Surfshark

People who want a mainstream provider under Dutch and EU law with recent no-logs and infrastructure audits, and a trial before they commit.

Less suited to: Anyone who wants a free plan, or who wants to wait for the independent infrastructure audit Surfshark promised after its 2026 test-server breach.

Surfshark B.V. is a company established in the Netherlands, with its office in Amsterdam.^[1]

• Deloitte · June 2025

  Repeat no-logs assurance engagement (ISAE 3000), covering standard, static and multiport VPN servers. Deloitte's earlier engagement was published in January 2023.^[3]

• SecuRing · December 2025 (published January 2026)

  Penetration test of Surfshark's network infrastructure. No critical vulnerabilities were found; one SSL/TLS configuration issue was fixed.^[5]

• Cure53 · February to March 2026

  Review of the architecture and cryptography of Surfshark's new Dausos protocol. No critical or high findings in the protocol itself; the most severe issues were in hosting that was out of scope.^[6]

• August to September 2026

  A misconfigured internal test server was accessed from the internet. It held service configurations, build-related credentials, parts of binaries and code history; a proxy server was also accessed. Surfshark says production VPN infrastructure and customer data were not affected.^[7]

• 2022

  Surfshark and Nord Security (NordVPN's parent) merged under one holding company and say they operate independently.^[2]

WireGuard, OpenVPN (UDP and TCP) and IKEv2. Surfshark's own Dausos protocol launched in April 2026 and is so far available only in the macOS App Store version.^[8]

No free plan. New users buying a 12- or 24-month plan on Surfshark's website get a 7-day free trial.^[10]

30-day money-back guarantee on your first purchase, one refund per service. Renewals, prepaid or gift-card payments, and most reseller purchases are not refunded.^[1]

Prices change often and depend on plan length, so check Surfshark's site for current pricing.