Is Surfshark Safe? The 2026 Forensic Security Audit
A proper trust check, not just another VPN sales page.
Quick answer: yes, Surfshark is safe enough for most people who want a modern VPN for private browsing, safer public Wi-Fi use, streaming, and general day-to-day protection. For a wider hands-on view of pricing, apps, speeds, and streaming, read our full Surfshark VPN review. On safety alone, Surfshark still does a lot right. The strongest points are repeated external audits, strong protocol support, RAM-only server claims, practical security features, and better transparency than the average cheap VPN. The main caveat is that Surfshark's privacy story is more nuanced than the homepage slogan. The company says it does not keep logs of your online activity, but its support material also says servers temporarily keep limited connection details and remove them within 15 minutes after your session ends.
What looks good
Surfshark has a stronger trust case than a lot of mid-priced rivals. The mix of independent audits, clear documentation, RAM-only infrastructure, account security features, and a modern protocol stack gives it a solid safety baseline.
What needs context
Surfshark is safe, but it is not a flawless privacy machine. The current no-logs wording, short-lived connection data, and April 2026 warrant disclosure all deserve plain-language explanation.
Bottom line
For most users, Surfshark remains one of the safer mainstream VPNs. For privacy purists, the real answer is still yes, but only with a careful reading of the policy and trust material.
What Surfshark Gets Right
Surfshark's safety case is not built on one flashy claim. It comes from several things stacking up at once. It supports modern VPN protocols, offers account 2FA, publishes more trust material than most rivals, and includes genuinely useful extra features such as NoBorders, Dynamic MultiHop, Bypasser, and rotating IP. That makes it feel like a serious security product rather than a bare VPN tunnel with a polished website.
The short version
If you judge a VPN by whether it looks serious in day-to-day use, Surfshark passes that test easily. It covers the basics well and then adds a deeper feature set on top, which is not something you usually get at its price level.
- It supports WireGuard, OpenVPN, IKEv2, and the newer Dausos protocol on supported macOS App Store builds.
- It offers a kill switch on the main desktop and mobile apps.
- It gives you account-level 2FA and recovery codes.
- It includes NoBorders for restrictive networks and Dynamic MultiHop for users who want two-hop routing.
- It says its whole VPN network is RAM-only, which is a meaningful design choice rather than just another marketing badge.
- It has added more recent external review points, including a 2026 SecuRing infrastructure audit and a Cure53 assessment of Dausos.
No-Logs Claims and Audit Timeline
This is where Surfshark looks strongest, but it is also where accuracy matters most. Surfshark says it does not log what you do online, which means no browsing history, traffic content, or destination activity records. Deloitte has independently reviewed the no-logs policy more than once, including a 2025 verification that looked at systems, internal processes, server types, deployment processes, privacy-related settings, and whether the no-logs policy was applied across relevant infrastructure.
The current support wording adds an important nuance. Surfshark says online activities are not logged, but it also says servers can temporarily store information about your connection to a particular VPN server, including user ID and or IP address plus connection timestamps. Surfshark says this information is automatically deleted within 15 minutes after the session ends. That is still far better than retaining browsing behaviour, but it is not the same thing as saying that absolutely nothing operational ever touches the system.
2018
Cure53 audited Surfshark's browser extensions.
2021
Cure53 audited Surfshark's server infrastructure and found no significant concerns.
2023 and 2025
Deloitte verified Surfshark's no-logs commitments twice, with the latest public write-up updated in November 2025.
2026 infrastructure
SecuRing completed an independent infrastructure security audit. Surfshark said no critical vulnerabilities and no high-risk issues affecting user security were identified.
2026 Dausos
Cure53 independently assessed Surfshark's newer Dausos protocol, which is currently a macOS App Store app feature rather than a universal platform feature.
Still not magic
Audits are useful, but they are snapshots. A safe VPN still needs continuing verification, app updates, clear policies, and user-side leak testing.
What that really means
Surfshark's audit history is better than what most VPNs can show. The honest reading is not "zero data of any kind ever exists". The honest reading is "there is external evidence that Surfshark does not keep logs of online activity, and the company is unusually open about the small amount of short-lived connection data used to operate the service."
Breach History and Transparency
Surfshark says it has never had a data breach. That is the company's current public position, and it still matters because breach history is one of the quickest ways to judge whether a VPN provider's trust story keeps falling apart under pressure.
The bigger 2026 update is transparency. Surfshark now publishes quarterly request numbers and has moved away from relying on a warrant canary alone. For January to March 2026, Surfshark reported 361,451 DMCA requests, 30 inquiries from government institutions, and zero national security letters, gag orders, or warrants from government organisations during that reporting period. Surfshark also added an April 14, 2026 update saying it fulfilled a legally binding warrant from the Amsterdam District Court. According to Surfshark, the only information it could disclose was confirmation of the account's existence and payment-related information, not browsing activity or traffic logs.
Breach record
Surfshark's own public statement is that it has never had a data breach.
Legal requests
The April 2026 warrant update is important. It shows that Surfshark can be compelled to provide account and payment-related information it has, even if it cannot provide stored browsing activity logs.
Reporting model
Quarterly transparency reporting is more useful than relying on a warrant canary alone, because it gives readers clearer numbers and concrete legal-request context.
One extra trust note
Separate from technical security, public billing and auto-renewal complaints can still affect how some users judge the brand. That is not the same thing as a breach, leak, or VPN tunnel failure, but it belongs in the wider trust picture if you are judging the company as a whole.
Security Features, Protocols, and Server Design
Surfshark's protocol picture has changed since older versions of this article. It still supports WireGuard, OpenVPN, and IKEv2, but there are platform details worth getting right. Surfshark now also promotes Dausos, its proprietary post-quantum protocol, currently available through the macOS App Store version of the app. Surfshark also says WireGuard now includes post-quantum protection by default on macOS, Android, and Linux, while IKEv2 is no longer directly available in the Surfshark Windows app and must be set up manually through Windows built-in VPN settings.
Protocol choice
WireGuard, OpenVPN, IKEv2, and Dausos give users a healthy mix of speed, maturity, flexibility, and newer post-quantum claims.
OpenVPN obfuscation
Surfshark's support material has stated that OpenVPN uses obfuscated servers, which is a real plus on networks that interfere with obvious VPN traffic.
NoBorders and MultiHop
NoBorders helps on restrictive networks, and Dynamic MultiHop gives users two-hop routing without forcing them into fixed server pairs.
Surfshark also says its network is fully RAM-only, which reduces the risk of persistent data sitting on hard drives. Add the kill switch, Bypasser split tunnelling, rotating IP, and account 2FA, and the service ends up looking stronger on real-world protection than a lot of mainstream rivals.
Why this matters in practice
What makes Surfshark feel modern is not just the encryption. It is the way the support features join up. You get protocol flexibility, some stealth capability, stronger account protection, and more than one layer of defence against everyday leaks and restrictions.
Dausos and Post-Quantum Protocol Update
Dausos is the biggest new technical update since this article was first drafted. Surfshark describes it as a proprietary VPN protocol built for consumer VPN use, with dedicated private data tunnels, post-quantum cryptography, and AEGIS-256X2 encryption. Cure53 has independently assessed Dausos, which is a positive sign.
The caveat is availability and maturity. Dausos is currently for Surfshark's macOS app from the App Store, not the website .dmg installer, and it is not yet a normal everyday option across Windows, iOS, Android, Linux, and routers. That means it should be treated as promising, not as the main reason everyone should trust Surfshark today. For most users, WireGuard and OpenVPN remain the more proven defaults.
My take on Dausos
Dausos improves Surfshark's technical story, especially because it has been externally assessed, but a new VPN protocol still needs time, platform coverage, and real-world scrutiny. I would treat it as an encouraging extra, not as a replacement for the broader audit and transparency case.
Jurisdiction and Ownership
Surfshark is based in the Netherlands through Surfshark B.V. For most users, that is a respectable jurisdiction and not an automatic privacy red flag. Surfshark's own security pages frame the Netherlands as a favourable place to operate because there are no mandatory data retention laws for its service model.
Ownership also matters. Surfshark merged with Nord Security in 2022, but both brands say they still operate as autonomous companies with separate infrastructures and product development. That does not erase the need for scrutiny, but it does matter when people worry that one shared holding group means one shared VPN backend.
My take on this
The Netherlands is a plus, but not the whole story. What lifts Surfshark above the average VPN pack is not jurisdiction on its own. It is the combination of location, audits, better documentation, transparency updates, and a more mature security design.
What Still Holds Surfshark Back
Surfshark is strong overall, but there are still a few things that stop it from being a perfectly clean trust story.
- The no-logs wording needs adult reading: the company does not log your online activity, but the support wording still describes short-lived connection data being kept temporarily.
- Legal requests can still reach account records: the April 2026 warrant update shows that account existence and payment-related information can be disclosed when legally required.
- Dausos is promising but new: a fresh protocol needs time and wider platform coverage before it becomes a settled trust advantage for everyone.
- Feature-rich services always need more testing: when a provider offers lots of extras, there are simply more moving parts to maintain cleanly across apps and platforms.
- Trust goes beyond encryption: even if the VPN tunnel looks good, things like billing complaints, renewal terms, and policy changes still affect how some users view the brand.
- You should still test your own setup: no matter how many audits a provider has, smart users still run IP, DNS, WebRTC, and kill switch checks on their own devices.
Best fit
Surfshark is a strong fit for people who want a capable all-round VPN with lots of practical extras. It is especially good for users who care about ease of use but still want more than the bare minimum.
Final Verdict
So, is Surfshark safe?
Yes, with honest caveats. Surfshark is one of the safer mainstream VPNs you can buy. The service gives you a stronger audit trail than most rivals, a cleaner server design than most rivals, and a deeper security toolkit than most rivals. The April 2026 transparency update does not undermine the no-logs claim, but it does make the account-data distinction clearer: Surfshark may not have browsing logs to hand over, but account existence and payment-related information can still exist. That is normal for many paid VPNs, but it should be stated plainly.
Frequently Asked Questions
Is Surfshark safe for banking and public Wi-Fi?
Yes. For ordinary use on cafés, airports, hotels, and shared networks, Surfshark is a sensible extra layer of protection. It does not replace good account security, but it does reduce easy network snooping.
Does Surfshark really keep no logs?
Surfshark says it does not log your online activity, and Deloitte has verified that policy. The nuance is that Surfshark's support wording also describes limited connection details being held temporarily and removed within 15 minutes after the session ends.
Has Surfshark ever had a data breach?
Surfshark's public statement is that it has never had a data breach. That is the current official position, and it is one of the reasons the service still looks comparatively strong in trust terms.
Did Surfshark hand over user data in 2026?
Surfshark's April 2026 transparency update says it fulfilled a legally binding Amsterdam District Court warrant and disclosed the specific user's available data. Surfshark says that meant account existence confirmation and payment-related information, not online activity logs.
Can Surfshark hide the fact that I am using a VPN?
Sometimes, yes. Surfshark says its OpenVPN implementation uses obfuscated servers, and it also offers NoBorders for restrictive networks. That does not mean it will beat every hostile network, but it is better prepared than many mainstream VPNs.
Does Surfshark have a post-quantum protocol?
Yes. Surfshark now promotes Dausos as a proprietary post-quantum VPN protocol, and it also says WireGuard includes post-quantum protection on selected platforms. Dausos is currently limited to the macOS App Store app, so most users should still treat WireGuard and OpenVPN as the practical everyday choices.
Is the Netherlands a good jurisdiction for a VPN?
Generally yes. For a VPN business, it is a respectable jurisdiction and Surfshark presents it as a place without mandatory data retention laws for its service model. It is a plus, though not the whole trust story on its own.
This information is for educational purposes. VPN apps, privacy policies, audit reports, transparency reports, and support pages can change. Always test your own setup for IP leaks, DNS leaks, WebRTC leaks, protocol behaviour, and kill switch performance before relying on any VPN for privacy-sensitive work.
Editorial Updates
Updated 14 May 2026: refreshed the article to reflect Surfshark's latest public transparency reporting, including the January to March 2026 request figures and the April 2026 Amsterdam District Court warrant update. The article now makes a clearer distinction between no browsing activity logs and account or payment-related information that may still exist.
Protocol update: added Dausos, Surfshark's newer post-quantum protocol, and clarified that it is currently available through the macOS App Store version of the app rather than across every Surfshark platform. Also updated the protocol section to mention Surfshark's current positioning of WireGuard post-quantum protection on selected platforms and the Windows IKEv2 limitation.
Audit update: added the January 2026 SecuRing infrastructure audit and Cure53's Dausos assessment to the audit timeline, while keeping the Deloitte no-logs verification and short-lived connection-data caveat in plain language.
Buying context: for a broader view of Surfshark's value, app experience, streaming performance, and renewal considerations, see our updated Surfshark VPN review.