Surfshark vs ExpressVPN

The short answer

Surfshark and ExpressVPN both have independent no-logs checks by Big Four accounting firms and security tests of their software. ExpressVPN has more of both, and one rare real-world test: a 2017 server seizure in Turkey that reportedly found no useful logs. Surfshark is younger, has no reported breach or court case either way, and publishes its latest audit report openly.

For most households the practical differences are devices (unlimited on Surfshark, up to 14 on ExpressVPN's top tier), price (we could read Surfshark's, not ExpressVPN's), and ownership: Surfshark sits with Nord Security, ExpressVPN with Kape Technologies.

Tunnelcheck hasn't tested either. The fact table above is built from our provider files. This page explains what the differences mean; see how we review and the sources at the bottom.

Ownership and jurisdiction

Surfshark is run by Surfshark B.V. in Amsterdam, according to its terms of service. It merged with Nord Security, the company behind NordVPN, in a deal that closed in early 2022; both brands say they operate separately. As a Dutch company it falls under EU privacy law, and its no-logs page says Dutch law doesn't require VPNs to keep user data.

ExpressVPN is operated by Express Technologies Ltd. under British Virgin Islands law. Kape Technologies agreed to buy it in 2021 for a reported $936 million. Kape also owns CyberGhost and Private Internet Access, began life as the browser-extension company Crossrider (whose platform adware makers widely misused), and has been privately held by Teddy Sagi's Unikmind since 2023.

Each is part of a multi-brand group. If you want two VPNs from unrelated companies, Surfshark plus ExpressVPN does that; Surfshark plus NordVPN doesn't. Our who owns your VPN page maps the groups.

Logging and audits

• Surfshark: Deloitte no-logs assurance under ISAE 3000 (the standard for assurance on non-financial claims) in 2023 and 2025. The 2025 fieldwork ran May 14 to June 10, 2025, and covered standard, static and multiport servers. Cure53 audited its browser extensions (2018) and servers (2021), and SecuRing tested its apps and infrastructure in 2025. The 2025 Deloitte report is a public PDF.
• ExpressVPN: KPMG reviewed its TrustedServer system and privacy policy under ISAE (UK) 3000 Type 1, as of February 28, 2025, giving reasonable assurance. ExpressVPN names PwC Switzerland among its auditors, had Cure53 and Praetorian assess its Lightway protocol, and said in May 2026 it had completed 27 independent audits. Reports sit on its Trust Center behind a terms-of-use screen.

ExpressVPN wins on volume and variety. Surfshark wins on openness, since anyone can read its 2025 report without signing up. Both kinds of no-logs check are snapshots: KPMG's is pinned to one date, and Deloitte's 2025 work to about four weeks. Neither proves how systems ran before or after. Our VPN audits page explains how to read them.

Track record

ExpressVPN has a longer and busier record. Turkish investigators seized one of its servers in early 2017 during the inquiry into the assassination of Russian ambassador Andrei Karlov; TorrentFreak reported it gave them nothing useful. In 2021 Reuters reported that senior executive Daniel Gericke had entered a deferred prosecution agreement with the US Justice Department over hacking work for the UAE; ExpressVPN kept him on. In 2024 a Windows app bug that had sent some DNS requests outside the tunnel with split tunneling on, affecting about 1% of Windows users by ExpressVPN's estimate, was reported, fixed and, the company says, independently verified.

Surfshark has no reported breach and no court case in which its data identified a user. That record runs only from 2018 and rests on audits rather than legal demands. A clean record and a tested one are different things.

Read more about real-world tests in no-logs policies explained.

Features and protocols

• Surfshark: WireGuard with post-quantum encryption by default, OpenVPN, IKEv2, and Dausos, its own protocol, which we found no public audit of. RAM-only servers, Multi Hop and static IP locations, and a kill switch.
• ExpressVPN: Lightway, its own open-source protocol, rewritten in Rust in 2025, audited by Cure53 and Praetorian, and post-quantum by default; its own WireGuard build with post-quantum key exchange; OpenVPN; and IKEv2 on iOS only. Its kill switch is called Network Lock.

The meaningful gap is inspection. ExpressVPN's in-house protocol is open source and audited. Surfshark's in-house protocol is neither, as far as we found, though you can stick to WireGuard or OpenVPN. On devices, Surfshark sets no cap; ExpressVPN's tiers allow 10, 12 or 14. See WireGuard vs OpenVPN and the kill switch guide.

Streaming and torrenting policies

Torrenting. Neither publishes a detailed P2P server policy that we found. Surfshark tags locations "P2P" on its server list without defining the tag, doesn't offer port forwarding, and its terms ban distributing copyright-protected material. ExpressVPN has no page listing P2P servers, and its terms forbid downloading or distributing copyrighted content without permission. If torrenting is your main use, Private Internet Access states its policy more clearly. A VPN hides your downloads from your internet provider. It doesn't make copyright infringement legal. See is torrenting illegal.

Streaming. Neither Surfshark nor ExpressVPN controls whether a streaming service lets you in. Watching another country's catalog usually breaks the streaming service's terms of use, and services block IP addresses they link to VPNs, so what works one week can fail the next. We don't promise that either one gets anything unblocked. See why streaming services block VPNs and, for legal options abroad, streaming while traveling.

Price (checked 2026-11-13)

Surfshark's pricing page showed the Starter plan at $2.49 a month for the first 27 months ($67.23), with a note that prices vary by currency and VAT. It mentioned a renewal price without printing it, and showed a 30-day money-back guarantee.

ExpressVPN's order page showed prices only in Israeli shekels to our reader, so we haven't printed a figure; see the official pricing page. It confirmed plans auto-renew at a stated renewal price, and its terms give new direct subscribers 30 days to ask for a refund. See checked VPN prices.

Which should you pick?

• Pick ExpressVPN if you want the most separate audits, an open-source protocol, and a no-logs claim that has met a real investigation.
• Pick Surfshark if you need many devices on one plan, want to read the audit report yourself, or want a price you can see before checkout.
• Weigh ownership either way. ExpressVPN brings Kape's history; Surfshark shares a parent with NordVPN.
• Look elsewhere if you need port forwarding or a written torrenting policy.