Surfshark Review
Last reviewed September 25, 2026 · pricing snapshot 2026-09-24/25
Evidence base: 14 linked sources — published audits, certifications, and documented pricing. No in-house lab testing. How we evaluate
Surfshark is a budget-friendly VPN for households and multi-device users who want an audited no-logs provider without paying premium-tier prices. Its strengths are a Deloitte no-logs audit, a string of independent security audits, and unlimited simultaneous devices; its weaknesses are renewal-price jumps that are the top recurring complaint, security features gated into higher tiers, and a September 2026 internal-server exposure you should know about.
What the independent audits say
No-logs assurance (Deloitte, ISAE 3000). Surfshark has completed two Deloitte no-logs audits: the first in January 2023 and a second completed June 2025, covering server configurations, deployment, SDN/API, and staff interviews. The full report is available to subscribers through the dashboard. This is the core evidence for the no-logs claim.
Independent security audits. The published record lists several: Cure53 audits of the browser extension and server architecture (historical), a SecuRing infrastructure penetration test, MASA verification for the Android app, and AV-TEST certification for Surfshark Antivirus (Protection 6/6, Performance 5.5/6, Usability 6/6). These are third-party test results reported by the company, not our own tests.
September 2026 incident. Surfshark disclosed in September 2026 that an internal engineering test server was misconfigured/exposed. The company says no customer data, IPs, traffic, or production keys were affected and commissioned an extra audit. Coverage from TechRadar and BleepingComputer is linked below. We treat this as a disclosed incident with a company claim of no customer impact — the extra audit was commissioned, and the outcome is not treated as a given here.
One honesty note: audit facts are company-published claims relayed through press or press-adjacent pages unless the underlying auditor PDF is linked. Where a source links the auditor or certification page directly, that is noted.
Pricing
Surfshark sells three tiers — Starter, One, and One+ — and the long-term promo rates are the headline.
| Tier | 2-year promo (approx.) | Renewal (approx.) |
|---|---|---|
| Starter | ~$2.49/mo | ~$79/yr |
| One | ~$2.79/mo | ~$99/yr |
| One+ | ~$4.49/mo | ~$119–149/yr |
Two add-ons matter: a dedicated IP add-on runs ~$3.75/mo, and there is a 30-day money-back guarantee on long plans. These are snapshot ranges from the retrieval date.
Read the renewal line before you buy. The 2-year promo rate is the initial-term price; renewal jumps to the annual rate — roughly a 45–100% increase versus the promo, and the top recurring complaint on record. Verify current pricing on the official page before you commit.
Read the renewal line before you buy — the promo rate applies to the initial term only. Verify current pricing on the official page.
Tracker: pending affiliate registration — this link is the vendor's direct page until the IncomeGenius CJ property goes live.
Where it falls short
- September 2026 internal-server exposure. An engineering test server was misconfigured/exposed. The company states no customer data, IPs, traffic, or production keys were affected and says it commissioned an extra audit. The incident is disclosed in linked coverage; the extra audit's outcome is not assumed here.
- Renewal-price jumps. The ~45–100% jump from promo to renewal pricing is the top recurring complaint on record.
- Shared-IP CAPTCHAs. Because IPs are shared, some sites trigger CAPTCHA checks — a known annoyance of shared-IP VPNs.
- Feature gating. Security features are gated into the One and One+ tiers, so the cheapest plan (Starter) is a bare VPN without the extras.
Who should (and shouldn't) use it
Use it if you want a no-logs VPN with an audit trail at a lower price point, you need unlimited simultaneous devices for a household, and you're fine with a Netherlands-based provider (Surfshark B.V., Amsterdam).
Jurisdiction and privacy posture. Surfshark B.V. is registered in Amsterdam (KvK 81967985) and moved there from the British Virgin Islands on October 1, 2021. The Netherlands is a 9-Eyes member, but the published record notes there is no mandatory VPN data retention and that GDPR applies. As with any Netherlands-based VPN, the no-logs claim — audited twice by Deloitte — is the load-bearing part of the privacy posture.
Skip it if renewal-price jumps will bother you, if you're sensitive to the September 2026 incident and prefer to wait for the commissioned audit results, or if you want the security extras without paying for the higher tiers. As with everything on this page, this is audit- and dataset-sourced guidance, not a first-hand test.
Where to next
- Compare with ExpressVPN: the NordVPN vs ExpressVPN comparison.
- Same vendor family: the NordVPN review and the NordPass review.
- All password managers compared.
- How to delete yourself from the internet — the next privacy step.
Sources
Every claim above traces to the published sources below (retrieved 2026-09-24/25). Pricing is a snapshot and must be re-verified on the official page.
- Surfshark blog — Deloitte audit (no-logs)
- Surfshark features — no-logs
- Surfshark Trust Center
- Surfshark blog — antivirus certification
- AV-TEST — Surfshark
- Wikipedia — Surfshark B.V.
- Surfshark support — where is Surfshark located
- Surfshark blog — VPN plans
- Security.org — Surfshark
- Surfshark official pricing
- TechRadar — Surfshark September incident
- BleepingComputer — Surfshark internal testing proxy breach
- CNET — Surfshark review
- Surfshark affiliate terms