IVPN vs Surfshark

The August 2026 incident. In August 2026 an attacker exploited a vulnerability in the self-hosted BTCPay Server, before it was public, and took IVPN's own Lightning operating funds. IVPN published the account four days later, unprompted, and scoped it to that machine: the VPN gateways were not involved, no customer records were reached, no customer money was lost.

Why it costs nothing. The model charges nothing for this, which is the point — an operator that says so promptly is behaving the way the field is meant to reward, and the entry is here so a reader knows it happened rather than to move a number.

What the engagements covered. The app pentest (iOS, Android, Electron, the daemon) is from March 2022 and the gateway/server-OS review from February 2023; neither tested the no-logs claim itself, the 2023 report says so explicitly, so retention rests on the privacy policy declaration alone.

The latest report is not the relevant one. April 2024's engagement, Cure53's sixth with IVPN, tested the customer account website, API and hosting; its own scope page names client apps and VPN servers out of scope, so it extends neither the app nor the gateway evidence, and V03_audit_subject reads unknown for it rather than carrying that credit forward. The seventh engagement, on the new email and DNS services, was only announced for May 2025; no report for it is published.

What the primary site never establishes. RAM-only is recorded as partial because IVPN describes it as a transition with test deployments under way, and has not announced its completion. Server hardware ownership (leased vs owned), traffic modification at the exit, and the beneficial owner's personal jurisdiction are unestablished: no primary IVPN page states any of the three, nor does user-base scale.

Three fields the knowledgebase answers, not the pages read at first fill. IP allocation is shared by design — "crowding" pools users on one address to blunt attribution. P2P is allowed everywhere, but IVPN asks customers to avoid US exits, citing upstream DMCA pressure. Streaming carries no guarantee, though the company says many customers do reach it.

India, and the secret-order regime. P04_mandate_response=withdrew_physical is the June 2022 India exit, restored from Surfshark's own blog (surfshark.com/blog/surfshark-servers-certin-india) after the earlier run found the /trust-center page no longer carried it. P11=judicial_only rests on the transparency report showing the April 2026 Amsterdam District Court warrant and its National-Security-letter and gag-order counters at zero.

Two reports found, maybe not all. Only two Deloitte no-logs reports (Dec 2022, Jun 2025) were found published; there may be others not linked from robots.txt that this audit did not search for by other means.

This record was previously read twice — connection_timestamps in V11 from the audit wording, source_ip in C01 from the policy wording — and graded at the worse of the two, which made the fifteen-minute buffer cost more than saying nothing at all: a blank on C01 is the market prior 0.550 and source_ip is 0.750.

R29 now draws the line: state deleted within a declared window tied to the end of the session is the connection, not a record of it, so both fields read connection_timestamps on the same sentence. What is still charged is what outlives the session — the last login date in policy section 2.3.1 and the connection timestamps the auditor names.

Surfshark and NordVPN share a parent (Nord Security, since 2022) but Surfshark's own about-us page states the brands merged 'while operating independently' with separate infrastructure — M18 is set to separate on that basis, mirroring the nordvpn.com record.

U12a is partial rather than yes on the server table's own P2P column: 88 of the 100 listed countries carry it and twelve do not (AU, CL, CO, HR, GR, IE, JP, MX, NZ, TW, TR, AE). The column is drawn client-side, so it was read off the rendered table rather than the static HTML, where every row carries every label.

The transparency report at /transparency-report — which is where /warrant-canary now redirects — carries the April-June 2026 quarter as a table: 374,719 DMCA notices, 33 inquiries from government institutions, 1 warrant, 0 national security letters and 0 gag orders. P08 counts the 34 legal requests and leaves the DMCA notices out: those are copyright complaints about traffic, not requests for a user's data.

The same page states Surfshark is retiring its warrant canary in favour of quarterly reporting, which is why P07 is removed rather than none — the canary existed and was withdrawn deliberately.

U07_protocols carries proprietary for Dausos on Surfshark's own word — its protocol page calls Dausos "Surfshark's proprietary protocol" and publishes no source for it — and that single value is what sets C13_weakest_protocol and the hygiene charge that follows. IKEv2 is kept because Surfshark still documents it, though its own blog records the removal from the Windows app; Shadowsocks is gone from the support index and is not listed.