# Surfshark privacy rating

Commercial VPN service from Surfshark B.V. in the Netherlands. Apps support WireGuard, OpenVPN and IKEv2.

## Summary

Surfshark scores 48 out of 100 (grade D) on the VPN providers criteria. It meets 5 of 12 criteria: no ads or data sales, independent audit, transparency report, TLS configuration and modern protocols. It partly meets audited no-logs policy and anonymous payment. It does not meet open source, no trackers or telemetry, tells users about requests, security headers and open-source apps. It is based in the Netherlands: Nine Eyes member; EU member (GDPR). Automated tests: SSL Labs grade A and Mozilla HTTP Observatory grade C-.

- Website: https://surfshark.com
- Jurisdiction: Netherlands. Nine Eyes member. EU member (GDPR).
- Platforms: Windows, macOS, Linux, Android, iOS
- Home page trackers: Trustpilot (not scored)
- Category: [VPN providers](https://privacyratings.com/vpns/)
- Grade: D (48/100)

## Criteria

| Criterion | Answer | Note | Evidence |
| --- | --- | --- | --- |
| Open source | No | Closed source. |  |
| No trackers or telemetry | No | The privacy policy lists Firebase Analytics and AppsFlyer for app analytics and marketing attribution. | https://surfshark.com/privacy |
| No ads or data sales | Yes | Funded by paid subscriptions. The policy states personal data is not sold, rented or traded. | https://surfshark.com/privacy |
| Independent audit | Yes | Full SecuRing penetration test report on the server infrastructure is public. | https://surfshark.com/media/SurfShark-InfrastructureTestReport_20251217_Public.pdf |
| Transparency report | Yes | Quarterly counts of user data requests by type are published. | https://surfshark.com/transparency-report |
| Tells users about requests | No | No published policy on notifying users about data requests. |  |
| TLS configuration | Yes | Grade A | https://www.ssllabs.com/ssltest/analyze.html?d=surfshark.com&hideResults=on |
| Security headers | No | Grade C- (45/100+) | https://developer.mozilla.org/en-US/observatory/analyze?host=surfshark.com |
| Modern web standards | Not tested yet | Not tested yet. |  |
| Audited no-logs policy | Partial | Deloitte assessed the no-logs policy, but the full report is only available to logged-in users, not publicly. | https://surfshark.com/blog/deloitte-nologs-policy-verified-again |
| Anonymous payment | Partial | Cryptocurrency is accepted, but an email address is needed for the account. | https://support.surfshark.com/hc/en-us/articles/360003069034-What-payment-options-do-you-offer |
| Open-source apps | No | The apps are closed source. |  |
| Modern protocols | Yes | WireGuard is supported alongside OpenVPN and IKEv2. | https://surfshark.com/blog/wireguard-protocol-is-now-live-on-surfshark |

Source: https://privacyratings.com/vpns/surfshark/
Edit: https://github.com/privacyratings/privacyratings.com/edit/main/ratings/vpns/surfshark.md