Interview with AirVPN

0)Please tell us, what is your role (in the VPN company, where do you stand, owner, marketer, advertiser etc)?
I am an AirVPN co-founder and I usually work with the customer care staff. I monitor and acquire documentation on peer-reviews of vulnerabilities, security bulletins and security-related documents and occasionally I perform ordinary VPN servers maintenance. Just like all the other co-founder persons, I also make sure that AirVPN activity remains compatible with its mission (see airvpn.org/mission).

1) Does AirVPN keep any logs, IP Addresses, Timestamps, Bandwidth caps, Traffic or other data?
No, we don’t.

2) What type of Encryption do you use?
Our service is based on OpenVPN which is configured in every VPN server in the following way:

Data Channel cipher: AES-256-CBC
Control Channel cipher: HMAC SHA1
RSA keys size: 4096 bit
Perfect Forward Secrecy: yes, through DHE. TLS re-keying occurs at each connection and every 60 minutes and this time can be lowered unilaterally on the client side.
TLS Auth is enabled (with 2048 bit RSA keys, not configurable in OpenVPN) and the authentication and handshake are performed through double certificates and keys.

About our web site it also supports PFS, HTTPS, HTTP STS (Strict Transport Security), TLS up to 1.2 and much more. Please see the Qualys SSL Labs report which grades airvpn.org with “A+” available in
www.ssllabs.com/ssltest/analyze.html?d=airvpn.org

3) Where are your servers located and what jurisdiction do you operate under?
Air company is located in Italy. We have VPN servers in 18 countries. The applicable law may differ from jurisdiction, of course. Full list of servers is available, together with additional information, on the servers real time monitor in our web site, publicly accessible by anyone.

4) How do you generally handle requests from law enforcement and copyright agencies?
We ignore private copyright enforcement entities. About law enforcement agencies, the question is too vague and can’t be answered in a general way. Please provide precise examples.

5) Do you have access to all your servers, and does the datacenter you use log?
In order to physically access one of our VPN servers, we must arrange a precise appointment with the datacenter staff and their security personnel. We carefully pick datacenters which don’t log and don’t monitor traffic. VPN servers do not host any database or any information about customers. Such data are kept in backend servers which are handled differently than VPN servers. Clients never access directly or indirectly backend servers. VPN servers access only indirectly backend servers.

6) Does your service support bittorrent?
Yes, fully, on every and each VPN server.