Surfshark vs Windscribe

This record was previously read twice — connection_timestamps in V11 from the audit wording, source_ip in C01 from the policy wording — and graded at the worse of the two, which made the fifteen-minute buffer cost more than saying nothing at all: a blank on C01 is the market prior 0.550 and source_ip is 0.750.

R29 now draws the line: state deleted within a declared window tied to the end of the session is the connection, not a record of it, so both fields read connection_timestamps on the same sentence. What is still charged is what outlives the session — the last login date in policy section 2.3.1 and the connection timestamps the auditor names.

Surfshark and NordVPN share a parent (Nord Security, since 2022) but Surfshark's own about-us page states the brands merged 'while operating independently' with separate infrastructure — M18 is set to separate on that basis, mirroring the nordvpn.com record.

U12a is partial rather than yes on the server table's own P2P column: 88 of the 100 listed countries carry it and twelve do not (AU, CL, CO, HR, GR, IE, JP, MX, NZ, TW, TR, AE). The column is drawn client-side, so it was read off the rendered table rather than the static HTML, where every row carries every label.

The transparency report at /transparency-report — which is where /warrant-canary now redirects — carries the April-June 2026 quarter as a table: 374,719 DMCA notices, 33 inquiries from government institutions, 1 warrant, 0 national security letters and 0 gag orders. P08 counts the 34 legal requests and leaves the DMCA notices out: those are copyright complaints about traffic, not requests for a user's data.

The same page states Surfshark is retiring its warrant canary in favour of quarterly reporting, which is why P07 is removed rather than none — the canary existed and was withdrawn deliberately.

U07_protocols carries proprietary for Dausos on Surfshark's own word — its protocol page calls Dausos "Surfshark's proprietary protocol" and publishes no source for it — and that single value is what sets C13_weakest_protocol and the hygiene charge that follows. IKEv2 is kept because Surfshark still documents it, though its own blog records the removal from the Windows app; Shadowsocks is gone from the support index and is not listed.

India, and the secret-order regime. P04_mandate_response=withdrew_physical is the June 2022 India exit, restored from Surfshark's own blog (surfshark.com/blog/surfshark-servers-certin-india) after the earlier run found the /trust-center page no longer carried it. P11=judicial_only rests on the transparency report showing the April 2026 Amsterdam District Court warrant and its National-Security-letter and gag-order counters at zero.

Two reports found, maybe not all. Only two Deloitte no-logs reports (Dec 2022, Jun 2025) were found published; there may be others not linked from robots.txt that this audit did not search for by other means.

Why retention is priced on the finding. Retention is therefore priced on what an auditor demonstrated was reachable rather than on what the policy declares, and the integrity channel carries the distance between the two. Read that as a two-year-old finding on one node, not as a current measurement: the scope was ca-023.windscribe.com alone, and a newer engagement covering more of the fleet is what would settle it.

The list that was never read. The offered country list was never read, so neither the usability country score nor the mandate intersection can be computed — Windscribe publishes a physical/virtual distinction, which makes C09b answerable here as soon as the list is. User scale is also unestablished, which leaves the exposure band resting on less than it should.

Where the three events now cite from. AIN.UA still carries the Ukrainian servers taken on 24 June 2021, and Windscribe's own blog the Greek case dismissed on 11 April 2025. The Dutch seizure and the seizure field itself now cite Windscribe's own no-logs page rather than the affiliate-paid press that first reported it: a company account of its own seizure is primary, not somebody else's account of one. The Ukrainian event is dated to the seizure itself, not the write-up.