Is Surfshark Safe, Legit and Worth It in 2026?

Yes – Surfshark is a safe, legitimate VPN. Deloitte has twice confirmed that it keeps no logs of what you do online, all of its 4,500+ servers run from RAM, and its only disclosed security incident, a breached test server in September 2026, didn’t touch user data, according to Surfshark. On the 2-year plan it costs $2.49 a month.

The catches are smaller: it’s based in the Netherlands, a 14 Eyes country, it renews at $79 a year after the first 27 months, and its audit record is shorter than NordVPN’s. Below is the evidence for each part of the answer, from Surfshark’s privacy policy, audit reports and US prices checked on 22 October 2026. New to the service? Our guide to what Surfshark is and how it works covers the basics.

Get Surfshark – $2.49/mo

Our Verdict in Brief

Is Surfshark Safe?

Yes. A VPN can see everything your internet provider used to see, so what matters is whether it keeps any of it and how well it guards its systems. Surfshark’s claims have been checked from several directions:

• Two no-logs assurance reports by Deloitte. The first, published in January 2023, examined Surfshark’s server and VPN configuration, deployment process, API, software-defined network and staff, and found them prepared “in all material respects” in line with its no-logs policy. The second, announced in June 2025 and carried out under the ISAE 3000 standard, covered its standard, static IP and MultiPort servers. Subscribers can read both reports in their Surfshark account.
• RAM-only servers since July 2020. Every server runs from memory, which is wiped on each restart, and Surfshark says most servers are also destroyed and rebuilt regularly. Our guide to Surfshark’s RAM-only servers explains why that matters.
• Outside security audits. Cure53 tested its browser extensions in 2018, its servers in 2021 and its own Dausos protocol in 2026; SecuRing tested its apps, extensions and websites in 2025, and its network infrastructure that December.
• Modern encryption. AES-256-GCM, ChaCha20 on WireGuard and AEGIS-256X2 on Dausos. Since 7 October 2026, WireGuard in the macOS and iOS apps is fully post-quantum, using the ML-KEM and ML-DSA standards, with other platforms to follow.
• A kill switch in every app. It cuts your internet if the VPN drops, on Windows, macOS, Android, iOS and Linux (Settings, then VPN settings). Here’s how Surfshark’s kill switch works.
• A bug bounty. Outside researchers who find flaws in its apps, VPN servers, API and websites can report them for a reward.

Here’s what each audit found:

Two caveats. Surfshark pays for the audits itself (its 2018 announcement says so plainly), and the Deloitte reports are visible only to subscribers. And Cure53’s 2026 summary found its most serious issues in the hosting environment rather than the protocol, asked Surfshark to write a formal specification and threat model for Dausos, and recommended a follow-up audit.

Does Surfshark Keep Logs?

Not of your online activity. Surfshark’s privacy policy, last updated on 12 October 2026, says it does not collect “your visited IP addresses, browsing history, session information, connection time stamps, used bandwidth, network traffic or any other similar information.”

What it does keep is worth knowing:

• For up to 15 minutes: your user ID and/or IP address and connection timestamps for the server you’re on, “automatically deleted within 15 minutes after your session ends.”
• While you’re a customer, plus 2 years after your last login: your email address, encrypted password, sign-up date, plan details, part of your card number and its expiry date, and your country (and state, for sales tax). Payment records are kept for 10 years for tax and accounting.
• For account security: the device name, operating system, app version and last login date, so it can email you about logins from a new device.
• Only with your consent: diagnostics and crash reports (kept for up to 7 days), and advertising and analytics identifiers, shared with services such as AppsFlyer and Firebase Analytics.
• With a dedicated IP: because that address is tied to your account, Surfshark warns that “certain online activities could be linked back to your account.”

Surfshark’s transparency report shows what that means in practice. From July to September 2026 it received 309,186 DMCA copyright notices and 23 inquiries from government institutions, and no national security letters, gag orders or warrants; it says none of them led to the disclosure of data about users’ online activity. It now publishes the report every quarter, in place of the warrant canary it used to run.

There’s also a real-world test of the policy. When India ordered VPN providers in 2022 to keep user logs for 180 days and customer data for five years, Surfshark shut down its physical servers there rather than comply, and replaced them with virtual Indian locations hosted in Singapore, the Netherlands and London. Our list of the best no-log VPNs shows how that record compares with other providers.

Has Surfshark Ever Been Hacked?

Once that has been made public, and Surfshark disclosed it itself. On 31 August 2026 its monitoring flagged suspicious activity on an internal test server that, through human error, had been left reachable from the internet. Surfshark confirmed the intrusion and contained it on 2 September, finished remediation by 5 September and published an incident report on 9 September.

The attacker reached parts of Surfshark’s system binaries, internal configurations for some services and build-related credentials that had at times been committed to its code history, as well as a separate proxy server used to optimise content accessibility. Surfshark says the test server held no user data and the proxy had no access to user identities, IP addresses, encryption keys or browsing traffic. It also says its production systems, apps and browser extensions weren’t touched, and that it rotated or retired every exposed credential.

BleepingComputer’s report of 10 September 2026 relayed Surfshark’s account and named no attacker; we found no claim of responsibility or leaked data in coverage up to 22 October 2026. Surfshark also admitted a slip: the first alert was treated as low-risk for two days because test systems hold no user data. It has promised to hold test environments to production standards and to order another independent audit of its wider infrastructure.

Surfshark says users don’t need to do anything, and the incident doesn’t contradict the no-logs reports, because the breached machines weren’t part of the VPN service. It does mean Surfshark no longer has a clean record.

Is Surfshark Safe If It’s Based in the Netherlands?

Mostly, yes, because it has little to hand over. The Netherlands belongs to the 14 Eyes, a group of countries that share intelligence (our guide to the Five, Nine and Fourteen Eyes explains it). That would matter if Surfshark stored your activity, but it says Dutch law places no obligation on it to log or retain user data, and its audited policy and RAM-only servers mean there are no activity logs to give. As an EU company, it also has to follow the GDPR for every customer, wherever they live.

If jurisdiction is your top concern, NordVPN, Surfshark’s sister company, is registered in Panama, which has no mandatory data retention law, and has passed six no-logs assessments. Our Surfshark vs NordVPN comparison weighs up the rest.

Who Owns Surfshark?

Surfshark B.V., a Dutch company at Kabelweg 57 in Amsterdam. Since early 2022 it has shared a holding company, Cyberspace B.V., with Nord Security, NordVPN’s parent, though the two VPNs keep separate apps, servers and prices.

In March 2026, former chief operating officer Dovydas Godelis took over as CEO from founder Vytautas Kaziukonis, who had led Surfshark since its 2018 launch and is now chairman of the board. Surfshark has also bought two data-removal companies, Ironwall in 2024 and Optery in September 2026, which run as separate services. Our guide to who owns Surfshark has the full story.

Is Surfshark Legit?

Yes. It’s a real company with a public address, a track record and millions of app downloads:

• A registered Dutch business: Surfshark B.V., Chamber of Commerce (KvK) number 81967985, with 500+ staff and offices in Vilnius, Kaunas, Warsaw and Berlin.
• Well-rated apps: 4.7 out of 5 from 132,766 ratings on the US App Store, and 4.6 from 318,954 ratings and 10M+ downloads on Google Play, checked on 22 October 2026. The Android app carries Google Play’s Independent Security Review badge after passing the MASA app-security assessment in December 2023 and again in January 2025.
• Industry standards: it holds the VPN Trust Initiative’s trust seal, awarded in September 2023.
• Ordinary ways to pay: cards, PayPal, Google Pay, Apple Pay and cryptocurrency (not on mobile), with a 30-day money-back guarantee on your first purchase.

Is Surfshark Good?

Yes, especially for what it costs. Every plan includes:

• Unlimited devices on one account; see how many devices Surfshark allows
• 4,500+ servers in 100 countries, all with 10Gbps ports; the Surfshark server list breaks them down
• WireGuard, OpenVPN and IKEv2, plus Dausos, Surfshark’s own protocol (macOS only for now); OpenVPN connections are obfuscated automatically
• CleanWeb, which blocks ads, trackers, cookie pop-ups and malicious sites
• Bypasser (split tunneling), Dynamic MultiHop (double VPN), Rotating IP and NoBorders for restrictive networks
• Alternative ID, a masked email address and a made-up persona for sign-ups you don’t trust
• Apps for Windows, macOS, Linux, iPhone, Android, Android TV, Apple TV and Fire TV, extensions for Chrome, Firefox and Edge, and manual setup on routers

One thing it no longer does: Surfshark retired SmartDNS on 2 February 2026, so a game console or other device that can’t run its apps needs a router or a hotspot instead. For speed, streaming and how the apps feel day to day, read our full Surfshark review.

Is Surfshark Worth the Money?

On a 2-year plan, yes. Here’s what each plan cost on Surfshark’s US site on 22 October 2026:

Shorter terms cost more: the 1-year Starter plan is $44.85 for 15 months ($2.99 a month), and month to month it’s $18.95. The catch on every plan is renewal: after the first 27 months, Starter costs $79 a year, about $6.58 a month. Our Surfshark price guide covers every plan and term.

Surfshark’s Black Friday sale, live since 12 October 2026, has made One cost the same as Starter for the first 27 months, so it’s the plan to pick right now. Our Surfshark Black Friday guide tracks the sale, and our review of Surfshark One and its antivirus explains what the upgrade adds.

When Surfshark Isn’t the Right Pick

Surfshark suits most people, but not everyone:

• You want a VPN outside the 14 Eyes, or the longest audit record. NordVPN is based in Panama, has passed six no-logs assessments, runs 7,000+ servers in 150 countries and costs $3.49 a month on its 2-year Basic plan. Our guide to whether NordVPN is worth it weighs its evidence.
• You need split tunneling on Linux. Surfshark lists Bypasser for Windows, macOS, Android, iOS and its browser extensions, but not for the Linux app.
• You only need a VPN for a few weeks. At $18.95, the monthly plan is poor value; a long plan with the 30-day guarantee costs less if you end up keeping it.
• You won’t pay at all. Surfshark has no free plan. Our list of the best free VPNs covers the safest options.

How to Try Surfshark Risk-Free

• 7-day free trial: new users get it on Surfshark’s website with a 12- or 24-month plan, paid by card, PayPal or Apple Pay. It covers up to 3 devices, and you’re charged when the 7 days end unless you turn off auto-renewal. Our Surfshark free trial guide walks through it.
• 30-day money-back guarantee: ask for a refund through live chat within 30 days of your first purchase. It covers purchases on Surfshark’s website or through Paddle, Google Play or Cleverbridge; App Store refunds go through Apple, and prepaid or gift cards, Alternative Number and anonymous dedicated IPs aren’t refundable. Here’s how to cancel Surfshark and get your money back.

Try Surfshark Risk-Free

FAQ

The Bottom Line

Surfshark is safe, legit and good value. Deloitte has checked its no-logs claim twice, its servers keep nothing on disk, and when a test server was breached in September 2026 it published the details within a week. Buy it for 2 years, take One while it costs the same as Starter, and set a reminder before the renewal at $79 or $99 a year.

Get Surfshark’s 2-year deal – or, if you want a VPN outside the 14 Eyes with a longer audit record, try NordVPN.