Score derivation
SunsonVPN
Under the Default (evidence-weighted) weighting, SunsonVPN scores 7.5 on the 65% of our methodology we hold evidence for, provably between 4.91 (every unmeasured dimension at its worst) and 8.05 (every one at its published maximum).
provably between 4.91 and 8.05
Weighting: Default (evidence-weighted). Weights are allocated toward what this site independently verifies. Speed and streaming are vendor-claimed rather than measured here, so they carry roughly half the weight the industry standard assigns them; that weight moves to privacy, transparency and server authenticity, all of which are checked against primary documents or our own probe network.
How the headline is summed
| Dimension | Weight | Value | Floor add | Potential add |
|---|---|---|---|---|
| Privacy | 0.24 | 9.08 | 2.179 | 2.179 |
| Security | 0.18 | 10.00 | 1.800 | 1.800 |
| Transparency | 0.12 | 0.71 | 0.086 | 0.086 |
| Server authenticity | 0.10 | ≤10.0 | 0.000 | 1.000 |
| Server locations | 0.07 | ≤10.0 | 0.000 | 0.700 |
| Streaming | 0.07 | ≤6.5 | 0.000 | 0.455 |
| Speed | 0.07 | ≤8.5 | 0.000 | 0.595 |
| Device compatibility | 0.05 | 6.00 | 0.300 | 0.300 |
| Usability | 0.04 | ≤10.0 | 0.000 | 0.400 |
| Torrenting | 0.03 | 8.00 | 0.240 | 0.240 |
| Additional features | 0.03 | 10.00 | 0.300 | 0.300 |
| Totals | 1.00 | 4.905 | 8.055 |
Floor 4.905 is the value column summed; potential 8.055 credits each unscored dimension at its ceiling instead. Renormalising the floor over the 65% that scored gives 7.55, held at or below the potential to publish 7.5.
Privacy
9.1Documented56% assessedcomposite · value = clamp(Σ weightᵢ · valueᵢ / Σ weightᵢ) · base 9.375 · coverage 56%
Current website address updated editorially on 2026-11-01; the quote and capture hash refer to the historical policy, not a new verification of the current website.
“We do not log, store or otherwise process: your originating IP address; the websites you visit or services you use while connected; DNS queries; connection or disconnection timestamps; per-session bandwidth usage; or any other data that could be used to associate online activity with an individual user.”
Current website address updated editorially on 2026-11-01; the quote and capture hash refer to the historical policy, not a new verification of the current website.
“We do not log, store or otherwise process: your originating IP address; the websites you visit or services you use while connected; DNS queries; connection or disconnection timestamps; per-session bandwidth usage; or any other data that could be used to associate online activity with an individual user.”
Current website address updated editorially on 2026-11-01; the quote and capture hash refer to the historical policy, not a new verification of the current website.
“We do not log, store or otherwise process: your originating IP address; the websites you visit or services you use while connected; DNS queries; connection or disconnection timestamps; per-session bandwidth usage; or any other data that could be used to associate online activity with an individual user.”
No evidence gathered yet, this rule was not assessed, and cost the provider nothing.
Current website address updated editorially on 2026-11-01; the quote and capture hash refer to the historical policy, not a new verification of the current website.
“We do not log, store or otherwise process: your originating IP address; the websites you visit or services you use while connected; DNS queries; connection or disconnection timestamps; per-session bandwidth usage; or any other data that could be used to associate online activity with an individual user.”
No evidence gathered yet, this rule was not assessed, and cost the provider nothing.
Current website address updated editorially on 2026-11-01; the quote and capture hash refer to the historical policy, not a new verification of the current website.
“We do not log, store or otherwise process: your originating IP address; the websites you visit or services you use while connected; DNS queries; connection or disconnection timestamps; per-session bandwidth usage; or any other data that could be used to associate online activity with an individual user.”
No evidence gathered yet, this rule was not assessed, and cost the provider nothing.
Current website address updated editorially on 2026-11-01. The historical quote is shortened before the old support address; the original capture hash is retained, not recalculated as a current-policy hash.
“We collect only the minimum information necessary to operate the Service: (a) Account information — the email address you register with and your hashed password. We retain account information only for as long as your account exists.”
No evidence gathered yet, this rule was not assessed, and cost the provider nothing.
No evidence, this part scored nothing and its weight was redistributed across the parts that did.
Current website address updated editorially on 2026-11-01; the legal entity quote and capture hash retain the original historical scope.
“QuicklyVPN Limited ("QuicklyVPN", "we", "us" or "our"), a company incorporated in the Hong Kong Special Administrative Region, with its registered address at 6/F, 822 Lai Chi Kok Road, Lai Chi Kok, Kowloon, Hong Kong. These Terms are governed by the laws of the Hong Kong Special Administrative Region.”
No evidence gathered yet, this rule was not assessed, and cost the provider nothing.
No evidence gathered yet, this rule was not assessed, and cost the provider nothing.
Current website address updated editorially on 2026-11-01; the legal entity quote and capture hash retain the original historical scope.
“QuicklyVPN Limited ("QuicklyVPN", "we", "us" or "our"), a company incorporated in the Hong Kong Special Administrative Region, with its registered address at 6/F, 822 Lai Chi Kok Road, Lai Chi Kok, Kowloon, Hong Kong. These Terms are governed by the laws of the Hong Kong Special Administrative Region.”
Current website address updated editorially on 2026-11-01. Capture date, original capture hash and quoted evidence remain historical; this is not a new capture at the current address.
“WireGuard; AES-256-GCM; Shadowsocks-2022; Kill Switch; Smart Split Tunneling with per-app, per-domain and per-IP routing rules; RAM-only servers; Windows, macOS, iOS, Android, Linux, Router / OpenWrt.”
No evidence gathered yet, this rule was not assessed, and cost the provider nothing.
Current website address updated editorially on 2026-11-01. The historical quote is shortened before the old support address; the original capture hash is retained, not recalculated as a current-policy hash.
“We collect only the minimum information necessary to operate the Service: (a) Account information — the email address you register with and your hashed password. We retain account information only for as long as your account exists.”
No evidence gathered yet, this rule was not assessed, and cost the provider nothing.
Current website address updated editorially on 2026-11-01. The historical quote starts after the former plan name and is not a statement of the current offer.
“¥39.90 / month, 200 GB, 2 devices. 30-day money-back guarantee. Up to 5 devices on one account. Payment: Credit and debit cards, PayPal, Alipay, WeChat Pay, and anonymous cryptocurrency payments (BTC, ETH, USDT, USDC and 50+ others).”
Security
10.0Documented67% assessedabsolute · value = clamp(base + Σ delta) · base 10 · coverage 67%
Current website address updated editorially on 2026-11-01. Capture date, original capture hash and quoted evidence remain historical; this is not a new capture at the current address.
“WireGuard; AES-256-GCM; Shadowsocks-2022; Kill Switch; Smart Split Tunneling with per-app, per-domain and per-IP routing rules; RAM-only servers; Windows, macOS, iOS, Android, Linux, Router / OpenWrt.”
Current website address updated editorially on 2026-11-01. Capture date, original capture hash and quoted evidence remain historical; this is not a new capture at the current address.
“WireGuard; AES-256-GCM; Shadowsocks-2022; Kill Switch; Smart Split Tunneling with per-app, per-domain and per-IP routing rules; RAM-only servers; Windows, macOS, iOS, Android, Linux, Router / OpenWrt.”
Current website address updated editorially on 2026-11-01. Capture date, original capture hash and quoted evidence remain historical; this is not a new capture at the current address.
“WireGuard; AES-256-GCM; Shadowsocks-2022; Kill Switch; Smart Split Tunneling with per-app, per-domain and per-IP routing rules; RAM-only servers; Windows, macOS, iOS, Android, Linux, Router / OpenWrt.”
Current website address updated editorially on 2026-11-01. Capture date, original capture hash and quoted evidence remain historical; this is not a new capture at the current address.
“WireGuard; AES-256-GCM; Shadowsocks-2022; Kill Switch; Smart Split Tunneling with per-app, per-domain and per-IP routing rules; RAM-only servers; Windows, macOS, iOS, Android, Linux, Router / OpenWrt.”
No evidence gathered yet, this rule was not assessed, and cost the provider nothing.
No evidence gathered yet, this rule was not assessed, and cost the provider nothing.
Current website address updated editorially on 2026-11-01. Capture date, original capture hash and quoted evidence remain historical; this is not a new capture at the current address.
“WireGuard; AES-256-GCM; Shadowsocks-2022; Kill Switch; Smart Split Tunneling with per-app, per-domain and per-IP routing rules; RAM-only servers; Windows, macOS, iOS, Android, Linux, Router / OpenWrt.”
Current website address updated editorially on 2026-11-01. Capture date, original capture hash and quoted evidence remain historical; this is not a new capture at the current address.
“WireGuard; AES-256-GCM; Shadowsocks-2022; Kill Switch; Smart Split Tunneling with per-app, per-domain and per-IP routing rules; RAM-only servers; Windows, macOS, iOS, Android, Linux, Router / OpenWrt.”
No evidence gathered yet, this rule was not assessed, and cost the provider nothing.
Transparency
0.7Documented33% assessednormalized · value = clamp(10 × Σ delta / Σ max) · base 0 · coverage 33%
Editorial brand revision dated 2026-11-01. This hash identifies the revised public JSON; test date, tested artifacts and security conclusions are unchanged.
“The completed static package and supply-chain scope receives 55/100: artifact integrity and provenance 13/30, platform signing 18/30, permissions and production hardening 16/20, and public security transparency 8/20. This is not a final VPN application-security or overall provider score.”
Editorial brand revision dated 2026-11-01. This hash identifies the revised public JSON; test date, tested artifacts and security conclusions are unchanged.
“The completed static package and supply-chain scope receives 55/100: artifact integrity and provenance 13/30, platform signing 18/30, permissions and production hardening 16/20, and public security transparency 8/20. This is not a final VPN application-security or overall provider score.”
No evidence gathered yet, this rule was not assessed, and cost the provider nothing.
No evidence gathered yet, this rule was not assessed, and cost the provider nothing.
No evidence gathered yet, this rule was not assessed, and cost the provider nothing.
No evidence gathered yet, this rule was not assessed, and cost the provider nothing.
Server authenticity
no evidence, excluded from the weighted meanNothing here could be scored, so this dimension is dropped from the mean rather than counted as zero. In the interval it is credited at its ceiling of 10.0, the most it could ever earn, and nowhere else.
Server locations
no evidence, excluded from the weighted meanNothing here could be scored, so this dimension is dropped from the mean rather than counted as zero. In the interval it is credited at its ceiling of 10.0, the most it could ever earn, and nowhere else.
Streaming
no evidence, excluded from the weighted meanNothing here could be scored, so this dimension is dropped from the mean rather than counted as zero. In the interval it is credited at its ceiling of 6.5, the most it could ever earn, and nowhere else.
Speed
no evidence, excluded from the weighted meanNothing here could be scored, so this dimension is dropped from the mean rather than counted as zero. In the interval it is credited at its ceiling of 8.5, the most it could ever earn, and nowhere else.
Device compatibility
6.0Documented55% assessednormalized · value = clamp(10 × Σ delta / Σ max) · base 0 · coverage 55%
Current website address updated editorially on 2026-11-01. Versions, availability and capture hash describe the historical download page only.
“Android, Windows and macOS have enabled download URLs for version 1.0.1. iOS and Linux are disabled and marked Coming Soon. The page offers help installing on a router, console or smart TV but publishes no router package.”
Current website address updated editorially on 2026-11-01. Versions, availability and capture hash describe the historical download page only.
“Android, Windows and macOS have enabled download URLs for version 1.0.1. iOS and Linux are disabled and marked Coming Soon. The page offers help installing on a router, console or smart TV but publishes no router package.”
Current website address updated editorially on 2026-11-01. Versions, availability and capture hash describe the historical download page only.
“Android, Windows and macOS have enabled download URLs for version 1.0.1. iOS and Linux are disabled and marked Coming Soon. The page offers help installing on a router, console or smart TV but publishes no router package.”
Current website address updated editorially on 2026-11-01. Versions, availability and capture hash describe the historical download page only.
“Android, Windows and macOS have enabled download URLs for version 1.0.1. iOS and Linux are disabled and marked Coming Soon. The page offers help installing on a router, console or smart TV but publishes no router package.”
No evidence gathered yet, this rule was not assessed, and cost the provider nothing.
No evidence gathered yet, this rule was not assessed, and cost the provider nothing.
No evidence gathered yet, this rule was not assessed, and cost the provider nothing.
No evidence gathered yet, this rule was not assessed, and cost the provider nothing.
Current website address updated editorially on 2026-11-01. Versions, availability and capture hash describe the historical download page only.
“Android, Windows and macOS have enabled download URLs for version 1.0.1. iOS and Linux are disabled and marked Coming Soon. The page offers help installing on a router, console or smart TV but publishes no router package.”
No evidence gathered yet, this rule was not assessed, and cost the provider nothing.
Current website address updated editorially on 2026-11-01. The historical quote starts after the former plan name and is not a statement of the current offer.
“¥39.90 / month, 200 GB, 2 devices. 30-day money-back guarantee. Up to 5 devices on one account. Payment: Credit and debit cards, PayPal, Alipay, WeChat Pay, and anonymous cryptocurrency payments (BTC, ETH, USDT, USDC and 50+ others).”
Usability
no evidence, excluded from the weighted meanNothing here could be scored, so this dimension is dropped from the mean rather than counted as zero. In the interval it is credited at its ceiling of 10.0, the most it could ever earn, and nowhere else.
Torrenting
8.0Documented50% assessednormalized · value = clamp(10 × Σ delta / Σ max) · base 0 · coverage 50%
No evidence gathered yet, this rule was not assessed, and cost the provider nothing.
No evidence gathered yet, this rule was not assessed, and cost the provider nothing.
Current website address updated editorially on 2026-11-01. Capture date, original capture hash and quoted evidence remain historical; this is not a new capture at the current address.
“WireGuard; AES-256-GCM; Shadowsocks-2022; Kill Switch; Smart Split Tunneling with per-app, per-domain and per-IP routing rules; RAM-only servers; Windows, macOS, iOS, Android, Linux, Router / OpenWrt.”
Current website address updated editorially on 2026-11-01; the quote and capture hash refer to the historical policy, not a new verification of the current website.
“We do not log, store or otherwise process: your originating IP address; the websites you visit or services you use while connected; DNS queries; connection or disconnection timestamps; per-session bandwidth usage; or any other data that could be used to associate online activity with an individual user.”
Additional features
10.0Documented22% assessednormalized · value = clamp(10 × Σ delta / Σ max) · base 0 · coverage 22%
Current website address updated editorially on 2026-11-01. Capture date, original capture hash and quoted evidence remain historical; this is not a new capture at the current address.
“WireGuard; AES-256-GCM; Shadowsocks-2022; Kill Switch; Smart Split Tunneling with per-app, per-domain and per-IP routing rules; RAM-only servers; Windows, macOS, iOS, Android, Linux, Router / OpenWrt.”
Current website address updated editorially on 2026-11-01. Capture date, original capture hash and quoted evidence remain historical; this is not a new capture at the current address.
“WireGuard; AES-256-GCM; Shadowsocks-2022; Kill Switch; Smart Split Tunneling with per-app, per-domain and per-IP routing rules; RAM-only servers; Windows, macOS, iOS, Android, Linux, Router / OpenWrt.”
No evidence gathered yet, this rule was not assessed, and cost the provider nothing.
No evidence gathered yet, this rule was not assessed, and cost the provider nothing.
No evidence gathered yet, this rule was not assessed, and cost the provider nothing.
No evidence gathered yet, this rule was not assessed, and cost the provider nothing.
No evidence gathered yet, this rule was not assessed, and cost the provider nothing.
No evidence gathered yet, this rule was not assessed, and cost the provider nothing.
No evidence gathered yet, this rule was not assessed, and cost the provider nothing.
Reading the derivation
- Measured
- We produced this number ourselves and can reproduce it.
- Documented
- Read out of a primary document: a privacy policy, an audit report, or source code.
- Vendor-claimed
- Asserted by the provider. We have not independently verified it, and the score is capped accordingly.
- No evidence
- We found nothing to score. The dimension is excluded from the weighted mean rather than counted as zero.
A ✓ is a rule we checked that found nothing wrong, for a no-logs provider that is the point, not an absence of news. A “not disclosed” line is a negative we scored and cited; a “not assessed” line is our own gap, which lowers coverage but costs the provider nothing. Every score here is a published-formula reading of the published evidence.