Is Surfshark VPN Safe in 2026?

The short verdict

I would be comfortable using Surfshark for normal privacy needs: hiding my public IP from websites, protecting traffic on public Wi-Fi and reducing what an ISP can see about the contents of a connection. The unlimited-device model also makes it practical for a household. I would not describe it as an anonymity tool, because account logins, browser fingerprints, cookies and payment records can still identify a person.

Privacy and logs: the part people usually skim too quickly

I rechecked Surfshark’s current privacy policy for this update. It says Surfshark does not collect visited IP addresses, browsing history, session information, connection timestamps, used bandwidth, network traffic or similar records about what a user does online. That is the core no-activity-log claim.

The detail I would not skip is the short-lived connection record. Surfshark says its servers temporarily keep a user ID and/or IP address plus timestamps relating to the connection to a specific VPN server, then automatically delete that information within 15 minutes after the session ends. That is not a browsing-history log, but it means the phrase “no logs” needs a little more precision than the headline suggests.

Surfshark B.V. is based in the Netherlands. I do not treat EU jurisdiction as an automatic privacy negative: Surfshark’s current Trust Center says Dutch law does not impose mandatory VPN logging or retention. The more useful question is what data exists when a valid order arrives — and the April 2026 warrant gives us a real example of that.

Audits and outside checks

The audit record is one of the main reasons I take Surfshark’s privacy claims seriously. Deloitte’s second no-logs assurance report was dated 10 June 2025. Its conclusion covered the configuration of Surfshark’s IT systems and supporting operations against Surfshark’s no-logs description as of that date. That is useful evidence, but I treat it as a point-in-time assurance report rather than a permanent certificate.

Surfshark also added more technical assurance in 2026. Cure53 carried out a white-box penetration test and source-code audit focused on the architecture and cryptography of the new Dausos protocol in February and March 2026. The public summary describes the platform as stable and resilient and reports no critical vulnerabilities or significant flaws. I keep that separate from the Deloitte work because a protocol audit and a no-logs assurance engagement answer different questions.

Server security, RAM-only design and network size

Surfshark still lists 4,500+ servers in 100 countries, so the July network figure remains current. I care more about the infrastructure model than the headline count, but a broad network does make it easier to choose a nearby endpoint and avoid a crowded location.

The more important privacy point is Surfshark’s claim that the network is 100% RAM-only. Data that would otherwise be written to a disk is designed to disappear when a server is powered off or rebooted. I count that as a useful defence against persistent server-side data, while still treating the logging policy and access controls as separate issues.

Surfshark says every server has at least a 10Gbps port, with some high-traffic capacity reaching 100Gbps. That is mainly a performance detail, not a privacy guarantee. The RAM-only design matters more for this page because it reduces persistent storage on the VPN endpoints themselves.

Dausos, WireGuard, OpenVPN and post-quantum protection

Dausos is now a real Surfshark protocol rather than a roadmap item. Our separate guide to Surfshark’s Dausos protocol explains it in more detail. Surfshark says it uses AEGIS-256X2, post-quantum key exchange, dedicated tunnels and adaptive performance features, and Cure53 assessed its architecture and cryptography in March 2026. I treat the “up to 30% faster” figure as a provider performance claim rather than a security result.

The platform limitation has not changed by September. Surfshark’s current documentation still says Dausos is available only on macOS, with other platforms coming later. Most users will therefore continue to use WireGuard, OpenVPN or IKEv2. Surfshark’s current encryption page says post-quantum protection is enabled by default in its WireGuard implementation too, so Dausos is not the only route to post-quantum protection inside the app.

Security features that matter day to day

I would not score Surfshark’s safety by counting features. The kill switch matters most because it blocks internet access if the VPN tunnel drops. Surfshark currently supports the kill switch on Windows, macOS, Android, iOS and Linux. We also have a separate visual explainer on how a VPN kill switch works if you want the mechanics without the jargon.

CleanWeb and Dynamic MultiHop are useful extras, but neither replaces the core tunnel, kill switch or good account security. I would also recheck leak behaviour after a major app or operating-system update rather than assume a setting works forever because it worked once.

Bypasser: helpful, but easy to misuse

Bypasser is Surfshark’s split-tunnelling feature. Current support material lists it on iOS, Android, Windows, macOS and the browser extension. It can let selected apps or websites avoid the VPN while the rest of the device stays routed through the tunnel. For a separate guide, see how split tunnelling works.

From a safety point of view, Bypasser is neither good nor bad by itself. It depends how you use it. Excluding a banking app because it blocks VPN traffic may be sensible. Excluding your browser because one website was annoying can accidentally remove the protection you wanted in the first place.

NoBorders, OpenVPN obfuscation and restricted networks

Surfshark’s NoBorders feature is designed for networks that restrict VPN traffic. Surfshark says it detects restricted networks and gives you a server list that should work better in that situation. Obfuscation matters here because it makes VPN traffic harder to identify. Our separate guide explains how obfuscated servers work in more detail.

NoBorders and obfuscation can help on networks that interfere with ordinary VPN traffic, but I would not describe either as invisibility. Network operators may still identify or block VPN use, and local rules still apply.

Transparency reporting and the old warrant canary question

Surfshark previously used a warrant canary. It now says it is moving away from that indirect signal and replacing it with fuller transparency reporting. That is a reasonable change if the report stays clear, current and specific. If you want the background, read our guide to how warrant canaries work.

Surfshark’s current report now covers April to June 2026. It lists 374,719 DMCA requests, 33 inquiries from government institutions, 0 national security letters, 0 gag orders and 1 warrant. Surfshark says none of the requests resulted in disclosure of data about users’ online activity.

The warrant is the most useful transparency event on the page because it shows what “no logs” means under real legal pressure. Surfshark says it complied with an Amsterdam District Court warrant in April 2026 and disclosed the account’s existence plus payment-related information because that was the data it had. It says it could not provide online-activity records because it does not collect or store them. That is more informative than a warrant canary alone.

Account safety, payment trail and Dedicated IP caveats

Surfshark can secure the tunnel, but it cannot compensate for a reused password or compromised account. I would enable two-factor authentication and use a unique password before worrying about marginal differences between protocols.

The April 2026 warrant is also a reminder that account and payment data exist even when browsing logs do not. Surfshark’s privacy policy says account creation involves an email address and encrypted password, while payment partners can process transaction and card-related information. A normal Surfshark subscription is therefore not anonymous by default.

Dedicated IP needs its own privacy caveat. Surfshark’s current terms say a Dedicated IP is linked to the account email unless the user selects the anonymous Dedicated IP option after setup. That option removes Surfshark’s database link between the account and the Dedicated IP, after which the user has to retain the setup information themselves.

A safer Surfshark setup in five minutes

• Turn on the kill switch before using public Wi-Fi.
• Use WireGuard by default; on macOS, Dausos is another reasonable option if it behaves well on your connection.
• Enable CleanWeb, then still treat suspicious pages as suspicious.
• Use Bypasser only for specific apps or websites that genuinely need it.
• Turn on two-factor authentication and avoid reusing your email password.
• Run DNS, WebRTC and IP leak checks after installing the app and after major updates.

September 2026 update

I rechecked this page on 3 September 2026 against Surfshark’s current privacy policy, Trust Center, Deloitte assurance material, Cure53 Dausos assessment, server pages, protocol documentation, feature support and transparency report.

• Updated the transparency section from Q1 to Q2 2026 and added the April Amsterdam District Court warrant outcome.
• Confirmed the 15-minute temporary connection-data wording remains in Surfshark’s current privacy policy.
• Confirmed the network remains 4,500+ servers in 100 countries and is still described as 100% RAM-only.
• Confirmed Dausos is still limited to macOS, while Surfshark’s WireGuard implementation also includes post-quantum protection.
• Clarified the difference between the 2025 Deloitte no-logs assurance and the 2026 Cure53 Dausos/architecture assessment.
• Updated Bypasser platform support to iOS, Android, Windows, macOS and browser extensions.