Surfshark's no-logs policy verified by KPMG
"Users have no direct way to see how a VPN handles their traffic, so we rely on external auditors to answer that question on their behalf. One of the Big Four auditing firms, KPMG, reviewed our server configurations,…
Cybersecurity company Surfshark just released its third no-logs assurance report. The independent verification by KPMG, one of the Big Four auditing firms, confirms that Surfshark does not monitor what users do online and does not keep logs of their activity.
VILNIUS, Lithuania, Nov. 13, 2026 /PRNewswire/ -- "Users have no direct way to see how a VPN handles their traffic, so we rely on external auditors to answer that question on their behalf. One of the Big Four auditing firms, KPMG, reviewed our server configurations, handling of temporary login data, and employee access controls, confirming that we do not log or monitor online activity. Undergoing these reviews year after year, rather than pointing back to a single past audit, proves that our no-logs commitment remains true as our network expands," says Gabriele Sinkeviciute, Head of Product at Surfshark.
The recent assurance provided by KPMG looked into Surfshark's Privacy Policy and internal processes. As part of the engagement, KPMG:
- Confirmed that Surfshark's VPN servers do not collect logs of user activity after login, including browsing history, traffic destination, data content, or connection logs;
- Verified that temporary login data is stored only briefly and deleted within a defined timeframe;
- Assessed that usage analytics data collection aligns with Surfshark's Privacy Policy;
- Evaluated security measures protecting customers from potential compromises of third-party services involved in server infrastructure;
- Reviewed change management procedures to ensure system updates and configuration changes are properly authorized and documented without compromising security;
- Inspected how privileged user access is managed and logged to ensure compliance with internal security policies.
This independent assessment confirms compliance with Surfshark's Privacy Policy. The detailed report (ISAE 3000) is available via this link.
This is Surfshark's third independent assurance of its no-logs policy. Previous independent verifications and certifications are listed in Surfshark's trust center, and the company is committed to continuing these checks regularly.
ABOUT SURFSHARK
Surfshark is a cybersecurity company offering products including an audited VPN, certified antivirus, data leak warning system, and tool for generating an online identity. Recognized as a leading VPN by CNET and TechRadar, Surfshark has also been featured on the FT1000: Europe's Fastest Growing Companies ranking. Headquartered in the Netherlands, Surfshark has offices in Lithuania and Poland. For information on Surfshark's operations and highlights, read our Annual Wrap-up. For information about Surfshark's previous independent verifications and certifications, visit our trust center.
More information: media@surfshark.com
View original content to download multimedia:https://www.prnewswire.com/news-releases/surfsharks-no-logs-policy-verified-by-kpmg-302938843.html
SOURCE Surfshark B.V.
