and the V reasoning on the scores page). The penalty it demanded still applies, because neither assessment touches the layer the axis measures, and the score was re-derived rather than adjusted. The second pre-commitment ended by ruling rather than by error: on 2026-08-07 the product owner ruled the sealed session on by default at launch, so the opt-in premise describes a state the product left. The affected sub-scores were re-derived from the unchanged anchors rather than adjusted; the ledger carries the change with its direction, and the frozen text again stands as written.

Four things did change after scoring began, and all are disclosed rather than smoothed over:

1. One sub-score was normalized during scoring. IVPN's latency part was first scored 6 on account of its smaller fleet, then normalized to 7 to match every other single-hop datacenter VPN. The corpus records no per-vendor latency deficits, and docking one vendor for fleet size without measurements would have been invented precision. The working record keeps the original value, and IVPN's entry on the scores page prints the effect either way.
2. The origin definition was corrected after scoring, by the product owner, and it is the only post-scoring change to the method. The next section explains it.
3. Apple Private Relay was rescored after independent peer review, on the same day as first scoring: the evidence base itself, and every page built on it, had misdescribed Apple's split as held by contract when Apple's own overview describes it as enforced by layered encryption. E 5→7 and S 6→7 against the unchanged frozen anchors, X 4.25→5.10, which moves Apple from the Legacy quadrant to the X line itself. The error had run in URnetwork's favour, which is the direction we most need to catch; no other product's scores were touched. The full re-derivation is in Apple's entry on the scores page.
4. URnetwork was rescored after the product owner ruled its sealed session on by default at launch: the second post-scoring rescore, and the one that moves our own dot. E 7→8 and PQ 5→7 against the unchanged frozen anchors, S re-derived and unchanged at 8, V untouched at 6; X 6.85→7.30. The re-derivation in URnetwork's entry on the scores page includes the explicit ruling that the encryption ladder's higher rung requires the default but not yet full integrity, and prints the seal's standing fail-open and key-substitution defects beside the score rather than waiving them.

These four are the score- and origin-level changes. The complete dated ledger, including the post-review method changes with the direction each cuts, is near the top of this page.

Why the axes cross at (5, 5)

The axes cross at (5.00, 5.00), the fixed center of the 0–10 scale. A position is therefore absolute against the rubric's anchors: crossing an axis line means crossing the scale midpoint, whatever the rest of the field looks like.

The first draft of the rubric defined the origin differently, as the centroid of the middle of the field (the mean of the middle eleven products per axis, which computes to (3.81, 5.66) on these scores). That definition was replaced, after scoring, because a centroid origin is relative to whoever happens to be on the chart: add three weak products and every other product moves rightward across the quadrant lines without anything about them changing. A fixed scale center is stable under any change to the field and lets a reader reason about a position without knowing who else was scored. The correction changed only where the axis lines cross, and therefore which quadrant name some products carry; no weight, anchor, or sub-score was changed with it, and nothing was re-scored afterward. Both origin definitions and the correction date are preserved in the working record.

One reading rule follows from the arithmetic. Because sub-scores are integers, a one-point change on a mid-weight part moves an index by about 0.25, which is why, throughout these pages, a product within ±0.25 of an axis line is read as sitting on the line rather than confidently on either side of it. Which products sit inside that band is tabulated with the coordinates on the scores page, and what single-point re-scores would move is worked through on the sensitivity page.

The scale: how the anchor ladders work

Every sub-score is an integer, 0–10, assigned against an anchor ladder written before any product was scored: a table of rungs that names the class of design or evidence each score band means. An integer that falls between two rungs means the product sits between those classes. As calibration across all nine parts: a score around 2 means the property is essentially absent, or exists as words only; around 5, present but partial, bounded, or held by contract and policy rather than by structure; around 9, present by construction, on by default, with the strongest evidence in the field. The nine ladders are printed in full with the matrix on the scores page, and the frozen originals sit in review/index/METHOD.md.

The limits

This is the part of the page that earns the rest, so none of it is softened.

1. These are scores of published evidence, not measurements. The inputs are the twenty-one comparison pages, vendors' own disclosure pages, audit and court records, and the IPinfo measurement study. Where outside measurement exists it moved scores; the egress column leans directly on IPinfo's results. Every latency and throughput score on the map is a structural class judgement, because the corpus forbids invented performance figures. A real measurement campaign could reorder the middle of the quality axis, and nothing on this page should be mistaken for one.
2. Nobody has measured URnetwork from outside. IPinfo measured Mullvad, IVPN and Windscribe at 0% location mismatch; no equivalent study has been run on URnetwork's exits, latency, or throughput, in either direction. Its Eg 8 rests on a mechanism you can check in code and on the structural properties of residential address space, not on a third-party result, and its L 5 and T 5 are unmeasured structural anchors. The asymmetry is stated here because it cuts against the product this documentation belongs to.
3. No independent audit covers URnetwork's protocol, connect engine or server code, and the axis is named verifiable. That absence is priced in, V 6 against Mullvad's 9, IVPN's 8 and PIA's 8, and it is the single largest criticism of URnetwork this corpus records: full-stack open source is continuous verifiability of design, but no independent check of the layer the claim rests on, no court test and no outside measurement is a real hole in a claim of verifiability, and it costs real points on the axis that carries the product's quadrant name. The two third-party assessments that do exist cover other surfaces and moved nothing; the ledger above and the V reasoning on the scores page carry them. Until 2026-08-07 this corpus said flatly that there were none; that was wrong, and correcting it changed the sentence, not the score.
4. One rule for defaults versus capabilities, applied both ways, with its inputs updated once by ruling. The rule: a product is scored on its shipping default, and an opt-in headline capability is credited as conditional structure, not as the default. Under it, URnetwork's then-opt-in sealed session scored E 7 while NymVPN's opt-in mixnet held its E at 9 rather than 10. When the product owner ruled URnetwork's session on by default at launch (2026-08-07, disclosed in the ledger), the same rule moved URnetwork to E 8. The facts changed, not the rule, while Nym's mixnet remains credited as the opt-in capability it still is. A reader who scores shipped defaults only should still lower Nym's E; one who scores capabilities only should raise it. What is not defensible is doing one without the other.
5. Some placements sit inside noise, and some orderings are weight judgements. Apple Private Relay sits within noise of both axis lines at once; Obscura sits on the quality line; Mysterium, Hola and Sentinel sit within noise below it; and defensible re-weightings reorder the top of the X axis, including against URnetwork. The named list, the single-point arithmetic, and the worked re-weightings are on the sensitivity page, beside the Monte Carlo record they belong to.
6. The scorer has a conflict of interest. URnetwork scored this field, and URnetwork is on the map. The mitigations are the ones on this page and its appendices: weights and anchors frozen before scoring, every sub-score published with its reasoning, judgement calls labeled, the re-weighting that demotes URnetwork printed rather than buried. None of them substitutes for an outside scorer. The matrix is deliberately complete enough that you can be that scorer: change the weights, or any sub-score you can argue from evidence, and the map is yours to redraw.

If the picture changes

If new evidence lands, an independent audit of URnetwork's protocol or the operator's server code, an outside measurement of its network, or a competitor shipping verifiable structural separation, the standing rule is to rescore and republish, in that order, and the ledger above gains a row with its direction marked. If a number on this page or its appendices fails to recompute, or a page drifts from the working record in review/index/, report it like any other documentation bug: issues on the repositories (github.com/urnetwork), or feedback in the apps.