Surfshark
A single roll-up of ownership and CLOUD Act exposure.
-
EU-Sovereign EU/EEA/Switzerland-owned and -operated, with no identified CLOUD Act exposure.
-
EU-Based This listing EU-operated, with at most minor or transient US exposure.
-
EU-Hosted EU hosting available, but a US parent or hyperscaler sub-processor creates material exposure.
-
US-Linked Operated by a US-incorporated entity, directly subject to US jurisdiction.
NL-incorporated VPN (Surfshark B.V., Amsterdam, KvK 81967985): moved from BVI to NL Oct 2021, merged with Nord Security 2022, RAM-only, Deloitte-audited.
Surfshark is a European service hosted in the Netherlands, with at most minor, transient US exposure under the CLOUD Act. It is listed under VPN.
Assessment notes
Surfshark is operated by Surfshark B.V. (Kabelweg 57, 1014BA Amsterdam, the Netherlands; KvK 81967985, VAT NL862287339B01). It moved its registration from the British Virgin Islands to the Netherlands on 1 October 2021, which is the structural reason it qualifies as an EU listing. Founded 2018 with operations still in Vilnius, Lithuania; in early 2022 it merged with Nord Security under one holding company while keeping independent brands and infrastructure, runs 4500+ RAM-only diskless servers across 100+ countries, and has a Deloitte no-logs audit on record. Ownership signals: Dutch B.V. operating entity (EU-incorporated), Nord Security holding-level US minority stakes (General Catalyst in the 2022 round, Warburg Pincus leading a second $100M round on 28 September 2023 at a $3B valuation), necessarily global VPN fleet including US locations (CLOUD Act exposure rated minor, mitigated by RAM-only architecture). No public DPA surfaced at audit. A stronger EU-incorporation story than a Panama-registered entity, but ownership complexity means it falls short of pure-EU founder-owned picks like Mullvad or the Swiss non-profit structure of ProtonVPN.
Findings
- CLOUD Act
- CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor This listing A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
-
- Ownership
- Ownership
Where ultimate control over the operating company sits.
-
EU-owned This listing EU-incorporated and EU-controlled; no significant US ownership.
-
EU HQ, US-funded EU-headquartered but US venture- or PE-controlled.
-
EU subsidiary, US parent European operating company owned by a US parent company.
-
US-owned The operating company itself is US-headquartered.
-
Other A non-EU jurisdiction. Swiss/EEA-owned vendors count as European here; the UK and others do not.
-
- Sub-processors
- 0 none disclosed
Verified signals
-
EU / adequacy hosting: Yes
-
EU / adequacy operator: Yes
-
No US CLOUD Act exposure: Not assessed
-
Public DPA: No
-
Sub-processors disclosed: Yes
-
Open-source clients: No
-
Third-party certification: No
Jump to
About Surfshark
Surfshark is operated by Surfshark B.V., a Dutch company at Kabelweg 57, 1014BA Amsterdam (Netherlands chamber of commerce KvK 81967985, VAT NL862287339B01). It was founded in 2018, originally registered in the British Virgin Islands, and moved its corporate registration to the Netherlands on 1 October 2021. That move is the structural reason Surfshark qualifies as an EU listing in this directory at all. Day-to-day operations are still in Vilnius, Lithuania. In early 2022 Surfshark and Nord Security announced a merger under a single holding company, but both brands continue to operate independently with separate infrastructure and product roadmaps: Surfshark is a Nord Security sister-brand, not a sub-product.
As a product, Surfshark is one of the better-audited consumer VPNs. The server fleet is 4500+ RAM-only diskless servers across 100+ countries, so configuration is loaded fresh on every boot and nothing persists. Deloitte performed an independent no-logs audit confirming the policy. The product offers WireGuard, Nexus mesh routing, Dynamic MultiHop, and an IP Rotator that changes the user's IP every 10 minutes. The marketing site supports 17 languages including all major EU locales.
For an EU-sovereignty audit Surfshark is a mid-tier pick. It has a stronger EU-incorporation story than a Panama-registered operating entity, and a cleaner ownership trail than CyberGhost (no Kape/Crossrider/Sagi history). Three signal gaps remain. First, the Nord Security holding carries US minority stakes across two rounds: General Catalyst co-led the 2022 $100M round, and Warburg Pincus led a second $100M round on 28 September 2023 at a $3B valuation, with the founders still reported as the largest holders. Second, the company's pre-2021 BVI history. Third, the US processor chain: beyond the structural reality that any global VPN service operates servers in the United States, the privacy policy names Cloudflare, Google BigQuery, Firebase, Zendesk, Stripe, Iterable, AppsFlyer, Purchasely, Tune and Telnyx on the marketing, support and payment paths, which is the widest US chain of any EU-owned listing in this category. The RAM-only architecture genuinely mitigates the data-at-rest exposure the US server locations would otherwise create, but it does not reach that processor chain. For buyers who prioritise a simple, founder-controlled EU ownership chain, Mullvad (Swedish AB, 100% founder-owned) and ProtonVPN (Swiss non-profit Foundation) are stronger picks.
Pricing is paid-only (no free tier; 30-day money-back): Surfshark Starter from €2.49 per month on the 24-month plan (€67.23 billed for 27 months, three of them free); One and One+ tiers add encrypted email/storage/data-removal extras above. Best fit: mainstream privacy-conscious EU buyers who want a multi-device VPN with audited no-logs and a Dutch corporate entity, at the lower end of the price range. Buyers who prioritise sovereignty over price and feature breadth should prefer Mullvad or ProtonVPN.
Sub-processor map · none disclosed
Frameworks & certifications · none listed
Capability matrix
Table 1Capabilities of Surfshark
Integration & access
Compliance & governance
Pricing & tiers
Public documents
Alternatives in this category
-
Italy · €7/moEU-SovereignCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None This listing EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: No Sub-processors: No Open source: No -
-
Sweden · €3.75/moEU-HostedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: No Sub-processors: No Open source: No -
-
Romania · €2.19/moEU-BasedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor This listing A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: No Sub-processors: Yes Open source: No -
| Product | Sovereignty | CLOUD Act | Signals | From |
|---|---|---|---|---|
AirVPN
Italy
|
EU-Sovereign | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: No
Sub-processors: No
Open source: No
|
€7/mo |
AzireVPN
Sweden
|
EU-Hosted | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: No
Sub-processors: No
Open source: No
|
€3.75/mo |
CyberGhost
Romania
|
EU-Based | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: No
Sub-processors: Yes
Open source: No
|
€2.19/mo |