NordVPN vs Surfshark

NordVPN's support page says its VPN service is based and operates under Panama jurisdiction. This is a provider statement; the page's data-retention and logging assertions are not independently assessed here.

Surfshark's privacy policy identifies Surfshark B.V. at an Amsterdam address as the entity processing personal data under the policy and says it acts as a data controller under privacy laws including GDPR. This is a provider statement, not a legal-risk assessment.

NordVPN's privacy notice, updated July 20, 2026, says it does not store used bandwidth, traffic logs, IP addresses, or browsing information. It separately describes unspecified last-session information used to limit concurrent sessions and deleted within 15 minutes after a session ends, plus whether the service was used in the preceding 90 days for abuse prevention and chargeback disputes. The notice does not enumerate the last-session fields. These are provider policy disclosures, not measurements of implementation.

Surfshark's privacy policy, updated October 12, 2026, says its VPN servers temporarily keep connection details such as user ID and/or IP address and VPN-server connection timestamps for service functionality, and delete them within 15 minutes after a session ends. It separately says it does not store information about websites visited. These are provider policy disclosures, not measurements of implementation.

NordVPN's support guide describes OpenVPN, NordLynx (WireGuard), and NordWhisper, and says NordLynx is the default in most apps. The guide describes NordWhisper for restrictive local networks but does not provide a complete protocol-by-platform matrix.

Surfshark's trust center lists WireGuard, OpenVPN, IKEv2, and its proprietary Dausos protocol. The cited page does not give a complete protocol-by-platform availability matrix.

NordVPN's encryption page says OpenVPN uses AES-256-GCM with a 4096-bit DH key and describes the NordLynx protocol. It says the post-quantum upgrade began on Linux in 2024 and was being rolled out to other apps; this page does not establish current app-by-app availability or NordLynx cipher details.

Surfshark's trust center states that it uses AES-256-GCM, ChaCha20 for WireGuard, and AEGIS-256X2 for Dausos. This provider description does not independently validate implementation.

NordVPN's support guide lists DNS leak protection and an automatic kill switch. This provider description does not establish WebRTC or IPv6 leak-test results or protection against every split-tunneling configuration.

Surfshark's security page lists an automatic kill switch and leak protection covering DNS, IPv6, and WebRTC. These are provider claims; this source is not a leak-test result.

NordVPN's trust center says a big chunk of its VPN servers are owned, maintained, and managed in-house, alongside partner-hosted servers. It does not state the proportion owned.

Large global network; mostly rented/virtual servers.

NordVPN's trust center says its servers do not rely on traditional hard drives and that server data is stored in volatile RAM and wiped when a server powers off. This is the provider's infrastructure statement, not an independent inspection.

Surfshark's security page claims its network uses 100% RAM-only, diskless servers. This is a provider statement, not an independent fleet inspection.

Corporate structure disclosed (Nord Security group; ops split across entities).

Surfshark's company timeline and ownership FAQ say it merged with Nord Security in 2022. Its terms separately identify Surfshark B.V. as the contracting company; these disclosures do not enumerate the group's full legal structure or beneficial ownership.

NordVPN says it is a founding member of the VPN Trust Initiative and publishes incident updates. These are provider statements about membership and communications; they do not establish independent governance.

Surfshark's features page discloses that media reviews quoted there are from outlets associated with Surfshark through affiliate partnerships. This is a page-specific relationship disclosure and does not establish broader corporate independence.

NordVPN's trust center describes a public bug bounty that invites researchers to report vulnerabilities in its network. The cited page does not specify the complete eligible scope or reward schedule.

Surfshark's trust center says it runs a third-party bug bounty program. The cited page does not provide the complete program scope or reward schedule.

NordVPN's October 2019 statement says a third-party data-center breach likely occurred in March 2018 on one Finnish server; the company says it learned of it in April 2019, terminated the provider relationship, and began audits. This is NordVPN's account, not independent incident forensics.

Reported 2018/2021 DC incidents addressed; improvements communicated.

Independent testing shows NordVPN consistently delivers high speeds with minimal impact on connection performance, often achieving over 1 Gbps speeds.

Surfshark delivers good speed performance with WireGuard protocol, though speeds may vary depending on server location.

NordVPN's official app directory lists apps or extensions for Windows, macOS, Linux, Android, iOS, Chrome, Firefox, Edge, Android TV, and Apple TV. This list does not establish a native router app or feature parity across platforms.

Surfshark's download page lists apps for Windows, macOS, Linux, Android, iOS, Apple TV, and Fire TV, and browser extensions. It separately says unsupported devices can use a VPN router; that does not establish a native router app or feature parity.

NordVPN reliably unblocks Netflix, BBC iPlayer, Disney Plus, and other streaming services according to independent testing.

Surfshark provides good streaming unblocking capabilities for most major services, though some may require specific server selection.

NordVPN's support page states that customer support is available 24/7. It does not verify channel availability, response times, or support quality.

Surfshark's feature page advertises 24/7 live chat or email support and a knowledge base. This provider statement does not establish response time or support quality.

NordVPN offers competitive pricing with 30-day money-back guarantee and various subscription lengths.

Surfshark offers competitive pricing with 30-day money-back guarantee and unlimited device connections.

Cards, PayPal, crypto supported.

Cards, PayPal, crypto via partner.

VTI membership; transparency reports/articles; some historical baggage acknowledged.

Participates in industry initiatives; no major unresolved scandals.

NordVPN's support guide describes file checks and harmful-site blocking as real-time protection, alongside DNS filtering. The page does not establish that every protection is DNS-level or available without a VPN connection across all platforms.

Surfshark's features page says CleanWeb blocks ads, banners, pop-ups, trackers, and access to malicious websites. The cited page does not establish that the feature operates at the network level or independently measured blocking efficacy.

NordVPN offers Meshnet, Double VPN, Onion Over VPN, and Dark Web Monitor for advanced privacy protection.

Surfshark's features page lists Dynamic MultiHop, Bypasser split tunneling, Static IP servers, and a separately offered Dedicated IP. The cited page does not substantiate the older summary's port-forwarding claim or a native router app.

NordVPN recommends NordWhisper for restrictive local networks and describes obfuscated servers as hiding VPN traffic. These provider descriptions do not guarantee access in a particular country or network.

Surfshark's current NoBorders guide says the app can detect network restrictions and show servers it says work best under those restrictions. This is a provider feature description, not a guarantee of access in a specific region or network.

NordVPN's trust center says its Linux command-line app has been open source for several years and that Linux GUI source code is available to view, build, and customize. It does not state that Meshnet tooling or all other apps are open source.

Surfshark's protocol documentation describes OpenVPN and WireGuard as open source and Dausos as proprietary. These protocol descriptions do not establish that Surfshark's VPN applications or all components are open source.

NordVPN's current support guide says post-quantum protection is available on Windows, macOS, Linux, Android, iOS, tvOS, and Android TV, but only with NordLynx. It says the feature is unavailable with OpenVPN, dedicated IP, obfuscated servers, and Meshnet.

Surfshark's April 13, 2026 Dausos announcement describes its proprietary VPN protocol as post-quantum resilient and says it was available only through the macOS app at that time. Whether Dausos is now available on other platforms and its cryptographic behavior were not independently tested.

NordVPN describes Dedicated IP as a personal IP address that is not shared with other users. The cited current provider page does not establish the country count or service compatibility stated in the older summary.

Surfshark's December 11, 2025 support article says Dedicated IP is purchased separately and is available through Windows, macOS, Android, iOS, Linux, and browser-extension apps. This unique IP is distinct from shared Static IP servers; the cited page does not establish a country count.

NordVPN describes Meshnet as a private network connecting users' devices. That description does not establish whether the service participates in third-party decentralized VPN networks.

Centralized architecture (not a dVPN).

NordVPN's next-generation antivirus whitepaper describes machine-learning models for phishing URLs, scam e-commerce pages, malware file behavior, and social-engineering patterns. It says processing may be on-device, in a browser extension, or in the backend; this is a provider description, not a detection-performance test.

No AI/ML endpoint threat features disclosed.

NordVPN's trust center says both its Linux command-line app and GUI source code are available. It does not establish feature parity, update cadence, or Meshnet support in the Linux client.

Surfshark's Linux download page describes a GUI app and lists supported Linux distributions and desktop environments. It says new features are available only in the Linux GUI app; this source does not establish parity with other platforms.

NordVPN's next-generation antivirus whitepaper says that, with user consent, it tracks feature use, blocked-threat volume, and direct survey scores for product improvement. This disclosure is scoped to that protection product and does not provide an app-wide telemetry or third-party tracker inventory.

Surfshark's privacy policy identifies Surfshark B.V. and describes personal-data processing for its website, hosted services, and related applications. This policy page does not provide an embedded-SDK or desktop tracker measurement.