Surfshark finally audits without logs – and passes

At the end of 2022, Surfshark finally did what we’ve been waiting for years: it invited auditors to evaluate its no-logs policy.

While the company has ordered audits in the past, they have focused on other aspects of its services, such as the presence of any malware in its applications or general infrastructure.

However, this time it large as far as its users are concerned. For any VPN service, it is very good to say that it does not log any data: it is easy. It’s another thing to prove it, and so far it’s been one of the big boxes that Surfshark couldn’t tick.

But in December 2022, the company gave Deloitte access to everything it needed to confirm that it was doing everything in its no-logs policy.

And confirming this by concluding: “Based on the procedures performed and the evidence obtained, in our opinion, the configuration of IT systems and the management of supporting IT operations are properly prepared in all material respects as described by Surfshark it is not. -logs policy”.

The move comes just two weeks after sister company NordVPN announced the results of its third no-registration audit, also conducted by Deloitte.

This is great news for all existing Surfshark users, as well as those considering registration on Surfshark but was previously unwilling to fix without such a guarantee that it does not really store any data about how you use its service.

It’s important to understand that there are different types of logs, and VPNs don’t really help themselves by not making it absolutely clear what “no logs” actually means.

Surfshark does a good job of this by highlighting three main types of logs: technical logs about your connection, personal logs about you and your account, and most importantly, activity logs about how you use the services.

The Surfshark website states: “In short, Surfshark VPN does not track your location or online activities in any way. The VPN server only stores enough data to maintain your VPN connection, and nothing is stored after you’re done.”

One way to ensure nothing gets written is to have all of its servers run in RAM and if they have any, any hard drives are read-only so no activity data can exist after the shutdown this server. And this applies not only to some of its servers, but to all of them.

Surfshark said it will make a summary of Deloitte’s report public so anyone can see evidence that the company is sticking to its no-logs policy.