Surfshark review: cost, safety record and platform limits

Our assessment

Surfshark is a good fit if you want one subscription for many devices at a fully stated price: Starter costs $67.23 for the first 27 months, then $79.00 a year, before tax. Its documented Bypasser also routes apps outside the VPN on supported Macs. On safety, Surfshark’s terms say it keeps no activity logs, it cites two Deloitte assessments of that policy and recent Cure53 and SecuRing security tests, and it says its servers run on RAM only.

The limits are platform-specific. On iPhone, Bypasser excludes websites, not apps. Linux is absent from the Bypasser platform list. The Kill Switch setup guide shows a single on/off control, so the two protection modes on Surfshark’s feature page are not confirmed for every system.

This is a documentation-based review of features, pricing and policies, checked on 13 October 2026. We have not run speed, streaming, DNS leak or app usability tests for The VPN Deal, so there is no score here and no performance claim. Whether Surfshark is good for you depends on the devices you use and the controls you need.

Plans, prices and renewals

Surfshark sells three plans: Starter, One and One+. On the 27-month term (24 months plus 3 extra), Starter costs $67.23 upfront, a monthly equivalent of $67.23 ÷ 27 = $2.49, and renews at $79.00 every 12 months. Keeping it through the first renewal costs $67.23 + $79.00 = $146.23 for 39 months, before tax. One costs the same $67.23 today but renews at $99.00 a year, or $166.23 over 39 months. One+ renews at $119.00 a year; its first payment is part of a Surfshark A/B price test and showed $121.23 or $107.73 for 27 months in our check.

The renewal amounts come from Surfshark’s renewal table, checked from a US connection on 13 October 2026, and the yearly renewals were the same in every price group we saw. Surfshark’s billing page says plans renew automatically at the full price, that it emails a reminder 30 days before (not for monthly plans) and that displayed renewal prices may be subject to testing. The 15-month and 1-month prices also vary by group. Our Surfshark price guide lists every term, and the Surfshark coupon guide explains why no code is needed.

Starter is the VPN itself, with CleanWeb ad and cookie pop-up blocking, Bypasser, Rotating IP and Dynamic MultiHop, plus Alternative ID for masked email addresses and personal details. One adds Antivirus, Alert, Search and scam protection; Search appears in Surfshark’s renewal table and plan-options article but not on the pricing-page card. One+ adds identity theft coverage of up to $1 million for US residents outside New York State, and Incogni data removal. Surfshark lists cards, PayPal, Google Pay, Apple Pay and cryptocurrency as payment options; cryptocurrency can’t be used on mobile devices.

Unlimited devices and supported apps

Surfshark documents unlimited simultaneous device connections on every plan. It lists apps for Windows, macOS, Linux, Android, iOS, Android TV, Apple TV and Fire TV, plus extensions for Chrome, Firefox and Edge. Devices without an app, such as some consoles, can be covered through a compatible router or a manual connection.

The allowance suits a household with many active devices, with practical limits. Every device still shares your home connection, and we have not measured Surfshark’s throughput with several devices connected, so we cannot promise a particular speed. A browser extension covers browser traffic within its scope; it does not route the device’s other apps through the VPN.

Bypasser on Windows, Android, Mac and iOS

Surfshark calls its split-tunneling feature Bypasser. Current documentation supports app and website rules on Windows, Android and supported macOS versions. The Mac feature needs approval of a system extension and does not support Big Sur, and Surfshark’s current Mac setup guide requires macOS 12 or later.

On iOS, Bypasser excludes websites rather than entire apps, and Surfshark’s article on CarPlay and Android Auto confirms that app bypassing is not supported there. That can help with a site that misbehaves through the VPN, but it is not per-app routing. Linux is not listed for Bypasser at all, so Linux users who need app rules should compare PIA, which documents desktop app routing on Linux.

Reverse Bypasser works the other way, sending only selected traffic through the VPN: apps and websites on Android, apps only on Windows. Traffic outside the tunnel loses the VPN’s protection, even though HTTPS still encrypts the connection to a website.

Kill Switch and Dynamic MultiHop

Surfshark documents Kill Switch on Windows, macOS, Android, iOS and Linux. Its feature page distinguishes soft protection after an unexpected disconnect from strict protection whenever the VPN is off, including a manual disconnect. The setup guide shows a single on/off control, so it does not establish that every operating system offers both modes. Check your app’s actual setting before relying on a particular behavior: a network drop, a manual disconnect and quitting the app are separate events.

Dynamic MultiHop routes a connection through two VPN servers and is documented on Windows, macOS, Android and iOS. That differs from PIA’s proxy-based Multi-Hop. An extra hop adds complexity and may affect speed; without testing, we cannot claim it is faster, necessary for everyone or a guarantee of anonymity.

Is Surfshark safe? Logging policy and audits

Logging policy. Surfshark’s terms of service say it does not collect information about what you do online, naming visited IP addresses, browsing history, session information, used bandwidth, connection timestamps and network traffic. For abuse prevention, its servers do store your user ID or IP address and connection timestamps, which the terms say are automatically deleted within 15 minutes after your session ends.

No-logs assessments. Surfshark has announced two Deloitte assessments of its no-logs policy. The first, announced on 25 January 2023, covered server configuration and deployment, the VPN infrastructure API, the software-defined network and staff interviews. The second, announced on 16 June 2025, followed the ISAE 3000 standard and covered standard, static and multiport VPN servers. The full reports are available only inside a Surfshark account; we have not read them and cannot state the report type or the period covered.

Security tests. Surfshark’s trust center links these independent tests:

• Cure53, summary dated March 2026: a penetration test and source-code audit of Dausos, Surfshark’s new VPN protocol, covering its architecture and cryptography. The summary lists 10 findings; the most severe were in the hosting environment, which was out of scope, and the in-scope findings were rated Medium or lower. The trust center describes the work more broadly, as covering “infrastructure and new protocol Dausos”.
• SecuRing, December 2025: a network infrastructure penetration test (testing 1–10 December, report 12 December) with no critical findings and one medium.
• SecuRing, February to April 2025: tests of the web, desktop (Windows, macOS, Linux) and mobile (Android, iOS) apps and the browser extensions, summarized in an attestation letter dated 9 June 2025.
• Older Cure53 audits: infrastructure in 2021, which the trust center says found no significant concerns, and the browser extensions in 2018.

Audits describe what was examined at one point in time. They do not prove that every app version or server is free of problems, and we have not tested logging or leaks ourselves.

Servers. Surfshark states that it runs “100% RAM-only servers”, with all data wiped on every server reboot, and its company timeline dates the move to 2020. Its server page lists “4500+ servers in 100 countries” with 10Gbps ports. These are Surfshark’s own figures, which we have not verified independently.

Who owns Surfshark: the Nord Security merger

Your contract is with Surfshark B.V., registered in Amsterdam, the Netherlands. Its terms nevertheless say the contract is governed by the laws of the British Virgin Islands, “the same as it was before we moved to the Netherlands”, while your own country’s mandatory consumer law still applies. Payments are processed by Surfshark Limited in London and Surfshark Inc. in California, and Surfshark lists offices in Vilnius, Kaunas, Warsaw and Berlin.

On 1 February 2022, Surfshark announced a merger with Nord Security, which owns NordVPN. The announcement said the two would “continue to operate as autonomous companies relying on separate infrastructures and different product development plans”, and Surfshark’s about page now says they merged under one holding company while operating independently. Surfshark does not name that holding company. Founder Vytautas Kaziukonis is now chairman of the board, and Dovydas Godelis is chief executive. Our guide to who owns Surfshark covers the details.

Free trial, refunds and support

Free trial. The 7-day trial for new users runs through Surfshark’s website on the 12- and 24-month terms and needs a card, PayPal or Apple Pay. The pricing page shows $0.00 due today, and the trial covers up to 3 devices; unless you turn off auto-renewal before day 7, the plan price is then charged. During the trial you cannot change the account email or two-factor settings. No app-store trial is documented, and there is no free plan. Our Surfshark free trial guide has the steps.

Refunds. The 30-day money-back guarantee covers the first purchase and starts when a trial converts, for up to 37 days in total. It allows one refund per service and excludes recurring payments, so renewal charges are not covered. Apple and Amazon purchases follow those stores’ procedures, Google Play handling depends on timing, and prepaid or gift-card payments, the anonymous Dedicated IP and paid Alternative ID services are non-refundable. Canceling auto-renewal (account, then Subscription, then Payments) keeps access until the paid term ends and does not request a refund.

Support. Refunds are requested through Surfshark’s live chat, and its help center publishes the platform guides this review relies on, from Bypasser and Kill Switch setup to cancellation. We have not assessed response times or the quality of answers.

When another provider fits better

• Linux app routing: Bypasser is not listed for Linux. PIA documents app rules on Windows, Mac and Linux.
• Whole-app routing on iPhone: Surfshark’s iOS Bypasser handles websites only.
• Closing selected Windows programs: NordVPN documents a Windows App Kill Switch that closes chosen programs. Its Basic plan costs $94.23 for 27 months, $27.00 more than Surfshark Starter, and allows 10 devices.
• A smaller first payment: PIA’s offer collects $46.54 for 26 months ($1.79 a month equivalent), $20.69 less than Surfshark today, though its deal page does not show the renewal amount.
• A longer first term: PrivateVPN charges $72.00 for 36 months ($2.00 a month), then $72.00 a year, but allows 10 devices and has no split tunneling in its apps.

If none of those applies and you need many devices covered, Mac app routing or iPhone website exclusions, the documentation supports Surfshark. NordVPN vs Surfshark sets out the closest comparison in detail.

Common questions

Is Surfshark good?

It is a good fit if you want unlimited simultaneous devices, Mac app routing with Bypasser or website exclusions on iPhone, at $67.23 for the first 27 months and $79.00 a year after that. It is a weaker fit if you need app routing on Linux or iPhone. We have not tested its speed or streaming, so this judgment rests on documented features and prices.

Is Surfshark safe?

Surfshark’s terms say it keeps no activity logs, and it cites two Deloitte assessments of that policy plus Cure53 and SecuRing security tests from 2025 and 2026. It also says its servers run on RAM only. Those are provider statements and third-party reports, not our own tests, and the full Deloitte reports are available only to Surfshark customers.

Does Surfshark keep logs?

Its terms say it does not record browsing history, visited IP addresses, bandwidth or traffic. For abuse prevention, its servers store your user ID or IP address and connection timestamps, and the terms say these are deleted within 15 minutes after your session ends.

Is Surfshark owned by NordVPN?

Surfshark merged in 2022 with Nord Security, the company that owns NordVPN, and the two now sit under one holding company. Both say they operate independently, with separate infrastructure. Your contract is with Surfshark B.V. in the Netherlands.

Can I try Surfshark for free?

Yes, for 7 days through its website on the 12- and 24-month plans, with payment details required and a 3-device limit. If you keep it, the 30-day money-back guarantee then applies to that first purchase.