Surfshark is the value pick, and unlimited simultaneous connections is a genuine differentiator rather than a marketing line: no other major provider allows it without a device cap. Its no-logs policy has been verified twice by Deloitte under ISAE 3000, most recently in June 2025, and Cure53 reviewed its infrastructure in 2025. The trade-off is jurisdictional. Surfshark is incorporated in the Netherlands, a 9-Eyes member, whereas NordVPN sits in Panama. If your threat model is a commercial one (public Wi-Fi, tracking, geo-restrictions) that distinction is largely academic. If it is a legal one, it is the single most important line on this page.
- ✓Unlimited simultaneous connections, the clearest differentiator in the category
- ✓No-logs policy audited by Deloitte in 2023 and again in June 2025 under ISAE 3000
- ✓Infrastructure and the Dausos protocol audited by Cure53 in 2025
- ✓CleanWeb blocks ads and malware domains without a separate extension
- ✓Among the cheapest long-term plans of any audited provider
- ✗Incorporated in the Netherlands, a 9-Eyes member, unlike Panama-based or BVI-based rivals
- ✗Dutch law means a valid legal order can compel disclosure of whatever it holds
- ✗Headline price requires a multi-year term and rises sharply at renewal
Independent audits
A no-logs claim is only as good as the evidence behind it. These are the third-party engagements Surfshark has published, with the firm and the year, so you can look them up yourself.
- ✓Deloitte, no-logs assurance under ISAE 3000 (2023 and June 2025)
- ✓Cure53, infrastructure and Dausos protocol review (2025)
- ✓Cure53, browser extension review (2018)
Jurisdiction
Netherlands. Worth understanding before you buy: the Netherlands is a member of the 9-Eyes intelligence-sharing alliance, and Dutch law allows a valid legal order to compel disclosure of data the company holds. The audited no-logs policy is what limits how much that data amounts to.