Sourced comparison
NordVPN vs Surfshark: audits, owners and leak fixes
NordVPN and Surfshark side by side: who runs each, what independent auditors checked, and how each app handled the TunnelVision and TunnelCrack leaks. Every cell links its source. Last checked 26 Oct 2026.
Same owner: NordVPN and Surfshark both belong to Nord Security, according to each brand’s own legal page. See who owns which VPN for the other brands in the group.
Where NordVPN and Surfshark differ
- Audits. NordVPN lists 11 since 2018, the latest by Deloitte on 3 Feb 2026; Surfshark lists 7 since 2018, the latest by Cure53 in Mar 2026.
- Open-source apps. Only NordVPN states it on its own pages; for Surfshark our sources hold no statement.
- Incidents. NordVPN has 2 on record, Surfshark has 0.
The same on both: owner: both are Nord Security brands, NordVPN run by nordvpn S.A. and Surfshark by Surfshark B.V.; RAM-only servers: both state it on their own pages; transparency: both publish a report or canary; TunnelVision: the same status on every app; TunnelCrack LocalNet: the same status on every app; TunnelCrack ServerIP: the same status on every app.
At a glance
| NordVPN | Surfshark | |
|---|---|---|
| Company and country | nordvpn S.A., Panama SourceRead 26 Oct 2026 | Surfshark B.V., Netherlands SourceRead 18 Oct 2026 |
| Part of | Nord Security SourceRead 26 Oct 2026 | Nord Security SourceRead 18 Oct 2026 |
| Independent audits | 11 since 2018, 5 with a public report | 7 since 2018, 2 with a public report |
| Most recent audit | 3 Feb 2026, Deloitte: No-logs SourceRead 26 Oct 2026 | Mar 2026, Cure53: Protocol SourceRead 18 Oct 2026 |
| RAM-only servers | NordVPN says it chose diskless RAM servers instead of hard disk servers for its network. SourceRead 26 Oct 2026 | Surfshark says its servers are RAM-only and wiped on every reboot. SourceRead 19 Oct 2026 |
| Open-source apps | The NordVPN Linux app is open source; the rest of the service is proprietary. SourceRead 19 Oct 2026 | No statement on record |
| Transparency report or canary | NordVPN publishes quarterly counts of government inquiries and DMCA requests: 79 government inquiries for July to September 2026. SourceRead 26 Oct 2026 | Inquiries from government institutions; Surfshark replaced its warrant canary with this quarterly report. SourceRead 18 Oct 2026 |
| Incidents on record | Oct 2024, No-logs tested by police or court: NordVPN received a binding warrant from the Panamanian prosecutor's office in a criminal investigation. (2 on record, newest shown) SourceRead 26 Oct 2026 | No statement on record |
| Newest app versions | Windows 8.14 (23 Oct 2026) SourceRead 26 Oct 2026 macOS 10.13 (16 Oct 2026) SourceRead 26 Oct 2026 Linux 5.4.1 (13 Oct 2026) SourceRead 18 Oct 2026 Android 9.15 (15 Oct 2026) SourceRead 26 Oct 2026 iOS 9.16 (19 Oct 2026) SourceRead 26 Oct 2026 | No statement on record |
Known VPN leak attacks
Each provider’s own statement for each app. “Not stated” means the provider published nothing on it.
| Attack | NordVPN | Surfshark |
|---|---|---|
| TunnelVisionA rogue DHCP server pushes routes (option 121) that pull traffic out of the tunnel while the VPN still shows connected. | Not affected Windows, Linux, Android SourceRead 18 Oct 2026 Mitigated macOS, iOS SourceRead 18 Oct 2026 | Not affected Windows, Linux, Android SourceRead 18 Oct 2026 Mitigated macOS, iOS SourceRead 18 Oct 2026 |
| TunnelCrack LocalNetA rogue Wi-Fi network assigns itself public addresses the VPN treats as local, so traffic to them skips the tunnel. | Not affected Windows, Linux, Android SourceRead 18 Oct 2026 Mitigated macOS, iOS SourceRead 18 Oct 2026 | Not affected Windows, Linux, Android SourceRead 18 Oct 2026 Mitigated macOS, iOS SourceRead 18 Oct 2026 |
| TunnelCrack ServerIPA spoofed DNS answer for the VPN server makes the client route chosen traffic outside the tunnel. | Not stated All apps SourceRead 18 Oct 2026 | Not stated All apps SourceRead 18 Oct 2026 |
Audits on record
NordVPN
| Date | Auditor | Type | What was checked | Findings | Source |
|---|---|---|---|---|---|
| 3 Feb 2026 | Deloitte | No-logs | Sixth no-logs assurance engagement, 10 November to 12 December 2025. | Not published | SourceRead 26 Oct 2026Report not public |
| 10 Dec 2025 | Cure53 | Apps | Pentest of all desktop and mobile apps, browser extensions, APIs and NordAccount login. | 3 high, 4 medium, 15 low, 8 info | SourceRead 26 Oct 2026 |
| 10 Dec 2025 | Cure53 | Servers and infrastructure | Pentest of VPN servers and supporting infrastructure, October 2025. | 2 high, 1 medium, 4 low, 2 info | SourceRead 26 Oct 2026 |
| 18 Feb 2025 | Deloitte | No-logs | Deloitte Audit Lithuania, fifth engagement, with access from 18 November to 20 December 2024. | Not published | SourceRead 18 Oct 2026Report not public |
| 9 Jan 2024 | Deloitte | No-logs | Fourth no-logs assurance engagement, 30 November to 7 December 2023: standard, Double VPN, obfuscated, Onion over VPN and P2P servers. | Not published | SourceRead 26 Oct 2026Report not public |
| 28 Feb 2023 | Cure53 | Apps | Pentest and source code audit of the Windows, Linux and macOS apps, browser add-ons and related backend services. | 1 critical, 2 high, 1 medium, 7 low, 11 info | Report SourceRead 26 Oct 2026 |
| 28 Feb 2023 | Cure53 | Servers and infrastructure | Pentest and source code audit of NordVPN servers and infrastructure. | 1 high, 2 medium, 1 low, 7 info | Report SourceRead 26 Oct 2026 |
| 10 Jan 2023 | Deloitte | No-logs | Reasonable assurance on IT system configuration against the no-logs claim, 21 November to 10 December 2022. | Not published | SourceRead 26 Oct 2026 |
| 1 Jul 2020 | PwC | No-logs | Second assurance engagement on the no-logs claim, 20 to 28 May 2020, adding obfuscated, Double VPN and P2P servers. | Not published | SourceRead 26 Oct 2026Report not public |
| 10 Oct 2019 | VerSprite | Apps | Penetration test of the NordVPN apps. | Not published | SourceRead 26 Oct 2026Report not public |
| Nov 2018 | PwC | No-logs | First assurance engagement on NordVPN's no-logs claim, ordered in late 2018. | Not published | SourceRead 26 Oct 2026Report not public |
Surfshark
| Date | Auditor | Type | What was checked | Findings | Source |
|---|---|---|---|---|---|
| Mar 2026 | Cure53 | Protocol | Architecture and cryptography of the Dausos protocol; only a summary is published. | Not published | SourceRead 18 Oct 2026Report not public |
| 23 Jan 2026 | SecuRing | Servers and infrastructure | Black-box penetration test of the network infrastructure, 1 to 10 December 2025. | 1 medium | Report SourceRead 18 Oct 2026 |
| 16 Jun 2025 | Deloitte | No-logs | ISAE 3000: standard, static and multiport servers and their deployment. | Not published | SourceRead 18 Oct 2026Report not public |
| 9 Jun 2025 | SecuRing | Apps | Web, desktop and mobile apps and extensions, February to April 2025; only an attestation letter is published. | Not published | SourceRead 18 Oct 2026Report not public |
| 25 Jan 2023 | Deloitte | No-logs | Server configuration and deployment, API, network software and staff interviews. | Not published | SourceRead 18 Oct 2026Report not public |
| Apr 2021 | Cure53 | Servers and infrastructure | Servers, VPN configuration and related infrastructure; only a management summary is published. | Not published | SourceRead 18 Oct 2026Report not public |
| 20 Nov 2018 | Cure53 | Browser extension | Pentest and code audit of the Chrome and Firefox extensions. | 1 low, 1 info | Report SourceRead 26 Oct 2026 |
Check it on your own connection
Records say what NordVPN and Surfshark state. A test shows what your own connection does today: run the NordVPN leak test with that app connected, or the Surfshark leak test with the other; each checks your IP, DNS, WebRTC and IPv6.
How this page is kept
- NordVPN’s column is read from nordvpn.com, support.nordvpn.com and sb.nordcdn.com; Surfshark’s from surfshark.com and support.surfshark.com. Auditors’ published reports count as well. Each cell links its source and the date it was read.
- “No statement on record” under NordVPN or Surfshark means our sources hold none for that provider. It is not a finding that NordVPN or Surfshark lacks the feature; check its own pages.
- This page does not rank NordVPN against Surfshark. Which row matters depends on what you need the VPN for.
- A script re-reads every NordVPN and Surfshark source weekly; when one changes, a person checks it before the NordVPN or Surfshark row changes. These records also feed every published VPN audit, who owns which VPN and leak issues by provider.
The data on this page as JSON: facts.json (CC BY 4.0) · All open data · Changes and Atom feed