Surfshark is a real VPN company, Surfshark B.V., with an Amsterdam address and a trust center that names its audits, including Deloitte for its no-logs policy. Those are the vendor's own claims, and a VPN can't protect you from everything. Download only from official sources and treat it as one privacy tool, not a shield.
If you're thinking of installing a VPN, you've probably seen Surfshark in a thousand ads and wondered who is behind it. I've gone through Surfshark's own trust center, its pricing and about pages and what Wikipedia records, and I've kept to what the company and public sources say rather than guessing.
Who makes Surfshark and where is it based?
Surfshark's footer names Surfshark B.V., with a registered address in Amsterdam, in the Netherlands. Its trust center says the company is based in the Netherlands and that Dutch law doesn't oblige it to log or retain user data. It also says that, being based in an EU country, it complies with the GDPR for all customers.
According to Wikipedia, the company was founded in Lithuania and launched its first VPN app in 2018. Surfshark's own timeline also begins in 2018, and says it merged with Nord Security in 2022. Wikipedia adds that both brands continue to operate independently, so it isn't an unknown startup hiding behind a logo.
What Surfshark says about its no-logs policy
Every VPN says it doesn't keep logs, so the question is who has checked. Surfshark's trust center says Deloitte confirmed it adheres to the commitments in its no-logs policy, with reports for 2023 and 2025. It says the full report is available to users inside their account.
Please keep one distinction in mind. An assurance report is a third party looking at whether a company follows its stated policy, and the vendor is the one publishing the result. It's better than a bare promise, but it isn't a guarantee of what happens on every server every day.
Security checks and server design
Beyond no-logs, Surfshark's trust center lists infrastructure assessments. It names Cure53 in 2026, covering its infrastructure and a new protocol it calls Dausos, and SecuRing in 2025. Its timeline says its first independent audit by Cure53 happened in 2018.
It also says its servers are 100% RAM-only, which it explains as meaning all data is wiped with every server reboot. Wikipedia says the apps use IKEv2, OpenVPN and WireGuard, with AES-256-GCM encryption.
| What I checked | What Surfshark's own pages say |
|---|---|
| Who is the company? | Surfshark B.V., Amsterdam |
| Where is it based? | The Netherlands, per its trust center |
| Has anyone audited the no-logs claim? | Deloitte, with reports for 2023 and 2025 |
| Any infrastructure checks? | Cure53 in 2026 and SecuRing in 2025 |
| How are the servers built? | 100% RAM-only, per its trust center |
Has Surfshark had problems?
Wikipedia describes no breaches or security incidents for Surfshark. It does record one policy decision: in 2022 Surfshark closed its physical servers in India in response to an order from CERT-In, the country's cyber agency, which required VPN companies to store consumer data for five years. In plain terms, the company chose to remove servers rather than keep that data. Wikipedia also carries maintenance notes about promotional tone and company-linked sources, so I've leaned on the trust center and Wikipedia together, not either alone.
Refunds and what you pay for
Surfshark advertises a 30-day money-back guarantee on its pricing page. It sells longer plans with sale prices, and the renewal price is whatever applies when your plan renews, so check the renewal terms and your account billing page before you buy. I haven't quoted prices because they change often.
On reach, the company advertises 4500+ servers in 100 countries. More servers don't make a VPN safer, but they do explain why it's popular and why speeds can vary by location.
What a VPN can't do
Even a trustworthy VPN has limits, and Surfshark's own pitch is about privacy, not total security.
Want AI doing the heavy lifting in your marketing?
I build the systems that handle the boring 80 percent, so you get your week back. Done properly, with the human kept in.
- It hides your traffic from your network and your internet provider, not from the site you log in to.
- It won't stop you being phished or downloading malware.
- It won't make a weak password strong; a password manager does that job, and my password manager review shows what to look for.
- Some services restrict VPN use in their terms, so check the rules before you rely on one for a specific site.
If you're torn between brands, my comparison of Surfshark and NordVPN covers the differences.
Fake Surfshark apps and scams
VPN names are heavily copied. To stay safe:
- Download Surfshark only from its official website or the official app store for your phone or computer.
- Don't install a cracked or modded version offered on a forum or a file-sharing site; that is a common way to catch malware.
- Ignore pop-ups, calls or messages claiming to be Surfshark support that ask for remote access or card details.
- Use the help centre on the official site, and contact support only through it.
If you ever suspect an account has been taken over, my guide on checking whether an account was hacked shows the warning signs to look for.
My verdict on Surfshark
It's a real, named company with an Amsterdam address and a set of named audits behind its privacy claims, so I wouldn't call it unsafe. But those claims come from the vendor's own trust center, a VPN only covers part of your privacy, and it's worth knowing how the refund window works before you pay. Download it from official sources and use it alongside a strong password and a cautious eye on links.
Frequently asked questions
Is Surfshark a real company?
Yes. Its footer lists Surfshark B.V. with an address in Amsterdam, and Wikipedia says it launched its first VPN app in 2018.
Has Surfshark's no-logs policy been checked?
Surfshark's trust center says Deloitte confirmed it follows its no-logs policy, with reports for 2023 and 2025. Those are the vendor's published claims.
Who owns Surfshark?
Wikipedia says Surfshark merged with Nord Security, whose parent company also owns NordVPN, and that both brands continue to operate independently.
Does Surfshark offer refunds?
It advertises a 30-day money-back guarantee on its pricing page. Check your account billing page for the exact renewal terms.
Can I trust a VPN with everything?
No. A VPN hides your traffic from your network and internet provider, but it won't stop phishing, malware or weak passwords.
