Proton VPN vs Surfshark

What actually settles the two fields. What settles C10 and C11 is that Switzerland carries no mandate basis in the catalogue's own country list; the appeal corroborates how Swiss authorities treat Proton and is not by itself a finding about Proton VPN. A ruling on a sibling service is thinner ground than the citation makes it look.

The single largest open item. Proton offers exit locations in eight countries that impose a logging mandate. Whether hardware actually sits in any of them is not established: Proton withdrew physical servers from India in 2022 and documents Smart Routing for locations it serves from elsewhere, which points to virtual, but that was verified for India alone. Establishing C09b_mandate_hosting is the single largest open item on this record.

India, and the secret-order regime. P04_mandate_response=withdrew_physical is the June 2022 India exit, restored from Surfshark's own blog (surfshark.com/blog/surfshark-servers-certin-india) after the earlier run found the /trust-center page no longer carried it. P11=judicial_only rests on the transparency report showing the April 2026 Amsterdam District Court warrant and its National-Security-letter and gag-order counters at zero.

Two reports found, maybe not all. Only two Deloitte no-logs reports (Dec 2022, Jun 2025) were found published; there may be others not linked from robots.txt that this audit did not search for by other means.

This record was previously read twice — connection_timestamps in V11 from the audit wording, source_ip in C01 from the policy wording — and graded at the worse of the two, which made the fifteen-minute buffer cost more than saying nothing at all: a blank on C01 is the market prior 0.550 and source_ip is 0.750.

R29 now draws the line: state deleted within a declared window tied to the end of the session is the connection, not a record of it, so both fields read connection_timestamps on the same sentence. What is still charged is what outlives the session — the last login date in policy section 2.3.1 and the connection timestamps the auditor names.

Surfshark and NordVPN share a parent (Nord Security, since 2022) but Surfshark's own about-us page states the brands merged 'while operating independently' with separate infrastructure — M18 is set to separate on that basis, mirroring the nordvpn.com record.

U12a is partial rather than yes on the server table's own P2P column: 88 of the 100 listed countries carry it and twelve do not (AU, CL, CO, HR, GR, IE, JP, MX, NZ, TW, TR, AE). The column is drawn client-side, so it was read off the rendered table rather than the static HTML, where every row carries every label.

The transparency report at /transparency-report — which is where /warrant-canary now redirects — carries the April-June 2026 quarter as a table: 374,719 DMCA notices, 33 inquiries from government institutions, 1 warrant, 0 national security letters and 0 gag orders. P08 counts the 34 legal requests and leaves the DMCA notices out: those are copyright complaints about traffic, not requests for a user's data.

The same page states Surfshark is retiring its warrant canary in favour of quarterly reporting, which is why P07 is removed rather than none — the canary existed and was withdrawn deliberately.

U07_protocols carries proprietary for Dausos on Surfshark's own word — its protocol page calls Dausos "Surfshark's proprietary protocol" and publishes no source for it — and that single value is what sets C13_weakest_protocol and the hygiene charge that follows. IKEv2 is kept because Surfshark still documents it, though its own blog records the removal from the Windows app; Shadowsocks is gone from the support index and is not listed.