ExpressVPN vs Surfshark

ExpressVPN is based in the British Virgin Islands, a jurisdiction with strong privacy laws and no data retention requirements.

Surfshark's privacy policy identifies Surfshark B.V. at an Amsterdam address as the entity processing personal data under the policy and says it acts as a data controller under privacy laws including GDPR. This is a provider statement, not a legal-risk assessment.

PwC conducted an independent audit of ExpressVPN's TrustedServer technology and no-logs policy in 2021.

Surfshark's privacy policy, updated October 12, 2026, says its VPN servers temporarily keep connection details such as user ID and/or IP address and VPN-server connection timestamps for service functionality, and delete them within 15 minutes after a session ends. It separately says it does not store information about websites visited. These are provider policy disclosures, not measurements of implementation.

ExpressVPN supports Lightway (proprietary), OpenVPN, and IKEv2 protocols with automatic protocol selection.

Surfshark's trust center lists WireGuard, OpenVPN, IKEv2, and its proprietary Dausos protocol. The cited page does not give a complete protocol-by-platform availability matrix.

ExpressVPN uses AES-256 encryption with Perfect Forward Secrecy across all supported protocols.

Surfshark's trust center states that it uses AES-256-GCM, ChaCha20 for WireGuard, and AEGIS-256X2 for Dausos. This provider description does not independently validate implementation.

ExpressVPN provides DNS leak protection, IPv6 leak protection, and network lock kill switch.

Surfshark's security page lists an automatic kill switch and leak protection covering DNS, IPv6, and WebRTC. These are provider claims; this source is not a leak-test result.

Large network with a mix of rented/colocated servers.

Large global network; mostly rented/virtual servers.

TrustedServer = RAM-only, read-only image on every boot.

Surfshark's security page claims its network uses 100% RAM-only, diskless servers. This is a provider statement, not an independent fleet inspection.

Acquired by Kape Technologies (2021) — disclosed.

Surfshark's company timeline and ownership FAQ say it merged with Nord Security in 2022. Its terms separately identify Surfshark B.V. as the contracting company; these disclosures do not enumerate the group's full legal structure or beneficial ownership.

Ownership links to ad-tech past and review-site holdings → potential conflicts.

Surfshark's features page discloses that media reviews quoted there are from outlets associated with Surfshark through affiliate partnerships. This is a page-specific relationship disclosure and does not establish broader corporate independence.

Public bug bounty (historically $100k+ tiers reported).

Surfshark's trust center says it runs a third-party bug bounty program. The cited page does not provide the complete program scope or reward schedule.

Nettitude's April 2024 Windows report documents disclosure, patched-build retesting and v10 split-tunnelling removal. The findings concern specific Windows versions and conditions; they are not a current cross-platform incident-response assessment.

Reported 2018/2021 DC incidents addressed; improvements communicated.

ExpressVPN's Lightway protocol provides excellent speed performance with minimal latency impact according to independent testing.

Surfshark delivers good speed performance with WireGuard protocol, though speeds may vary depending on server location.

ExpressVPN offers apps for Windows, macOS, Linux, iOS, Android, Android TV, Fire TV, and browser extensions.

Surfshark's download page lists apps for Windows, macOS, Linux, Android, iOS, Apple TV, and Fire TV, and browser extensions. It separately says unsupported devices can use a VPN router; that does not establish a native router app or feature parity.

ExpressVPN consistently unblocks major streaming services including Netflix, Hulu, and BBC iPlayer.

Surfshark provides good streaming unblocking capabilities for most major services, though some may require specific server selection.

ExpressVPN provides 24/7 live chat support and email support with excellent response times and knowledgeable staff.

Surfshark's feature page advertises 24/7 live chat or email support and a knowledge base. This provider statement does not establish response time or support quality.

ExpressVPN is priced at a premium but offers 30-day money-back guarantee and consistent pricing across subscription lengths.

Surfshark offers competitive pricing with 30-day money-back guarantee and unlimited device connections.

Accepts Bitcoin and major cards/PayPal.

Cards, PayPal, crypto via partner.

Strong audit cadence, but Kape ownership reduces ethics score.

Participates in industry initiatives; no major unresolved scandals.

Threat Manager (blocking feature).

Surfshark's features page says CleanWeb blocks ads, banners, pop-ups, trackers, and access to malicious websites. The cited page does not establish that the feature operates at the network level or independently measured blocking efficacy.

ExpressVPN provides split tunneling, kill switch, and DNS leak protection as core additional features.

Surfshark's features page lists Dynamic MultiHop, Bypasser split tunneling, Static IP servers, and a separately offered Dedicated IP. The cited page does not substantiate the older summary's port-forwarding claim or a native router app.

Longstanding reliability in restricted regions; obfuscation techniques.

Surfshark's current NoBorders guide says the app can detect network restrictions and show servers it says work best under those restrictions. This is a provider feature description, not a guarantee of access in a specific region or network.

Clients closed; Lightway components open-sourced.

Surfshark's protocol documentation describes OpenVPN and WireGuard as open source and Dausos as proprietary. These protocol descriptions do not establish that Surfshark's VPN applications or all components are open source.

ExpressVPN has integrated ML-KEM, the newly established NIST standard for post-quantum encryption, into its proprietary Lightway VPN protocol as of January 2025. The implementation uses NIST Security Level 5 key sizes and provides quantum resistance with minimal performance impact.

Surfshark's April 13, 2026 Dausos announcement describes its proprietary VPN protocol as post-quantum resilient and says it was available only through the macOS app at that time. Whether Dausos is now available on other platforms and its cryptographic behavior were not independently tested.

Dedicated/static IP add-on available.

Surfshark's December 11, 2025 support article says Dedicated IP is purchased separately and is available through Windows, macOS, Android, iOS, Linux, and browser-extension apps. This unique IP is distinct from shared Static IP servers; the cited page does not establish a country count.

Centralized model (not dVPN).

Centralized architecture (not a dVPN).

No AI-based endpoint threat features advertised.

No AI/ML endpoint threat features disclosed.

GUI + CLI available and documented.

Surfshark's Linux download page describes a GUI app and lists supported Linux distributions and desktop environments. It says new features are available only in the Linux GUI app; this source does not establish parity with other platforms.

Policy claims on minimal logs; audits cover logging systems.

Surfshark's privacy policy identifies Surfshark B.V. and describes personal-data processing for its website, hosted services, and related applications. This policy page does not provide an embedded-SDK or desktop tracker measurement.