Transparency methodology
How we calculate, collect and verify our data.
This page explains the methodology behind every metric in our Quarterly Impact & Transparency Report. From how we define eligible revenue to how we select and score partner organizations, every calculation is documented here so you can verify our claims independently.
01
Overview
A summary of the data pipeline behind our transparency reports — from raw payment data to published metrics.
Every quarter, PrivateByRight publishes a comprehensive transparency report covering financial contributions, partner allocations, legal request handling, and security posture. The data in these reports follows a consistent methodology designed to be auditable, reproducible, and independently verifiable.
Our reporting pipeline draws from four primary data sources, each serving a distinct role in the calculation chain:
Payment processor
Gross revenue, refunds, taxes, and processing fees
Internal ledger
Eligible revenue calculations and donation commitments
Bank records
Transfer confirmations for partner payouts
Legal log
Formal data requests, outcomes, and jurisdiction data
Reporting cadence
Reports are published quarterly. Revenue and donation figures are calculated on a monthly basis and aggregated at quarter-end. All figures use month-end close dates. Reports are typically published within 30 days of quarter-end.
02
Revenue calculation
How we define gross revenue, what we exclude, and how we arrive at the eligible revenue figure used for donation calculations.
Gross membership revenue
The total amount collected from all membership subscription payments during the reporting period, before any deductions.
This includes every plan and billing period. It is the top-line figure exported directly from our payment processor and represents the starting point for all donation calculations.
Exclusions
Three categories of costs are deducted from gross revenue before the donation rate is applied.
Refunds: any subscription refunded within the reporting period (e.g., 30-day money-back guarantee claims). Taxes: VAT, sales tax, or other jurisdiction-specific taxes collected on behalf of tax authorities. Payment processing fees: fees charged by our payment processor for handling transactions.
Eligible revenue
The net figure after all exclusions have been deducted. This is the base on which the donation rate is applied.
Eligible revenue is calculated monthly and recorded in our internal ledger at month-end close. The quarterly figure is the sum of three monthly eligible revenue calculations. This ensures donations are only calculated on revenue we have actually retained.
All values are illustrative. Actual figures are published in each quarterly report. The eligible revenue figure is independently verifiable by comparing our payment processor export against the published totals.
Monthly breakdown
The quarterly report includes a month-by-month table showing gross revenue, eligible revenue, the applied donation rate, and the resulting donation for each month. This granularity allows readers to track how revenue and donations fluctuate within a quarter, rather than only seeing aggregated totals.
| Period | Gross rev. | Eligible rev. | Rate | Donation |
|---|---|---|---|---|
| Month 1 | €XX,XXX | €XX,XXX | X% | €X,XXX |
| Month 2 | €XX,XXX | €XX,XXX | X% | €X,XXX |
| Month 3 | €XX,XXX | €XX,XXX | X% | €X,XXX |
| Total | €XX,XXX | €XX,XXX | X% | €X,XXX |
Data sources: Stripe for gross revenue and exclusions; internal ledger for eligible revenue and donation commitment.
03
Donation methodology
How the donation rate is applied, the difference between committed and paid, and the timing of fund transfers.
Donation rate
A fixed percentage of eligible membership revenue, calculated monthly and committed at month-end close.
The donation rate is set by PrivateByRight’s leadership and reviewed annually. It is applied uniformly across all eligible revenue — there is no variation by plan type, billing frequency, or geography. The rate is published in every quarterly report for full transparency.
Committed vs paid
‘Committed’ means funds have been allocated at month-end. ‘Paid out’ means funds have been transferred to the partner.
There may be a timing gap between commitment and payout due to bank processing, partner onboarding, or minimum payout thresholds. Both figures are reported separately in the quarterly report so readers can track the full lifecycle of each donation.
The donation commitment is recorded in the internal ledger at month-end. Payout to partners is confirmed via bank transfer records and partner receipts.
Allocation principles
Once the total quarterly donation is determined, it is distributed among partner organizations according to these governing principles:
Alignment requirement
Partners must operate in alignment with digital rights, privacy advocacy, press freedom, or human rights.
Minimum payout threshold
A minimum payout amount per quarter ensures administrative costs do not outweigh the donation value.
Concentration limit
No single partner receives more than a defined percentage of the total quarterly donation to ensure diversification.
Quarterly review
Allocations are reviewed and rebalanced each quarter by the internal allocation committee.
Receipt confirmation
All partners must provide confirmation of receipt before the payout is marked as complete.
Public reporting
Every allocation is published in the quarterly report with partner name, focus area, amount, and payment date.
04
Partner selection
How we identify, evaluate, and score potential partner organizations using a structured assessment framework.
Partner organizations are evaluated using a weighted scoring framework. Each candidate is assessed across five criteria, with scores assigned on a 1–10 scale and multiplied by the criterion’s weight. The total weighted score determines eligibility and allocation priority.
Minimum qualifying score:60 / 100
Organisations scoring below the threshold are not eligible for funding in the current quarter but may reapply after addressing identified gaps.
Mission alignment
How closely the organization’s mission aligns with digital rights, privacy, press freedom, or human rights advocacy. Evaluated based on stated mission, published work, and public track record.
Weight30%
Scored 1–10
Demonstrated impact
Evidence of tangible outcomes — policy changes influenced, individuals protected, tools built, or communities served. Preference given to organizations with measurable, documented results.
Weight25%
Scored 1–10
Operational transparency
The organization’s own transparency practices: published financials, governance structure, public reporting, and willingness to share how funds are used.
Weight20%
Scored 1–10
Geographic & thematic reach
Breadth of impact across regions and issue areas. Preference for organizations operating in underserved regions or addressing gaps in the current partner portfolio.
Weight15%
Scored 1–10
Organisational stability
Financial health, team capacity, and operational continuity. Ensures that donated funds will be used effectively and the partnership can be sustained over multiple quarters.
Weight10%
Scored 1–10
Rebalancing & review
Partner scores and allocations are reviewed quarterly. New candidates can be nominated at any time, but formal scoring and onboarding occurs during the quarterly review cycle. Existing partners are re-evaluated annually to ensure continued alignment and impact.
See who we support today05
Legal & data requests
How we receive, evaluate, and respond to formal legal and governmental requests for user data.
Every formal request for user data is logged, evaluated, and reported in our quarterly transparency report. The evaluation follows a four-step process:
- 1
Verify legal validity
Confirm the request comes from a legitimate authority with proper jurisdiction and legal basis.
- 2
Assess scope
Evaluate whether the request is proportionate and narrowly tailored to a legitimate purpose.
- 3
Consult legal counsel
Engage legal advisors to review the request and determine the appropriate response.
- 4
Log outcome
Record the decision (complied, rejected, or challenged) and include it in the next quarterly report.
What we collect
Our data collection is limited to the minimum required for account management and payment processing:
- Email address (for account authentication)
- Payment reference (processed by Stripe)
- Subscription status and plan type
What we do not collect
Our no-logs architecture means we structurally cannot provide the following, even if legally compelled:
- Browsing history or DNS queries
- Connection timestamps or session duration
- IP addresses (not retained post-session)
- Bandwidth usage per user
- VPN server selection history
Reporting metrics
Each quarterly report includes the following legal request metrics, broken down by jurisdiction and request type:
Requests received
Total formal requests
Complied
Requests fulfilled
Rejected
Requests denied
Challenged
Requests contested
Emergency
Urgent requests
Data source: legal log.
06
Security & privacy
How we measure and report on infrastructure security, privacy posture, and operational risk.
Uptime
The percentage of time our VPN services were fully operational during the reporting period.
Uptime is measured by our infrastructure monitoring tools across all server regions. Planned maintenance windows are excluded from the calculation. The metric covers VPN connection availability, not website or portal uptime.
Security incidents
The number of confirmed security incidents during the quarter, including breaches, vulnerabilities exploited, or data exposures.
We follow a defined incident classification framework. Only confirmed incidents are counted — suspected or investigated-and-cleared events are not included in the headline figure but may be referenced in the narrative.
Audit status
The current status of our independent no-logs audit, including the auditor, scope, and most recent completion date.
Our no-logs policy is independently audited on a regular schedule. The audit covers server infrastructure, logging configuration, and data retention practices. Results are summarised in the quarterly report.
Privacy posture tracking
Each report includes a privacy posture assessment tracking whether our data practices have changed during the quarter. This covers three dimensions:
| Dimension | What it tracks | Example |
|---|---|---|
| Data collection | Whether any new data points are being collected | “No new data points added” |
| Retention | Whether data retention policies have changed | “Policy unchanged” |
| 3rd party exposure | Whether any new third-party vendors have access to user data | “No new vendors” |
Data source: infrastructure monitoring and internal security review.
Risk notes & mitigations
The report includes a risk register documenting identified risks, their severity, current status, and the mitigation actions taken. This provides accountability for how security risks are managed over time.
| Column | Description |
|---|---|
| Risk | Brief description of the identified risk |
| Severity | Low, Medium, or High — based on potential impact and likelihood |
| Status | Resolved, Monitoring, or Open — current state of the risk |
| Mitigation | Actions taken or planned to address the risk |
07
How to verify
Steps any reader can take to independently verify the figures published in our transparency reports.
We believe transparency is only meaningful if it is verifiable. The following steps outline how readers, journalists, or auditors can cross-check the figures in our reports:
- 1
Compare donation totals against payment processor exports
Our gross revenue and exclusion figures can be cross-referenced with data exported from our payment processor. We can provide anonymized exports on request for audit purposes.
- 2
Cross-reference partner allocations with bank transfer records
Each partner allocation listed in the report corresponds to a bank transfer. Transfer references can be matched against the published allocation table.
- 3
Request partner confirmation receipts
Partner organizations provide confirmation of receipt for each payout. These receipts can be requested for independent verification.
- 4
Review legal request log against published count
The number and categorisation of legal requests can be verified against our internal legal log. Summary statistics are published; detailed logs are available under NDA for qualified auditors.
Questions or verification requests
If you have questions about our methodology or would like to verify specific figures, contact us at transparency@privatebyright.com. Quarterly reports will be listed on our About page as they are published.
08
Metric glossary
Complete definitions for every metric used in our quarterly transparency reports, including data sources and notes.
- Gross Membership Revenue
- Total membership fees collected before any exclusions
- Source: Stripe. Includes all plans and billing periods.
- Eligible Revenue
- Gross revenue minus refunds, taxes, and payment processing fees
- Source: Internal Ledger. See exclusion policy in section 02.
- Donation Rate
- Fixed percentage applied to eligible revenue
- Source: Internal Policy. Reviewed annually; applied uniformly.
- Donation Committed
- Donation Rate multiplied by Eligible Revenue
- Source: Internal Ledger. Recorded at month-end close.
- Donation Paid Out
- Funds actually transferred to partner organizations
- Source: Bank Records. May differ from committed due to timing.
- Partners Supported
- Number of organizations receiving funds in the quarter
- Source: Partner Agreements. Includes new and continuing partners.
- Transparency Request
- Any formal legal or governmental request for user data
- Source: Legal Log. Defined and handled per section 05.
- Uptime
- Percentage of time VPN services were fully operational
- Source: Infra Monitoring. Excludes planned maintenance windows.
- Security Incidents
- Confirmed security incidents during the reporting period
- Source: Infra Monitoring. Only confirmed incidents are counted.
- Audit Status
- Current status of the independent no-logs audit
- Source: External Auditor. Auditor, scope, and date published in report.
Definitions are subject to refinement. Any changes to metric definitions will be noted in the quarterly report where the change takes effect, with a reference to the previous definition.
Last updated: April 2026
This methodology document is reviewed and updated alongside each quarterly report.