| Every product starts here — neither good nor bad | | | 50 |
| Protocol Audit No Critical Findings An independent German security firm, Cure53, tore apart Surfshark's own connection technology (called Dausos) in February and March 2026 and found nothing rated critical or high risk inside it. They looked at the source code, not just the outside. Ten issues total were written up, seven of them counted as real security holes, but all the ones inside the protocol were medium risk or lower. With no findings rated at Critical or High severity within the actual Dausos protocol itself, the audit results reflect a stable and resilient platform. | independently measured
counts 100% | +22 × 1.00 | +22.0 |
| No Logs Audit Opinion Deloitte, one of the four biggest accounting and audit firms in the world, checked whether Surfshark's servers and systems were actually set up the way its no-logs promise describes. No-logs means the company claims it does not keep records of what you do online. Deloitte gave its strongest grade of confidence, called reasonable assurance, and said the setup matched the description as of 10 June 2025. Based on the procedures performed and the evidence obtained, in our opinion, the configuration of IT systems and management of the supporting IT operations is properly prepared, in all material respects in accordance with the Surfshark’s description set out in the Appendix I, as of 10 June 2025. | independently measured
counts 100% | +18 × 1.00 | +18.0 |
| No Per Seat Cost On the positive side, there is no per-person or per-device charge. One subscription covers as many devices as you want at the same time, so a household or small team does not pay extra per user. Surfshark allowed us to connect to as many devices as we wanted, with no limit on simultaneous connections. | independently measured
counts 100% | +11 × 1.00 | +11.0 |
| Worst Flaws Ruled Out Of Scope The nastiest problems Cure53 actually found were not in Surfshark's own software at all. They were in the outside hosting setup, meaning the rented servers and infrastructure Surfshark runs on. Because the job was defined as reviewing the protocol, those worst findings were marked out of scope and were not graded as part of the result. So the clean headline result covers a narrower area than it first appears. It is important to highlight that the most severe vulnerabilities identified during the audit were localized to the external hosting environment rather than the Surfshark VPN Dausos protocol or its source code. Consequently, these were categorized as out-of-scope (OOS) for the core protocol assessment. | independently measured
counts 100% | -10 × 1.00 | -10.0 |
| Ram Only Servers All server data is stored in temporary RAM memory that wipes clean every time a server reboots. Deloitte verified Surfshark's strict no-logs policy and Cure53 audited its RAM-only server infrastructure. | independently measured
counts 100% | +10 × 1.00 | +10.0 |
| Renewal Price Jump The cheap headline price only applies to the first term. After that the subscription renews at a much higher standard rate, billed as a yearly lump sum. The entry plan renews at 79 dollars a year, the middle bundle at 99 dollars, and the top bundle at 119 dollars. Against an advertised introductory rate near 2 dollars a month, the entry plan roughly triples on renewal. After the initial subscription period, Surfshark Starter renews at $79 per year ($6.58 per month). Surfshark One renews at $99 per year ($8.25 per month) and Surfshark One+ renews at $119 per year ($9.92 per month). | reported by owners and reviewers
counts 80% | -12 × 0.80 | -9.6 |
| Renewal Charge Not Refundable This is the core trap. The 30-day money-back promise covers only your very first payment. Once the subscription has rolled over into a renewal, that renewal charge cannot be refunded at all — so the expensive payment is precisely the one the guarantee does not protect. The subscription has already renewed | the maker's own claim
counts 70% | -12 × 0.70 | -8.4 |
| Audit Is Snapshot Only Deloitte spells out that this was a single snapshot in time, not ongoing monitoring. It says nothing about whether the no-logs setup held true before that day or has held true since, and the auditors note that any later change to the systems could change their conclusion. Our assurance engagement is a point in time assessment. The procedures we performed do not provide any assurance for any other point in time or period of time. | independently measured
counts 100% | -8 × 1.00 | -8.0 |
| Pricing Starter Plan The most attractive entry-level plan costs only $2.49 per month, providing significant savings compared to the original price, though local taxes may apply. Surfshark Starter $2.49 /mo. + 3 EXTRA months old price $444.15 sale price $67.23 for the first 27 months (VAT may apply). | the maker's own claim
counts 70% | +11 × 0.70 | +7.7 |
| App Update Broke Autoconnect March 2026 A real user who had used Surfshark for a while updated their App Store review in March 2026 to say a recent app change broke the 'auto-connect on untrusted WiFi' safety feature -- meaning the VPN sometimes silently stayed off when it should have turned on, which defeats the whole point of having a VPN. Update March 2026: dropping my review down to 1 star due to a recent change that ruined the mobile VPN. The autoconnect/trusted network feature is completely broken and has likely exposed me to much more risk than it should have. | reported by owners and reviewers
counts 80% | -9 × 0.80 | -7.2 |
| Independent Security Audits Less Frequent Than Expressvpn An independent reviewer who tested Surfshark himself points out that outside security firms have only checked Surfshark's 'we don't log you' promise 4 times ever, compared to a rival (ExpressVPN) getting checked 19 times. Fewer independent check-ups means less outside proof the no-logging promise is still being kept over time. Another thing is that they do have rather infrequent audits, comparing their four audits to ExpressVPN's 19 audits. | reported by owners and reviewers
counts 80% | -8 × 0.80 | -6.4 |
| Unlimited Devices One subscription covers every smartphone, laptop, TV, and tablet in your home simultaneously. Supports unlimited simultaneous device connections under a single account. | the maker's own claim
counts 70% | +9 × 0.70 | +6.3 |
| Encryption Config Weakness Found A Polish security company, SecuRing, ran simulated attacks on Surfshark's network infrastructure in December 2025. It found no critical problems, but it did flag one medium-risk issue: weak settings in the encryption that protects traffic between your device and the servers, which under the right conditions could let an eavesdropper intercept that communication or knock the service offline. The fix listed was to switch off outdated encryption methods and old protocol versions. A number of weaknesses in SSL/TLS configuration were identified, which in the presence of favorable conditions can lead to the interception of communication between the client and the server or to performing a Denial of Service attack. | independently measured
counts 100% | -6 × 1.00 | -6.0 |
| Top End Speeds Measured Another reviewer measured raw speeds on a very fast home connection (1000 megabits per second — roughly a top-tier fibre line). On nearby connection points the service still delivered most of that speed, and it dropped further the farther away the connection point was. We ran all tests on a 1000 Mbps connection using the latest Surfshark VPN apps with the WireGuard protocol. | independently measured
counts 100% | +6 × 1.00 | +6.0 |
| Connection Records Kept 15 Minutes Surfshark's own signed statement inside the Deloitte report admits the servers do record something: an account identifier plus the times you connected and disconnected. It is wiped automatically within fifteen minutes of your session ending. That is not a record of the websites you visited, but it is not literally zero data either, so the flat claim that the company stores nothing at all is not accurate. Our servers do store information about user’s connection to a particular VPN server (user ID and connection time stamps), but this information is automatically deleted within 15 minutes after termination of user session. | the maker's own claim
counts 70% | -8 × 0.70 | -5.6 |
| Shared Parent Company With Nordvpn NordVPN and Surfshark, which look like separate rival VPN companies, actually merged in 2022 and now belong to the same parent company (Nord Security). They still run as separate apps, but if you pick 'Surfshark over NordVPN' thinking you're choosing a totally different company, you're not. Two giant VPN providers, NordVPN and SurfShark, are merging to become one colossal VPN supplier. | reported by owners and reviewers
counts 80% | -7 × 0.80 | -5.6 |
| Payment Route Restricts Refund Where you buy matters. The refund only applies if you bought directly from Surfshark or through one of three named payment handlers. Buy through any other shop or reseller and the money-back guarantee does not apply to you. The subscription was purchased directly from Surfshark or through an eligible reseller (Paddle, Google Play, or Cleverbridge) | the maker's own claim
counts 70% | -7 × 0.70 | -4.9 |
| Torrenting Socks5 Proxy Support Disputed Two different 2026 reviewers disagree on a specific torrenting feature: Cybernews' reviewer says Surfshark has no SOCKS5 proxy and no port forwarding at all, while a Gizmodo-branded review of the same product lists 'Socks5 proxy support' as a feature. Torrent users who specifically need SOCKS5 should double-check directly with Surfshark before relying on either claim. Surfshark's lack of torrenting specific features. No SOCKS5 proxy, no port forwarding, nada. | sources disagree
counts 40% | -6 × 0.40 | -2.4 |
| Fit for “Privacy-focused” | 50 + 6.9 = 57 |
