How we score

Hexento recommendations are constraint matches, not global popularity contests. This page is the shared rulebook behind Pickguard and the decision hubs.

Last updated: 2026-07-31

Affiliate disclosure: Some Hexento pages may include partner or affiliate links when programs are accepted. We may earn a commission at no extra cost to you. Partner status can change which offers we deep-link — it does not force a poor-fit winner. See disclosure.

Principles

Useful without the click-out If the only value is “go buy this,” the page failed. Rubric, tradeoffs, and skip paths must stand alone.
Your constraints weight the score Streaming reliability only matters if streaming is your job. Household seats only matter if you share. No secret global ranking dressed up as personalization.
One primary job beats five half-needs People who want “privacy + streaming + torrenting + enterprise compliance + cheapest forever” get a confused market, not a clean pick. We force prioritization.
No-fit is a first-class result Built-in tools, free tiers, DIY, and “wait” are valid outcomes. We would rather lose a commission than ship a forced yes.
Name the failure mode Every option we take seriously should have a known downside: renewal pricing, platform gaps, recovery pain, re-listing brokers, performance cost, jurisdiction discomfort.
Evidence over adjectives “Military-grade,” “#1 rated,” and server-count bragging do not move scores. Audits, export paths, kill-switch behavior, seat math, and cancel friction do.

Decision shape

Whether you use Pickguard or read a hub, the output tries to look like this:

Primary fit — named option + the constraints it matched.
Runner-up / different tradeoff — not a clone with a synonym.
Honest alternative — cheaper, built-in, free tier, or DIY when relevant.
Skip / wait — when nothing clears the bar or the category is the wrong tool.

Scores are intentionally coarse (filled dots / plain weights), not fake precision to three decimals. Deterministic rubrics beat black-box “AI best VPN” theater.

What we refuse to rank on

Server count bragging as a quality proxy. Topology and protocol matter more than a marketing integer.
Unverified “no logs forever” slogans without jurisdiction context or audit posture.
Single speed-test screenshots or “fastest VPN 2026” Olympics. Networks vary by hour and route.
Fear meters (“you’re exposed!!”) without a job-to-be-done and a maintenance plan.
Bundle theater — VPN + AV + cleaner + dark-web upsell piles scored as one magical suite.
Commission rate as a ranking input. EPC never overrides a reputation or fit fail.
Invented lab tests. If we didn’t run a test, we won’t imply we did. Independent public testing can be cited carefully; we won’t fabricate “we tested 47.”
Scareware, keyshops, fake cleaners, repairware — hard exclude regardless of payout.

Quality gates before a brand can win

Reputation gate

History of deceptive UX, fake infection counts, gray-market keys, or bait-and-switch renewals → disqualified.

Platform gate

If it doesn’t run on the user’s daily device/browser, it can’t be the primary pick — full stop.

Exit gate

Password managers need export. Subscriptions need a comprehensible cancel/refund story. Soft lock-in is a penalty.

Honesty gate

Category limits must be stated (VPN ≠ anonymity; broker removal ≠ erase the internet; AV ≠ fix bad habits).

How partner links fit

Mentally separate editorial fit from commerce routing:

The rubric picks (or skips) first.
If a fit has a live partner program, outbound may use a tracked link.
If a better fit has no partner path (built-in OS tools, some open-source options, DIY), it can still win.
Until programs are accepted, hubs show illustrative brand slots labeled partner-link-pending — not live commission claims.

We will not invent tracking URLs, coupon guarantees, or “exclusive” pricing we can’t verify.

What “updated” means here

Hubs and guides show a last updated date when constraint checklists, category advice, or illustrative catalogs change in a material way. It does not mean we re-bench every product weekly. Pricing and promo flags go stale fast — treat sticker prices as volatile and verify on the vendor site before buying.

Vertical notes

VPN — primary job, devices, jurisdiction comfort, kill switch / modern protocols, seats, renewal.
Password managers — household, platforms, offline, recovery, export, ceiling; built-in allowed to win.
Data removal — confirmed exposure, time vs money, maintenance, scope limits; DIY always on the table.
Antivirus — OS baseline first, behavior risk, performance, multi-seat, reputation hard-fail list.

Want the interactive version?

Run Pickguard · About Hexento · Disclosure