Is Surfshark Safe and Legit? What the Audits, Logs, and Owners Show

Is Surfshark safe? Yes, Surfshark is a legitimate, safe VPN for everyday privacy. Its no-logs policy has been independently audited twice by Deloitte, and it runs on RAM-only servers. A few points deserve a look, though: it’s based in a 9 Eyes country, some users report account-security problems, and in September 2026 it disclosed an incident on an internal test server that it says didn’t touch customer data.

So, is Surfshark legit as a company, and safe as a product? “Safe” really means three questions. Will it protect my data? Is the company trustworthy? Has anything gone wrong? This guide answers all three, with the audits, the logging policy, the owners, and the complaints in one place.

Everything here comes from Surfshark’s own policies, its audit summaries, and expert reviews.

Question	Short answer	Source
Is it a real company?	Yes, Surfshark B.V., launched in 2018	Surfshark about us
Who owns it?	The Nord Security group, after a 2022 merger	Surfshark, Nord Security
Where is it based?	Amsterdam, Netherlands (a 9 Eyes country)	Surfshark privacy policy
Does it keep activity logs?	No. Deloitte checked this in late 2022 and again in 2025	Surfshark, Deloitte
Other audits	Cure53 (2018, 2021), MASA (2023), SecuRing (2025)	Surfshark, CNET, vpnMentor
Servers	RAM-only, wiped on every reboot	surfshark.com
Encryption	AES-256 and ChaCha20 (with WireGuard)	CNET, vpnMentor
Known incidents?	A test-server breach in Sept 2026, with no customer data affected, per Surfshark; some users report account takeovers	Surfshark, BleepingComputer

Is Surfshark a Legit Company?

Yes. Surfshark is a registered company that has operated since 2018 and is one of the best-known VPN brands.

Surfshark launched its first VPN app in 2018. Its founder, Vytautas Kaziukonis, chairs the board, and Dovydas Godelis is CEO. The legal company is Surfshark B.V., registered at Kabelweg 57 in Amsterdam, with offices in Vilnius and Kaunas (Lithuania), Warsaw and Berlin, and more than 500 staff. Surfshark doesn’t publish a user count, but it reports more than 40 million app downloads.

Let’s look at Surfshark’s security and trust record:

Year	What happened
2018	Launches its first VPN app; Cure53 audits its browser extensions
2021	Cure53 audits its server infrastructure (April); headquarters moves from the British Virgin Islands to the Netherlands (October)
2022	Merges with Nord Security; Deloitte completes its first no-logs assurance review (December)
2023	Deloitte result announced (January); MASA tests the Android app (December)
2025	Second Deloitte no-logs report (June); SecuRing infrastructure audit (December)
2026	Discloses an incident on an internal test server (September); Surfshark says no customer data was affected

Major outlets review and recommend it. CNET, vpnMentor and Security.org all rate Surfshark among their top VPNs, and PCMag names it the best pick for unlimited connections.

Who Owns Surfshark?

Surfshark merged with Nord Security, the parent company of NordVPN, in 2022. Surfshark says the two companies merged under one holding company but still operate independently, with their own apps and infrastructure.

Nord Security’s outside investors include Novator Ventures, which led a 2022 round alongside Burda Principal Investments and General Catalyst, and Warburg Pincus, which led a further $100 million round in 2023. These firms invest in the group, not in Surfshark’s day-to-day operations.

Ownership decides who could be asked to hand over data, which is why audits count: the no-logs audits cover Surfshark’s own servers and systems. The two sister brands still compete, and the choice between Surfshark vs NordVPN mostly turns on price and device limits.

Is Surfshark a Chinese, Russian, or Israeli Company?

No. Surfshark is a Dutch-registered company, Surfshark B.V., founded by a Lithuanian team, with offices in Lithuania, Poland, and Germany. Its parent group, Nord Security, also has Lithuanian roots, and its named investors are US and European funds.

Why Is Surfshark So Cheap, and Is That a Red Flag?

No. The low price comes from long prepaid plans, not from selling data.

The 2-year Starter plan costs $67.23 for the first 27 months, about $2.49 a month, and then renews at $79 a year (Surfshark pricing). The monthly plan costs $18.95. You pay the whole first term up front, which is how the per-month figure looks so low.

Surfshark’s privacy policy says plainly: “We do not sell, rent, lease, or trade your personal data with anyone.” That long-term pricing is also why Surfshark VPN often tops lists of the best cheap VPNs.

Is It Legal to Use Surfshark in the US?

Yes. Using a VPN is legal in the US.

A VPN doesn’t change what’s legal, though. Anything that’s illegal without a VPN is still illegal with one. A few countries restrict or ban VPNs, so check local laws before you use Surfshark abroad.

Does Surfshark Keep Logs?

No. Surfshark doesn’t log your browsing, downloads, or the sites you visit, and Deloitte has checked this twice.

Its privacy policy says, “We do not collect any information about what you do online.” That covers your browsing history, network traffic and bandwidth use.

What the Deloitte Audits Checked

Deloitte first verified Surfshark’s no-logs policy in an assurance review completed in December 2022 and announced in January 2023. It repeated the check in a report Surfshark published on June 16, 2025, under the ISAE 3000 assurance standard.

In plain words, Deloitte:

• Checked the servers: Standard, static, and multi-port VPN servers.
• Checked the setup: Server configuration, deployment processes, and privacy settings.
• Interviewed staff: About how the no-logs policy is followed.

Deloitte’s 2025 review confirmed that browsing and activity aren’t logged or tracked. Paying users can read the full report in their account. One limit applies to any audit: it checks a point in time, not every day since.

How does that compare with other big VPNs? Each of the major providers now pays an outside firm to check the same no-logs promise:

VPN	Latest no-logs audit	Auditor	Based in
Surfshark	June 2025 (its second)	Deloitte	Netherlands
NordVPN	Published February 2026 (its sixth)	Deloitte	Panama
ExpressVPN	As of February 2025	KPMG	British Virgin Islands
Proton VPN	May 2026 (its fifth)	Securitum	Switzerland

Independent privacy experts treat this kind of checking as the right test. The Electronic Frontier Foundation (EFF), the US digital-rights nonprofit, tells readers of its Surveillance Self-Defense guide (last reviewed July 28, 2026) to verify a VPN’s privacy claims, look for published third-party audits, understand how it makes money, and research who runs it. EFF calls public audits “a sign the VPN provider is trying to take security seriously.” Surfshark meets each point: Deloitte verified its no-logs claim, its SecuRing infrastructure report is public, it earns its money from subscriptions, and its founders and company address are on record.

What Data Does Surfshark Actually Collect?

Surfshark collects the data it needs to run your account, plus a short-lived connection record. According to its privacy policy (updated October 12, 2026), it keeps:

• Account data: Your email address, encrypted password, and registration date.
• Payment data: Subscription and billing details.
• Performance data: Aggregated app performance and how often the service is used.
• Temporary connection data: Your user ID and/or IP address and connection timestamps, which are “automatically deleted within 15 minutes after your session ends.”

That last point is why CNET’s Surfshark review rates its privacy and security 7 out of 10. CNET’s Attila Tomaschek says casual users should be fine, but privacy-critical users should be aware of the temporary collection of IP addresses and timestamps. Security.org also lists it as a drawback, while noting that Deloitte verified the practice.

How Does Surfshark Protect Your Data?

Surfshark encrypts your traffic with the same standard banks use, and adds tools that stop your data from leaking if the connection drops.

• Encryption: AES-256 with OpenVPN and IKEv2, and ChaCha20 with WireGuard. CNET also notes post-quantum encryption on its WireGuard and Dausos protocols.
• Protocols: WireGuard by default, plus OpenVPN, IKEv2, and Surfshark’s own Dausos protocol.
• RAM-only servers: Servers run in memory, so nothing is saved to a hard drive and data is wiped on every reboot.
• Kill switch: Cuts your internet if the VPN drops, so your real IP address isn’t exposed.
• Leak protection: Keeps your DNS requests and real IP address inside the VPN tunnel.

Independent checks back this up. vpnMentor found no IP, WebRTC, or DNS leaks across 10 servers, and Security.org’s tests found no DNS or WebRTC leaks, with the kill switch working during torrenting. On the security side, Cure53 audited Surfshark’s browser extensions in 2018 and its server infrastructure in 2021, when it found only minor issues, which were fixed. SecuRing completed an infrastructure security audit in December 2025, and Surfshark has committed to annual audits.

You can repeat the basic checks yourself in about two minutes:

1. Note your real IP: With the VPN off, open any “what is my IP” site and note the address and location.
2. Connect and reload: Connect to a Surfshark server and reload the page. The IP and location should now match the server.
3. Run a DNS leak test: Use the standard test at dnsleaktest.com. None of the servers listed should belong to your home internet provider.
4. Run a WebRTC test: Open BrowserLeaks WebRTC. Your real IP address shouldn’t appear.

Does Surfshark’s Netherlands Base and the 9 Eyes Affect Your Privacy?

Less than it sounds, because a VPN that keeps no activity logs has very little to hand over.

The Five, Nine and 14 Eyes are intelligence-sharing alliances between countries. The Netherlands is part of the Nine Eyes group, so in theory its authorities could share information with partner countries.

vpnMentor notes that the jurisdiction “isn’t ideal for privacy”, but adds that Surfshark doesn’t keep identifiable activity logs, and its audited no-logs policy means there’s little user activity on record to share.

People with high-risk privacy needs, such as journalists or activists, may prefer a VPN based in a country with stronger privacy laws, like Switzerland-based Proton VPN. For everyday browsing, streaming, and public Wi-Fi, the audited no-logs policy is the stronger protection.

Has Surfshark Ever Been Hacked or Had a Controversy?

No breach of Surfshark’s customer data or VPN servers has been reported. In September 2026, though, Surfshark disclosed that someone had accessed an internal test server, and some users have complained about their accounts being taken over.

The September 2026 test-server incident: Surfshark said that a misconfigured internal test server, left reachable online through human error, was accessed in late August 2026. The server contained engineering material such as configuration files and build credentials. Surfshark spotted the activity on August 31, contained it on September 2, and said it “did not affect customer data, VPN traffic, production systems, apps, or browser extensions,” according to its September 2026 incident report, which BleepingComputer and CyberInsider also covered. It rotated its internal credentials and said it would commission an independent audit of its wider infrastructure. Surfshark said customers didn’t need to change passwords or reinstall apps.

Server breach vs account takeover: These are different things. A server breach means the company’s systems were attacked. An account takeover usually happens when someone gets into a single user’s login, often because the same password was used and leaked elsewhere.

A widely read thread in r/vpnreviews describes one user whose Surfshark account email was changed several times in 2025. The user says Surfshark explained that someone had contacted support with the account’s payment details, then flagged the account so that future email changes need a bank statement. Commenters suggested checking the user’s devices for malware, using a password manager, and turning on two-factor authentication, and several long-time users said they’ve had no problems over two to eight years.

The fix is simple: use a unique password and turn on two-factor authentication for your Surfshark account.

Is Surfshark Safe for Banking, Public Wi-Fi, and Torrenting?

Banking: Yes. Surfshark encrypts your connection, so your banking session is protected on any network. Your bank may ask for an extra check when you log in from a new IP address, so connect to a server in your own country to avoid that.

Public Wi-Fi: Yes, and this is one of the best reasons to use a VPN. Surfshark’s auto-connect can switch the VPN on when you join Wi-Fi, and you can mark your home network as trusted so it stays off there.

Torrenting: Surfshark allows P2P traffic, and CyberInsider reports its servers are P2P-friendly. Security.org’s tests found its kill switch kept the real IP address hidden from peers. Downloading copyrighted material without permission is still illegal, VPN or not.

What Can’t Surfshark Protect You From?

A VPN hides your IP address and encrypts your traffic, but it doesn’t make you anonymous or stop every threat.

• Logged-in accounts: Google, Facebook, and other sites still know who you are when you’re signed in.
• Phishing: A VPN won’t stop you from entering details on a fake website.
• Malware already on your device: It can’t remove viruses or spyware.
• Browser fingerprinting: Sites can still recognize your browser and device settings.

Malware and data leaks need separate tools, which is why the Surfshark One bundle adds antivirus and Alert breach monitoring to the VPN.

What Do Reviewers and Users Say About Surfshark’s Safety?

Experts rate Surfshark highly overall, and privacy is its weakest score.

• CNET (October 2026): Features 10/10 and privacy and security 7/10. CNET praises the RAM-only servers, the clear no-logs promise, and the commitment to annual audits, and flags the temporary connection logs.
• vpnMentor (June 2026): 9.3 out of 10 overall and 10 for security. It lists the Deloitte, Cure53, and MASA audits and notes the 9 Eyes caveat.
• Security.org (October 2026): 9.5 out of 10, with passed DNS and WebRTC leak tests.

Users are mostly positive too. Trustpilot shows 4.3 out of 5 from 31,794 reviews, and its profile is claimed and actively managed by Surfshark. On Reddit, long-time users report years of trouble-free use, while the most common complaints are about account security and renewal prices.

Surfshark Pros and Cons for Privacy and Security

Pros:

• Audited no-logs policy: Deloitte has checked it twice.
• RAM-only servers: Nothing is stored on a hard drive.
• Strong encryption: AES-256 and ChaCha20, plus post-quantum protection on WireGuard.
• Kill switch and leak protection: No leaks found in independent tests.

Cons:

• 9 Eyes base: The Netherlands is part of an intelligence-sharing alliance.
• Temporary connection logs: IP addresses and timestamps are kept for up to 15 minutes after a session.
• Account security complaints: Some users report takeovers, often linked to reused passwords.
• Renewal price rise: The 2-year price renews at $79 a year.

How to Use Surfshark as Safely as Possible

A few settings make a big difference:

1. Turn on two-factor authentication in your account settings.
2. Use a password you don’t use anywhere else.
3. Keep the kill switch on.
4. Use the WireGuard protocol.
5. Turn on auto-connect for public Wi-Fi.
6. Turn on CleanWeb to block ads and trackers.
7. Keep the Surfshark apps updated.

So, Is Surfshark Safe to Use?

Yes, for most people. Surfshark is a legitimate, audited VPN that’s safe for everyday privacy, streaming, public Wi-Fi, and banking.

It suits anyone who wants strong protection at a low price, especially households with many devices, since one plan covers unlimited connections. It’s also a solid pick for streaming: Surfshark is the best budget option among the best VPNs for streaming, and it ranks among the best VPNs for iPhone.

If your privacy needs are high-risk, consider a VPN based outside the 14 Eyes alliance. For everyone else, Surfshark’s audited no-logs policy, RAM-only servers, and kill switch cover what counts, and the 30-day money-back guarantee lets you try it first. Speed, apps, and plans are where Surfshark VPN earns its value, and its lower price and unlimited devices are its main edge in Surfshark vs ExpressVPN.

[Get Surfshark]

Conclusion

Surfshark is audited and legitimate: Deloitte has checked its no-logs policy twice, it runs on RAM-only servers, and it’s open about incidents, including the September 2026 test-server breach. Know its limits, too. It’s based in a 9 Eyes country, it keeps connection details for up to 15 minutes, and no VPN can hide you while you’re logged in to your accounts. Secure your own account with a unique password and two-factor authentication, since most takeovers start there. For everyday users, Surfshark is a safe choice.

This article is general information based on public audits, policies and expert reviews as of November 2026. TechZeeno did not test Surfshark hands-on. Policies change, so check Surfshark’s current privacy policy before you buy. This page contains affiliate links.

Frequently Asked Questions

Q. Is Surfshark a Secure VPN?

Yes. Surfshark uses AES-256 and ChaCha20 encryption, runs on RAM-only servers, and includes a kill switch. vpnMentor and Security.org found no DNS or WebRTC leaks in their tests, and Deloitte has audited its no-logs policy twice.

Q. Has Surfshark Ever Been Hacked?

No customer data or VPN server breach has been reported. In September 2026, Surfshark disclosed that an internal test server was accessed, and said customer data, VPN traffic, and its apps weren’t affected. It rotated credentials and promised an independent audit.

Q. Does Surfshark Sell Your Data?

No. Surfshark’s privacy policy says it does not sell, rent, lease, or trade your personal data. Its low price comes from long prepaid plans, and it collects only account, payment, and aggregated performance data, plus short-lived connection details.

Q. Can Surfshark See What You Do Online?

No. Surfshark says it doesn’t collect your browsing history or network traffic, and Deloitte’s audits back that up. It does briefly keep your IP address and connection times, which it deletes within 15 minutes after your session ends.

Q. Is Surfshark Owned by NordVPN?

No, not directly. Surfshark and NordVPN merged under one parent group, Nord Security, in 2022. Surfshark says both brands still operate independently, with their own apps, servers, and teams.

Q. Is Surfshark Safe for Online Banking?

Yes. Surfshark encrypts your connection, which protects your banking session on public or shared networks. Connect to a server in your own country to avoid extra security checks from your bank when it sees a new IP address.

Q. Is Surfshark Hard to Cancel?

No. Sign in at my.surfshark.com, click your email address, open Subscription, then Payments, and choose Cancel auto-renewal. App Store purchases are cancelled through that store. For a refund, ask within 30 days of buying.