Surfshark review

The short answer

Surfshark is a paid VPN run by Surfshark B.V. in Amsterdam. Its public record is clean: no reported breach, no court case where user data was handed over, and a growing list of independent checks. Deloitte has reviewed its no-logs claim twice, and Cure53 and SecuRing have tested its software and servers. The thing to keep in mind is ownership. Since 2022 Surfshark has sat under the same holding company as NordVPN.

Tunnelcheck hasn't tested Surfshark. Everything here comes from Surfshark's own pages, the published audit material and press coverage, all linked under Sources. See how we review.

Who owns Surfshark and where is it based?

Surfshark launched in 2018. Wikipedia says it was first registered in the British Virgin Islands and moved its headquarters to the Netherlands on October 1, 2021. Its terms of service now say your contract is with Surfshark B.V., at Kabelweg 57 in Amsterdam (Dutch company register number 81967985). Surfshark names Vytautas Kaziukonis as its founder.

In 2021 Surfshark began merging with Nord Security, the company behind NordVPN, and the deal closed in early 2022. Both brands said they would keep separate infrastructure and product plans. Merged ownership doesn't mean shared logs, but it does mean that buying Surfshark and NordVPN gives you one owner, not two. More on this in who owns your VPN.

Being Dutch puts Surfshark under EU privacy law (GDPR). Surfshark's no-logs page says the Netherlands has no law requiring VPNs to keep user data. In 2022 Surfshark shut its physical servers in India after the Indian government ordered VPN companies to keep customer data for five years, according to Wikipedia.

Does Surfshark keep logs? What the audits say

Surfshark's no-logs page says it doesn't record browsing history, the sites you visit, files you download or apps you use. It says it keeps account data: your email, an encrypted password, basic billing details and order history, plus minimal information about the initial connection that it needs to run the service. It says its servers run from RAM only, so data is wiped when they reboot.

The 2025 Deloitte engagement followed ISAE 3000, the standard for assurance on non-financial claims. Surfshark's blog says Deloitte interviewed staff, examined standard, static and multiport servers, and checked server configuration and deployment against the privacy policy. Surfshark has posted the 2025 report as a PDF on its own site, which is more open than providers that keep reports behind a login.

Surfshark's blog says the 2021 Cure53 server audit found no serious problems and that the general issues it raised were fixed. Its product page says SecuRing's 2025 app assessment found no critical vulnerabilities, and neither did the separate 2025 infrastructure test.

Security features and protocols

Surfshark lists four protocols, the rule sets that build the encrypted tunnel: WireGuard, OpenVPN, IKEv2 and Dausos, its own protocol. It says WireGuard connections use post-quantum encryption automatically and describes Dausos as "quantum-secure". Post-quantum encryption is meant to protect today's traffic from future computers that could break current methods. For background, see WireGuard vs OpenVPN and our VPN protocols explainer.

• Kill switch. Surfshark says it cuts your connection if the VPN drops. Our kill switch guide explains when that matters.
• RAM-only servers. The company says nothing is written to disk, so a reboot wipes server data.
• Multi Hop and static servers. The server list tags locations with Multi Hop (two servers in a chain), Static and Dedicated IP options.

Surfshark's track record

We found no reported breach of Surfshark's systems and no court case where its data identified a user. That's a shorter history than some rivals, since the service dates from 2018, and a clean record isn't the same as a tested one. Unlike Private Internet Access, which has had its no-logs claim tested in court, Surfshark's claim rests on audits rather than real-world legal demands.

Streaming and torrenting with Surfshark

Torrenting. Surfshark's server list shows a "P2P" tag next to its locations but doesn't say what the tag means. Its terms don't mention torrenting by name; they forbid using the servers to distribute copyright-protected material. Surfshark's own comparison page says it doesn't offer port forwarding, a feature some torrent clients use to connect to more peers. A VPN stops your internet provider from seeing what you download, but it doesn't make sharing copyrighted files legal. See is torrenting illegal.

Streaming. Watching another country's catalog usually breaks a streaming service's terms, and services block IP addresses they tie to VPNs. Results change from week to week. Read why streaming services block VPNs before you pay for a VPN for this.

Apps and devices

Surfshark's pricing page and FAQ say one subscription covers unlimited simultaneous devices; free trials are limited to three. Its server list counts more than 4,500 servers in 100 countries. The company now sells bundles that add other products to the VPN, which is why its plans carry names like Starter, One and One+.

Price and refund (checked 2026-11-13)

The page shows a 30-day money-back guarantee. It says plans renew at a "renewal price" but doesn't print the figure, and the one-month and 12-month prices weren't shown in the version we read. Check the official pricing page before you buy, and see our checked VPN prices page.

What we couldn’t verify

• Exact torrenting rules. Surfshark’s server list tags locations "P2P" without defining the tag, and its terms don’t mention torrenting. If this matters, ask support in writing before you buy.
• The 2023 Deloitte report. Surfshark says it exists and links a 2023 announcement, but the report we could read directly is the 2025 one. Some sources date the first Deloitte work to 2022; Surfshark’s own pages say 2023, and we follow them.
• Renewal prices. The pricing page refers to a renewal price without printing it. Expect to pay more after the first term, and check the figure at checkout.
• Dausos. Surfshark calls its own protocol quantum-secure. We found no public audit of Dausos specifically.

Who Surfshark suits, and who should look elsewhere

• Suits: households with many devices, since there's no device cap.
• Suits: people who want a provider that publishes its no-logs report openly and has no known breach.
• Look elsewhere if you rely on port forwarding for torrenting. Private Internet Access offers it on many servers.
• Look elsewhere if you want an alternative to NordVPN under a different owner.

Comparisons: NordVPN vs Surfshark and Surfshark vs ExpressVPN.