On the record as a whole.
surfshark.com is not Cloudflare-walled the way nordvpn.com is: robots.txt, static pages and even the two ISAE 3000 no-logs assurance report PDFs and the December 2025 SecuRing infrastructure pentest report are all fetchable directly, and robots.txt's own Disallow list named the exact PDF paths (evidently meant to keep them out of search results, not to hide them from a direct link).
Both audit PDFs were opened and read in full (level A). The 2025 report's appendix and the privacy policy describe the same record in the same terms: 'user ID and/or your IP address and connection to VPN server time stamps', automatically deleted within 15 minutes of the session ending.
the rest of what is open — 378 more words
This record was previously read twice — connection_timestamps in V11 from the audit wording, source_ip in C01 from the policy wording — and graded at the worse of the two, which made the fifteen-minute buffer cost more than saying nothing at all: a blank on C01 is the market prior 0.550 and source_ip is 0.750.
R29 now draws the line: state deleted within a declared window tied to the end of the session is the connection, not a record of it, so both fields read connection_timestamps on the same sentence. What is still charged is what outlives the session — the last login date in policy section 2.3.1 and the connection timestamps the auditor names.
Surfshark and NordVPN share a parent (Nord Security, since 2022) but Surfshark's own about-us page states the brands merged 'while operating independently' with separate infrastructure — M18 is set to separate on that basis, mirroring the nordvpn.com record.
U12a is partial rather than yes on the server table's own P2P column: 88 of the 100 listed countries carry it and twelve do not (AU, CL, CO, HR, GR, IE, JP, MX, NZ, TW, TR, AE). The column is drawn client-side, so it was read off the rendered table rather than the static HTML, where every row carries every label.
The transparency report at /transparency-report — which is where /warrant-canary now redirects — carries the April-June 2026 quarter as a table: 374,719 DMCA notices, 33 inquiries from government institutions, 1 warrant, 0 national security letters and 0 gag orders. P08 counts the 34 legal requests and leaves the DMCA notices out: those are copyright complaints about traffic, not requests for a user's data.
The same page states Surfshark is retiring its warrant canary in favour of quarterly reporting, which is why P07 is removed rather than none — the canary existed and was withdrawn deliberately.
U07_protocols carries proprietary for Dausos on Surfshark's own word — its protocol page calls Dausos "Surfshark's proprietary protocol" and publishes no source for it — and that single value is what sets C13_weakest_protocol and the hygiene charge that follows. IKEv2 is kept because Surfshark still documents it, though its own blog records the removal from the Windows app; Shadowsocks is gone from the support index and is not listed.
