AirVPN vs Surfshark

A notable practice data point: public US federal court transcripts in United States v. Klyushin (D. Mass., docket 61629108, documents #183 and #217, found via CourtListener/RECAP) show a law-enforcement pen register was placed directly at the hosting company (DediPath), not at AirVPN, to monitor an AirVPN server's IP from Jan–Feb 2020; AirVPN's own staff, replying on their forum, confirmed the company had no knowledge of or involvement in the tap and that the device had to be installed outside AirVPN's own systems.

This is recorded in P12_case_history as a court_order/nothing_produced event, sourced to AirVPN's own forum confirmation (not to the PACER PDFs themselves, which returned 403 to automated fetches and were read only via a secondary summary).

This record was previously read twice — connection_timestamps in V11 from the audit wording, source_ip in C01 from the policy wording — and graded at the worse of the two, which made the fifteen-minute buffer cost more than saying nothing at all: a blank on C01 is the market prior 0.550 and source_ip is 0.750.

R29 now draws the line: state deleted within a declared window tied to the end of the session is the connection, not a record of it, so both fields read connection_timestamps on the same sentence. What is still charged is what outlives the session — the last login date in policy section 2.3.1 and the connection timestamps the auditor names.

Surfshark and NordVPN share a parent (Nord Security, since 2022) but Surfshark's own about-us page states the brands merged 'while operating independently' with separate infrastructure — M18 is set to separate on that basis, mirroring the nordvpn.com record.

U12a is partial rather than yes on the server table's own P2P column: 88 of the 100 listed countries carry it and twelve do not (AU, CL, CO, HR, GR, IE, JP, MX, NZ, TW, TR, AE). The column is drawn client-side, so it was read off the rendered table rather than the static HTML, where every row carries every label.

The transparency report at /transparency-report — which is where /warrant-canary now redirects — carries the April-June 2026 quarter as a table: 374,719 DMCA notices, 33 inquiries from government institutions, 1 warrant, 0 national security letters and 0 gag orders. P08 counts the 34 legal requests and leaves the DMCA notices out: those are copyright complaints about traffic, not requests for a user's data.

The same page states Surfshark is retiring its warrant canary in favour of quarterly reporting, which is why P07 is removed rather than none — the canary existed and was withdrawn deliberately.

U07_protocols carries proprietary for Dausos on Surfshark's own word — its protocol page calls Dausos "Surfshark's proprietary protocol" and publishes no source for it — and that single value is what sets C13_weakest_protocol and the hygiene charge that follows. IKEv2 is kept because Surfshark still documents it, though its own blog records the removal from the Windows app; Shadowsocks is gone from the support index and is not listed.

What the forum threads show. Forum threads show users repeatedly asking AirVPN for a warrant canary with no confirmation from staff that one exists, which is suggestive but not a primary denial, so P07 stays unknown rather than 'none'.

Counts nobody publishes. Request/data-handover counts are consequently also unknown (P08, P09), and total subscriber count is never disclosed (M08 unknown) — AirVPN publishes only a live concurrently-connected-users counter, not a registered-user or subscriber total, so silence/ignorance carry real weight here.

Builds and pentests. Reproducible builds are not documented on AirVPN's own build-from-source page (eddie.website/support/build/), and no dedicated client/infrastructure pentest could be found (V13, V14 unknown). Kill switch scope and split-tunneling behaviour are sourced to a third-party review rather than AirVPN's own documentation (U08, U09 at confidence C) because the relevant FAQ pages could not be reached directly through the site's routing (they render via JavaScript and returned only a loading shell to a plain fetch).

Coverage outside the affiliates. Press coverage is not affiliate-only: BleepingComputer, a mainstream outlet outside the affiliate-aggregator list, has published an independent review carrying its own affiliate-disclosure notice rather than being confined to affiliate directories (X08=no). Its same review also found AirVPN failed every streaming service it tried — Netflix, Hulu, HBO Max, Amazon Prime Video, Disney+, ABC, NBC, CBS — which is why U12b_streaming_works now reads no rather than the addictivetips.com-sourced partial it carried before that host was ruled forbidden.