NordVPN vs Surfshark

The short answer

NordVPN and Surfshark are less of a head-to-head than they look. Since early 2022 both have sat under one holding company with Nord Security, and both say they run separate infrastructure. Buying one as a backup for the other doesn't spread your trust across two owners.

On the evidence, both are well documented. Outside accountants have checked NordVPN's no-logs claim six times since 2018, and Surfshark's twice, in 2023 and 2025. Both have had security firms test their apps or servers. NordVPN has one serious incident on record, a 2018 server breach it disclosed in 2019. Surfshark has none reported. The practical differences are devices (ten for NordVPN, unlimited for Surfshark), how openly each publishes its audit reports, and the extra server types each offers.

Tunnelcheck hasn't tested either service. The fact table above comes from our provider files. This page explains what the differences mean, and every claim links to a source at the bottom. Read how we review for the method.

Who owns NordVPN and Surfshark?

Surfshark and Nord Security agreed to merge in 2021, and the deal closed in early 2022. Tech Advisor reported at the time that the two would stay separate VPN services. NordVPN's apps are sold on Apple's App Store by Nordvpn S.A., a Panama company. Surfshark's terms of service make your contract with Surfshark B.V. in Amsterdam, which moved there from the British Virgin Islands in 2021, according to Wikipedia.

Two things follow. First, the jurisdictions differ. Surfshark is a Dutch company under EU privacy law (GDPR), and its no-logs page says Dutch law doesn't require VPNs to keep user data. NordVPN's legal seller is in Panama. Second, the shared parent means one company's decisions can reach both brands. Neither brand has published anything suggesting shared logs or servers, but if independence between your providers matters to you, pick one of these and a provider from a different group. Our who owns your VPN page maps the groups.

Jurisdiction is only one layer. A company can only hand over what it stores, which is why the audits below carry more weight than the country on the paperwork.

Logging and audits

Both companies say they don't log what you do on the VPN, and both now hire Deloitte to check that claim under ISAE 3000, the international standard for assurance on non-financial claims. The audit table above lists each engagement. Three differences stand out.

• Length of record. NordVPN's first no-logs engagement was with PwC Switzerland in 2018, followed by PwC again in 2020 and Deloitte Lithuania every year from 2022 to 2025. The 2025 round was a reasonable assurance engagement, the stronger of the two levels, with fieldwork from November 10 to December 12, 2025. Surfshark's Deloitte reports date from 2023 and 2025.
• Openness. Surfshark posts its 2025 Deloitte report as a public PDF on its own site. NordVPN makes its full reports available only to logged-in customers.
• Security testing. NordVPN had an application assessment by VerSprite in 2021 and a Cure53 penetration test of its servers in 2022. Surfshark had Cure53 audits of its browser extensions (2018) and server infrastructure (2021), and SecuRing tests of its apps and infrastructure in 2025.

Each assurance engagement looks at how systems were set up during a window of a few weeks. It's a snapshot. A run of yearly checks, which NordVPN has kept up since 2022, says more than one report. Surfshark's series is shorter so far, with a gap between 2023 and 2025. Our VPN audits page explains how to read these reports.

Track record: breaches and court cases

NordVPN. In March 2018 an attacker got into one server NordVPN rented in a Finnish data center, using a remote-management tool the host had left on it. TechCrunch reported that an expired internal key was exposed. NordVPN said the server held no activity logs. It disclosed the breach on October 21, 2019, and security researchers criticized the delay. Separately, in 2019 about 2,000 NordVPN account logins circulated online through credential stuffing, where attackers reuse passwords leaked from other sites.

Surfshark. We found no reported breach of Surfshark's systems and no court case in which its data identified a user. The service dates from 2018, so the record is shorter, and a clean record is not the same as one tested by a court or a raid. Its claim rests on audits.

How much the 2018 breach should weigh is a judgment call. It was limited to one rented server and NordVPN has added outside tests since. The slow disclosure is the part some readers will hold against it. For how real-world tests differ from audits, see no-logs policies explained.

Features and protocols

A protocol is the rule set an app uses to build its encrypted tunnel. Both companies use WireGuard-based protocols as their default and have added post-quantum key exchange, which aims to protect today's traffic against future computers that could break current encryption.

• NordVPN lists NordLynx (its WireGuard build, post-quantum in all apps since May 2025), NordWhisper for networks that block VPNs, and OpenVPN. Its audits covered Double VPN, Onion Over VPN and obfuscated servers.
• Surfshark lists WireGuard (post-quantum by default), OpenVPN, IKEv2 and Dausos, its own protocol. We found no public audit of Dausos. Surfshark says its servers run from RAM only and offers Multi Hop and static IP locations.

Surfshark says it has a kill switch. NordVPN's own feature pages refused our reader, so our provider file leaves that field blank; check the app's settings and run a leak test whichever you choose. On devices, NordVPN allows ten at once and Surfshark sets no limit. A VPN on your router counts as one connection on either.

Streaming and torrenting policies

Torrenting. NordVPN's iOS release notes for version 9.6.0 say all its regular servers now support P2P (peer-to-peer) traffic, and Deloitte's 2024 check included its P2P servers. Surfshark shows a "P2P" tag on its server list without defining it, doesn't offer port forwarding, and its terms ban distributing copyright-protected material. If you need port forwarding, neither fits; Private Internet Access offers it on selected servers. A VPN hides your downloads from your internet provider. It doesn't make copyright infringement legal. See is torrenting illegal.

Streaming. Neither NordVPN nor Surfshark controls whether a streaming service lets you in. Watching another country's catalog usually breaks the streaming service's terms of use, and services block IP addresses they link to VPNs, so what works one week can fail the next. We don't promise that either one gets anything unblocked. Our explainer on why streaming services block VPNs covers how the blocking works, and streaming while traveling covers the legal options when you're abroad.

Price (checked 2026-11-13)

Surfshark's pricing page showed the Starter plan at $2.49 a month for the first 27 months, billed as $67.23. The page said prices vary by currency and VAT and that plans renew at a "renewal price" it didn't print. It shows a 30-day money-back guarantee.

NordVPN's pricing page refused our reader on 2026-11-13, so we haven't printed a price or refund term. See the official pricing page. With both, compare the renewal price, not only the first term. Our checked VPN prices page lists what we could verify.

Which should you pick?

• Pick NordVPN if you want the longest run of yearly no-logs checks, specialty servers such as Double VPN and Onion Over VPN, or a protocol built for networks that block VPNs.
• Pick Surfshark if you have more than ten devices, want to read the audit report without an account, or prefer a company based in the EU.
• Pick neither if you wanted two independent providers. Pair one of these with a VPN from another group, such as Proton VPN or Mullvad.
• Pick neither if you need port forwarding for torrenting.