Surfshark

Is Surfshark safe?

Yes. Surfshark encrypts your connection, runs every server from memory so a reboot wipes it, and has had its no-logs policy checked twice by Deloitte. We score it 79/100, level with ExpressVPN and NordVPN, its sister company since a 2022 merger.

The catch is on the app side rather than the VPN side. Surfshark collects analytics tied to your account, uses some data for its own marketing, keeps its audit reports for paying customers only, and faces a US lawsuit over subscription renewals. None of these touches the encrypted tunnel itself, which is what most buyers are paying for, but they are the reasons it does not reach the top of our list.

What does Surfshark know about you?

Less than most consumer apps, more than the strictest VPNs. Apple's privacy label lists your user ID, product interaction and performance data as linked to you, used for analytics and app functions, plus customer support messages. Your email is collected for Surfshark's own advertising and marketing and a device ID for analytics, neither linked to your identity. Nothing is listed as used to track you across other companies' apps.

Google Play goes further in one respect: it lists payment information and purchase history as used for advertising or marketing, alongside fraud prevention. Analytics on app use and the apps installed on your phone are optional.

The privacy policy, updated on 12 October 2026, is specific about the VPN itself. While you are connected, the server holds your user ID, your IP address and connection timestamps, and Surfshark says these are deleted within 15 minutes after you disconnect. It does not log the sites you visit. In the app it shares device data with AppsFlyer and Firebase for campaign attribution and with Iterable for marketing email, and it uses advertising IDs only with your consent. The policy says Surfshark does not sell personal data.

Has the no-logs claim been checked?

Twice by Deloitte, with results announced in January 2023 and June 2025. For the 2025 check, under the ISAE 3000 assurance standard, Deloitte's staff interviewed employees and reviewed the configuration of standard, static and multiport VPN servers against the no-logs policy. Unlike Proton, Surfshark does not publish the reports: they sit in the customer account area, so anyone deciding whether to buy sees only the company's summary.

The other limit applies to every such audit. It is a check of systems at one moment, not continuous monitoring. Surfshark's quarterly transparency report adds a little: 23 inquiries from government bodies in July to September 2026, none of which, it says, led to disclosure of users' online activity.

How secure is Surfshark?

The server design is the strong point. All VPN servers are RAM-only and most are rebuilt regularly, so nothing written to them survives a restart. Connections use WireGuard with post-quantum protection, OpenVPN or IKEv2, plus Dausos, a protocol Surfshark built itself.

Outside testing is recent. Cure53 audited the infrastructure and Dausos in 2026, after earlier reviews of the browser extensions (2018) and servers (2021). SecuRing tested the web, desktop and mobile apps and, separately, the network infrastructure in 2025, and the Android app holds a Mobile App Security Assessment certificate. Surfshark runs its own bug bounty covering apps, servers and websites, with rewards at its discretion rather than a published scale. We found no record of a breach.

Incogni, Surfshark's data-removal service

Incogni is a paid service that asks data brokers and people-search sites to delete your details. It was created within Surfshark and is run by Incogni Inc. of Mission Viejo, California. To do the job it needs your full name, address and date of birth, plus extra addresses, emails and phone numbers on some plans, and it sends those details to the brokers it covers. The iPhone app is listed only in the US and Canada and is rated 4+. Its Apple label is less private than Surfshark's: it lists a device ID as used to track you, with email, user ID and usage data collected without your name. Incogni is not part of Surfshark's score.

How to use Surfshark safely

1. Turn off automatic renewal in your account if you bought a fixed term, and note the renewal date. A proposed class action in California alleges renewals without clear consent; it is an allegation, not a finding.
2. Refuse the advertising and analytics consent prompts in the app if you want the minimum data shared with AppsFlyer and Firebase.
3. Use WireGuard or Dausos rather than older protocols.
4. Turn on the built-in ad and tracker blocker, especially on public Wi-Fi.
5. Parents who rely on router or school filters should know a VPN can bypass them.

How we scored it

The regulatory record is the strongest factor (86), with no fines or orders found. Security (81) follows, helped by RAM-only servers and recent Cure53 and SecuRing audits. Scams and harmful content (80) loses two points because the iPhone app is rated 4+ while the terms require users to be 18. Transparency and control is the weakest (74), because the Deloitte reports are hidden from non-customers and renewal practices are being challenged in court.