Skip to content
Independently verified · Quarterly re-audit
EU VETTED

Surfshark

VERIFIED
Founded 2018 · surfshark.com ↗

NL-incorporated VPN (Surfshark B.V., Amsterdam, KvK 81967985): moved from BVI to NL Oct 2021, merged with Nord Security 2022, RAM-only, Deloitte-audited.

In short

Surfshark, in the VPN category, is a European service with Netherlands as its hosting location and at most minor, transient US exposure under the CLOUD Act.

Assessment notes

Surfshark is operated by Surfshark B.V. (Kabelweg 57, 1014BA Amsterdam, the Netherlands; KvK 81967985, VAT NL862287339B01). It moved its registration from the British Virgin Islands to the Netherlands on 1 October 2021, which is the structural reason it qualifies as an EU listing. Founded 2018 with operations still in Vilnius, Lithuania; in early 2022 it merged with Nord Security under one holding company while keeping independent brands and infrastructure, runs 4500+ RAM-only diskless servers across 100+ countries, and has a Deloitte no-logs audit on record. Ownership signals: Dutch B.V. operating entity (EU-incorporated), Nord Security holding-level US-VC minority (General Catalyst, 2022 round), necessarily global VPN fleet including US locations (CLOUD Act exposure rated minor, mitigated by RAM-only architecture). No public DPA surfaced at audit. A stronger EU-incorporation story than a Panama-registered entity, but ownership complexity means it falls short of pure-EU founder-owned picks like Mullvad or the Swiss non-profit structure of ProtonVPN.

CLOUD ACT
OWNERSHIP
SUB-PROCS
0 none disclosed
Verified signals
Jurisdiction
  • EU / adequacy hosting
  • EU / adequacy operator
  • No US CLOUD Act exposure
Transparency
  • Public DPA
  • Sub-processors disclosed
  • Open-source clients
  • Third-party certification
JUMP TO
OVERVIEW

About Surfshark

Surfshark is operated by Surfshark B.V., a Dutch company at Kabelweg 57, 1014BA Amsterdam (Netherlands chamber of commerce KvK 81967985, VAT NL862287339B01). It was founded in 2018, originally registered in the British Virgin Islands, and moved its corporate registration to the Netherlands on 1 October 2021. That move is the structural reason Surfshark qualifies as an EU listing in this directory at all. Day-to-day operations are still in Vilnius, Lithuania. In early 2022 Surfshark and Nord Security announced a merger under a single holding company, but both brands continue to operate independently with separate infrastructure and product roadmaps: Surfshark is a Nord Security sister-brand, not a sub-product.

As a product, Surfshark is one of the better-audited consumer VPNs. The server fleet is 4500+ RAM-only diskless servers across 100+ countries, so configuration is loaded fresh on every boot and nothing persists. Deloitte performed an independent no-logs audit confirming the policy. The product offers WireGuard, Nexus mesh routing, Dynamic MultiHop, and an IP Rotator that changes the user's IP every 10 minutes. The marketing site supports 17 languages including all major EU locales.

For an EU-sovereignty audit Surfshark is a mid-tier pick. It has a stronger EU-incorporation story than a Panama-registered operating entity, and a cleaner ownership trail than CyberGhost (no Kape/Crossrider/Sagi history). Three signal gaps remain: the Nord Security holding-level US-VC minority (General Catalyst co-led the 2022 $100M round), the company's pre-2021 BVI history, and the structural reality that any global VPN service operates servers in the United States. The RAM-only architecture genuinely mitigates the data-at-rest exposure those US locations would otherwise create. For buyers who prioritise a simple, founder-controlled EU ownership chain, Mullvad (Swedish AB, 100% founder-owned) and ProtonVPN (Swiss non-profit Foundation) are stronger picks.

Pricing is paid-only (no free tier; 30-day money-back): Surfshark Starter from around €2.50-3/month on a 2-year plan; One and One+ tiers add encrypted email/storage/data-removal extras above. Best fit: mainstream privacy-conscious EU buyers who want a multi-device VPN with audited no-logs and a Dutch corporate entity, at the lower end of the price range. Buyers who prioritise sovereignty over price and feature breadth should prefer Mullvad or ProtonVPN.

SUB-PROCESSORS

Sub-processor map · none disclosed

Source ↗
Vendor discloses zero sub-processors. All data processing happens in-house.
CERTIFICATIONS

Frameworks & certifications · none listed

We checked the vendor's website and standard certification body registries. No active certifications found at the time of last audit (2026-05-15).
FEATURES

Capability matrix

Servers 4500 servers
Countries 100 countries
Simultaneous devices Unlimited
Protocols WireGuard OpenVPN IKEv2
Kill switch Yes
Audited no-logs Yes
Port forwarding No
Platforms iOS macOS Windows Android Linux
INTEGRATION & ACCESS
REST API No
SSO (SAML / OIDC) No
COMPLIANCE & GOVERNANCE
Audit log No
Self-host / on-prem option No
PRICING

Pricing & tiers

PAID
from €3/mo
View pricing page ↗
PUBLIC DOCUMENTS

Public documents

Vendor does not publish a public DPA. Without a publicly accessible Data Processing Addendum, small EU customers cannot self-serve the processor agreement. This is recorded as no public DPA (see How we assess).
  • Data Processing Addendum (DPA)
    — missing
    missing
  • Sub-processors list
    surfshark.com/privacy…
    Open ↗
  • Terms of Service
    surfshark.com/terms-of-service…
    Open ↗
ALTERNATIVES

Alternatives in this category

AirVPN
Italy · Founded 2010
EU-SOVEREIGN

Italian hacktivist-founded VPN (Perugia, 2010), no-logs, port forwarding, but no longer serves Italian residents (Piracy Shield).

Public DPA Sub-processors Open source
FROM
€7/mo
CLOUD ACT
NONE
AzireVPN
Sweden · Founded 2012
EU-HOSTED

Swedish privacy VPN (Stockholm, est. 2012): Blind Operator, RAM-only, audited no-logs; acquired by Malwarebytes (US) 7 Nov 2024.

Public DPA Sub-processors Open source
FROM
CLOUD ACT
MATERIAL
CyberGhost
Romania · Founded 2011
EU-BASED

Romanian-operated VPN (CyberGhost S.R.L., 2011) under Kape Technologies (UK; ex-Crossrider) → Unikmind/Teddy Sagi (IM) since 2023; listed as a warning.

Public DPA Sub-processors Open source
FROM
€2/mo
CLOUD ACT
MINOR