Surfshark VPN Review (2026)

Quick answer

Surfshark’s clearest public privacy evidence is a series of third-party assessments with stated scope and dates. The evidence is useful, but it does not turn a VPN into a guarantee of anonymity or future behavior. Surfshark’s current offer also makes a one-subscription household setup possible: Surfshark says Starter, One, and One+ allow unlimited simultaneous VPN connections, subject to its stated Antivirus and abuse limits. The trade-offs are the difference between a privacy policy and an independent test, a group relationship with Nord Security, and an introductory price whose exact renewal amount depends on the customer’s checkout terms.

This is a source-based review, not a controlled speed test. I have removed the old unsupported audit-market comparison, the hard-coded matrix score, the unsupported exact holding-company name, and an unverified lawsuit status. The audit results, ownership record, provider-stated features, and pricing observation are described separately below.

Is Surfshark safe? The audit record

Surfshark’s Trust Center lists Deloitte no-logs assurance reports for 2023 and 2025. The public 2025 report is an ISAE 3000 reasonable-assurance report addressed to Surfshark B.V. Deloitte says its procedures examined the configuration of systems and supporting operations used for Surfshark’s VPN service, and concluded on 10 June 2025. It describes an assessment of the service as configured at that point in time, not a guarantee for every later release or operating period.

The report’s scope is narrower than a general claim that the whole company has been audited. It inspected configurations and deployment processes for standard, static-IP, MultiHop, and Multiport VPN servers. The report explicitly excludes areas including data-transfer security, streaming infrastructure, much of the web and API stack, physical security, and access-rights testing. It also says the engagement was not an examination of compliance with laws or regulations.

The report appendix describes Surfshark’s no-activity-logs configuration and gives a useful data distinction: the appendix says Surfshark servers temporarily store a user ID and connection timestamps, deleted within 15 minutes after a session ends; it separately says incoming and outgoing traffic, including user and destination IP addresses, browsing history, DNS queries, and files are not stored. The current Privacy Policy uses broader wording for temporary server connection details, which may include a user ID and/or IP address. The June 2025 report predates that policy update and does not assess its later wording. It also lists minimal account and billing data and operating-system diagnostics. This is a point-in-time configuration assurance, not “no data exists.”

A separate Cure53 report dated March 2026 focuses on Dausos protocol architecture and cryptography. It records ten findings overall; the most severe were in an external hosting environment outside the protocol scope, while the eight in-scope Dausos findings were medium or lower. Cure53 recommends a formal protocol specification, threat model, and a follow-up assessment. This is evidence about Dausos, not a blanket audit of every Surfshark app or service.

SecuRing’s December 2025 network-infrastructure penetration test reported one medium SSL/TLS configuration finding. Surfshark’s January 2026 follow-up says it resolved the issue. I did not find an independent follow-up report confirming that remediation. Read the original finding and the provider’s response together; neither replaces the point-in-time scope of the 2025 Deloitte report.

Who owns Surfshark

Surfshark’s current About page says it merged with Nord Security under one holding company in 2022 and continues to operate independently. Its original merger statement described Surfshark and Nord Security as autonomous companies with separate infrastructure and different product-development plans. Surfshark does not name the holding company’s exact legal entity on the reviewed page.

NordVPN’s support page identifies Nord Security as NordVPN’s parent company, while a separate NordVPN ownership page identifies nordvpn S.A. as NordVPN’s service owner and operator. That supports a shared group relationship between the brands, but not the shorthand that Surfshark and NordVPN are the same service or that their customer databases are shared. The available sources do not establish those conclusions.

Where Surfshark is based

Surfshark says it is based in the Netherlands. Its current Privacy Policy identifies Surfshark B.V. in Amsterdam as the data controller, and its Terms of Service say the customer’s contract is with Surfshark B.V., a company established in the Netherlands.

The governing-law clause is a separate matter: Surfshark’s terms choose British Virgin Islands law for the contract, while saying this choice does not limit consumer-protection rights that mandatory laws in the customer’s country of residence provide. This is a summary of the provider’s published terms, not a determination of which law would apply in an individual dispute. A Netherlands business base, contracting entity, and chosen contract law should not be collapsed into one jurisdiction label.

What you get for the price

Surfshark’s support article lists OpenVPN, WireGuard, and IKEv2, with availability varying by platform. It says post-quantum protection is layered on WireGuard in supported apps, not manual configurations. The newer Dausos protocol is described as proprietary and is currently available only in the macOS App Store version of the Surfshark app. These are provider-stated feature facts; this article does not report independent performance measurements.

Surfshark’s server page reports 4,500-plus servers, 130-plus locations, and 100 countries, with those figures dated 30 October 2026. Treat that as the company’s published network count, not proof that every location is owned infrastructure or a measure of speed. The provider’s terms also state that actual service coverage, speeds, locations, and quality may vary.

The feature most relevant to households is simultaneous connections: Surfshark’s support page says Starter, One, and One+ subscriptions can connect an unlimited number of VPN devices. It excludes the Antivirus service from that allowance and reserves action against abuse such as unauthorized reselling or very large illicit activity. So the practical advantage is a broad household device allowance, not a promise that every service is unlimited.

Pricing and renewals

The 1 November 2026 USD observation in our pricing inventory lists Surfshark Starter at USD 2.49 per month equivalent, with USD 67.23 billed upfront for 27 months, including three extra months; VAT may apply. Surfshark’s pricing page is regional, so this is a dated offer observation rather than a promise that every visitor will see the same currency or total. During this source review the live pricing page returned a localized Swiss-franc offer. Surfshark says displayed and charged currencies can vary by location and payment method, and applicable VAT or sales tax is added based on purchase location.

Surfshark’s terms say paid subscriptions renew automatically at the full standard non-introductory rate. The provider says it emails about an upcoming renewal 30 days before the term ends, except for one-month plans. Its renewal page notes that listed prices depend on location, may be affected by price testing, and are before tax. Our dated offer record does not establish one renewal amount for all customers. Check the amount shown for your plan and payment method before purchase, and note the renewal date.

An earlier version of this review repeated a media report about a U.S. auto-renewal lawsuit. This refresh removes that allegation: I did not verify the original court docket or its current status from an authoritative court source. What the current Surfshark terms do establish is the company’s automatic-renewal policy; this article makes no conclusion about the legality of a particular sale.

Surfshark advertises a 30-day money-back guarantee. Its terms state that this applies to an initial purchase and list exceptions, including some reseller purchases, prepaid cards, anonymous Dedicated IP, and certain Alternative ID purchases. Check the current terms for the offer and purchase route you use.

This is an affiliate link; we may earn a commission if you subscribe. Check Surfshark’s current offer (affiliate) alongside the linked official pricing and renewal terms before you buy.

How Surfshark fits our matrix

The comparison matrix keeps its own score and verification record. This article update does not re-check every scoring criterion or recompute that score. I have therefore removed the hard-coded number and ranking claim from this review. Use the comparison tool and methodology page for the current matrix entry and how those scores are calculated.

Who should use Surfshark

Surfshark is worth considering if your main practical need is one VPN subscription for many household devices, you are comfortable with the provider’s stated privacy policy, and the first-term payment works for your budget. The audits give readers dated evidence about specific configurations and systems, while the privacy policy explains what account and temporary connection data the service says it processes.

Look elsewhere or compare more carefully if you need an independently confirmed future renewal amount, a named legal holding company, a provider with no shared corporate group, or current third-party speed results. None of those is established by the sources in this review. A VPN also does not make you anonymous to every service or protect you from malware, phishing, account compromise, or unsafe device settings.

Some links on this page are affiliate links. We may earn a commission if you subscribe through them. That does not change the source dates or limitations described here.Review Surfshark’s current plans (affiliate) or compare providers on our comparison page.

Frequently asked questions