Surfshark — Israel Complicity Index

Key Findings

Digital: Surfshark directly offers its consumer VPN through Apple’s Israel App Store and markets an Israel-labelled VPN location. These sources establish ordinary consumer digital-service availability, without establishing physical Israeli hosting or security-sector use.^{1, 2, 3}

Economic: The Israel App Store listing establishes a direct consumer distribution/sales channel. It does not establish subscriber numbers, completed sales, local revenue, tax contribution, workforce, or capital investment.³

Political: Surfshark’s current public Israel-facing offering supports the rubric’s Business-as-Usual classification. The reviewed record does not establish an institutional political partner or measured national audience; the political magnitude is therefore below full scale.^{1, 3}

Separate vendor finding: Surfshark discloses AppsFlyer as an analytics and advertising provider, and AppsFlyer Ltd. is Israeli-incorporated. Actual Surfshark contract terms, processing location, spend, and government access remain unresolved.^{4, 5, 6}

Target Profile

Field	Detail
Company Name	Surfshark / Surfshark B.V.^{7, 8}
Jurisdiction	Netherlands: Surfshark B.V. is recorded as a Dutch besloten vennootschap. Customer contracts are stated to be governed by British Virgin Islands law.^{7, 9}
Headquarters	Kabelweg 57, 1014BA Amsterdam, Netherlands.⁸
Sector	Consumer cybersecurity and online-privacy services, including VPN, antivirus, breach-alert, private-search, alternative-identity, alternative-number, and data-deletion services.¹⁰
Ownership	Private. Surfshark states that it merged with Nord Security under one holding company in 2022 while continuing to operate independently. Public materials reviewed do not identify the holding company’s legal name, ownership percentages, or ultimate beneficial owners. Nord Security financing announcements name Novator Ventures, Burda Principal Investments, General Catalyst, and later Warburg Pincus as investors, without establishing controlling interests.^{10, 11, 12, 13}
Key Executives / Governance	Dovydas Godelis (CEO); Vytautas Kaziukonis (founder and Chairman of the Board); Laurynas Zabulis (CFO); Donatas Budvytis (CTO); Saulius Maslinskas (Chief Product Development Officer); Tomas Stamulis (Chief Security Officer); Gytis Malinauskas (Head of Legal).¹⁰
Israeli-Nexus Summary	The documented nexus consists principally of a consumer service listed in Apple’s Israel App Store, Israeli VPN-location marketing, and disclosed use of AppsFlyer, an Israeli-incorporated analytics and advertising provider; no public evidence identified of Israeli state, military, settlement, or security-sector contracting.^{4, 5, 1, 3}

Key Facts:

Surfshark B.V. has Dutch Chamber of Commerce number 81967985 and an entity-creation date of 22 February 2021.⁷
Surfshark states it has offices in Lithuania, Poland, and Germany as well as being based in the Netherlands; its public materials state that it employs more than 500 people.¹⁰
A reviewed third-party judgment named Surfshark B.V. and Surfshark Ltd, but did not establish their ownership relationship, operating roles, or whether Surfshark Ltd remains active.¹⁴

Executive Summary

Surfshark is a consumer privacy and cybersecurity provider whose identified Israel-facing activity is the marketing of eight Israeli VPN servers, presented to users as Tel Aviv connection locations capable of providing an Israeli IP address.¹ Surfshark describes the service as encrypted, RAM-only VPN infrastructure. Its general server documentation cautions that a virtual VPN server may provide an IP address for a country other than its physical location; the record therefore does not establish that the advertised endpoint is physically hosted in Israel, let alone in occupied territory.^{1, 2}

The governing digital and economic finding is Surfshark’s direct consumer service, supported by its Israel-facing marketing and its listing in Apple’s Israel App Store.^{1, 3} The listing establishes an available consumer distribution/sales channel, without measuring completed subscriptions, Israeli revenue, taxes, staff, or local capital investment.³

A separate buyer-side relationship is Surfshark’s disclosure of AppsFlyer as a provider used for analytics and advertising.⁴ First-party AppsFlyer legal material identifies AppsFlyer Ltd. as incorporated under Israeli law and registered in Herzliya, Israel.⁵ AppsFlyer’s standard terms allocate some customers to the Israeli entity absent contrary order-form arrangements, but the reviewed record does not contain Surfshark’s order form, identify Surfshark’s actual AppsFlyer contracting entity, or disclose contract value, duration, deployment volume, or data-processing location.⁶ This evidence therefore supports a disclosed commercial relationship with an Israeli-incorporated technology provider, not an inference of Israeli government access, military use, surveillance deployment, or Israel-specific data processing.^{4, 5, 6}

Surfshark’s public materials also include a facial-recognition research project that separately treats “Palestine,” because it identified Israeli-government facial-recognition use to monitor Palestinians in the West Bank.¹⁵ The cited reference is a privacy and surveillance research-methodology statement; it does not announce a position on military operations, settlements, civilian harm, or the broader Israel–Palestine conflict.¹⁵ Surfshark’s Emergency VPN programme offers six months of free access to journalists, NGO representatives, and activists facing censorship or surveillance, but the reviewed programme page does not describe an Israel-, Palestine-, or Gaza-specific initiative.¹⁶

The evidence record does not substantiate direct military, intelligence, police, state-cloud, settlement, or weapons involvement. No public evidence identified of Israeli Ministry of Defense, IDF, prison-service, Border Police, intelligence, police, or other security-body contracts; Project Nimbus participation; deployment for Israeli military or law-enforcement surveillance; Israeli R&D facilities; Israeli public-sector customers; settlement operations; or Israeli defence-prime supply relationships. Document-scoped searches also found no Surfshark mention in the identified OHCHR settlement-business materials or UN Human Rights Council report A/HRC/59/23, while making clear that such findings do not prove universal absence from all records.^{17, 18, 19}

Under the fixed, human-vetted V6.5 assessment, Surfshark receives a BRS of 257, placing it in Tier D (Moderate Complicity). The digital and economic scores use the current direct consumer-service and sales-channel frames. Political Impact reflects public Business-as-Usual market conduct, with Magnitude reduced to 5.5 under the dedicated political table because institutional reach is not established. AppsFlyer is a separate lower digital frame and is not added to the provider-side score; the facial-recognition methodology is contextual evidence and does not drive the score. Military remains zero.

Timeline of Relevant Events

Date	Event
22 February 2021	Surfshark B.V. was created as a Dutch legal entity, according to its Global LEI record.⁷
1 February 2022	Surfshark and Nord Security announced a merger agreement, stating they would retain autonomous operations, separate infrastructure, management, and product-development plans.¹¹
April 2022	Nord Security announced a US$100 million financing round led by Novator Ventures, with Burda Principal Investments and General Catalyst participating; the announcement did not disclose Surfshark ownership percentages or control.¹²
September 2023	Nord Security announced a further US$100 million financing round from Warburg Pincus, with Novator and Burda participating; the disclosed announcement did not establish controlling ownership or voting rights.¹³
10 June 2025	An independent reasonable-assurance report addressed to Surfshark B.V.’s board covered IT systems and operations supporting Surfshark’s customer VPN service; it did not describe military or Israeli-hosting work.²⁰
14 April 2026	Surfshark’s transparency report described fulfilment of one Amsterdam District Court warrant in a criminal inquiry; it identified no Israeli authority, Israel-related order, or conflict matter.²¹
7 September 2026	Supplementary vendor review confirmed that AppsFlyer Ltd. is Israeli-incorporated and that Surfshark’s cookie policy identifies AppsFlyer for analytics and advertising, while leaving actual contract and processing details unresolved.^{4, 5, 6}

Corporate Overview

Surfshark B.V. is the identified customer-facing contracting entity and data controller for Surfshark services, located at Kabelweg 57, 1014BA Amsterdam, Netherlands.^{7, 8} Surfshark’s terms state that customer contracts are governed by British Virgin Islands law.⁹ A separate third-party-hosted French judgment named both Surfshark B.V. and Surfshark Ltd, at a Road Town, Tortola address, as parties, but the reviewed judgment does not establish their ownership relationship, operational roles, or present status.¹⁴

Surfshark reports that it merged with Nord Security under one holding company in 2022 while continuing to operate independently.^{10, 11} Available corporate disclosures do not identify the legal name of that common holding company, a formal legal-entity chart, direct-parent relationships, shareholdings, voting rights, or ultimate beneficial owners.^{10, 12, 13} The Nord Security materials identify its co-founders as Tomas Okmanas, Eimantas Sabaliauskas, and Jonas Karklys, but do not publish equity stakes or complete board composition.²²

The reviewed record identifies Surfshark offices in Amsterdam, Vilnius and Kaunas, Warsaw, and Berlin; it does not identify an Israeli office, subsidiary, branch, R&D centre, franchisee, distributor, authorised reseller, or occupied-territory location.¹⁰ This is not proof that no Israeli commercial arrangements, customers, contractors, or infrastructure exist. It does, however, mean the dossier does not attribute such arrangements without evidence.^{10, 8}

Domain Summaries

Military: Military

Mechanism of Involvement

No public evidence identified of Surfshark, Surfshark B.V., or Nord Security holding an Israeli Ministry of Defense, IDF, prison-service, Border Police, intelligence, police, or other security-body contract, tender award, framework agreement, or official cooperation announcement.

Surfshark’s publicly described offerings are consumer privacy and cybersecurity products. The reviewed materials do not describe military-specific products, tactical variants, weapons integration, kinetic AI, fire-control systems, munitions, strategic platforms, or defence-business programmes.¹⁰ No public evidence identified of supply to Israeli defence primes including Elbit Systems, Israel Aerospace Industries, Rafael, or IMI/Elbit Land.

Counter-Arguments and Evidence Limits

The strongest defence is the civilian character of the documented business. Surfshark’s product portfolio is publicly presented as privacy, VPN, security, and identity-related software rather than defence supply.¹⁰ Its Israeli VPN marketing does not name a government or military end user, establish end-user certification, or identify physical infrastructure, a host, operator, reseller, or data-centre provider.¹

The audits are bounded reviews, not proof of absolute absence. Surfshark’s public office list is not a complete operational-footprint disclosure; likewise, no identified contract should not be read as proof that no non-public customer relationship exists.¹⁰ Nevertheless, the record contains no verified military or security relationship on which a continuing or post-divestment assessment could be based.

Named Entities and Evidence Map

Surfshark B.V.: Consumer-facing Dutch entity; no public evidence identified of Israeli defence contracting.
Nord Security: Common-group counterpart since the 2022 merger; no public evidence identified of supplying named Israeli defence primes or security bodies.¹¹
Israeli state/security bodies and defence primes: No verified contract, supply, joint-development, or licensed-technology relationship identified.

Digital: Digital

Mechanism of Involvement

Surfshark advertises eight Israeli VPN servers and directs users to select Tel Aviv to obtain an Israeli IP address.¹ It describes these servers as RAM-only and states that the service encrypts online activity and masks users’ IP addresses.¹ Apple also lists the Surfshark app in its Israel storefront.³ Together these records establish the ordinary consumer-services frame; an Israeli IP label alone would not prove service use by Israeli customers or physical infrastructure in Israel.

Surfshark’s cookie policy identifies AppsFlyer among providers used for analytics and advertising.⁴ AppsFlyer’s agency agreement identifies AppsFlyer Ltd. as incorporated under Israeli law, with a registered office in Herzliya.⁵ This establishes disclosed use of an Israeli-incorporated commercial technology provider.

Counter-Arguments and Evidence Limits

The vendor relationship does not establish Surfshark-specific data processing in Israel, Israeli governmental access, surveillance use, or military use.^{4, 5, 6} AppsFlyer’s standard terms may allocate certain customers to AppsFlyer Ltd. absent a contrary order form, but the reviewed evidence does not include Surfshark’s order form or establish its actual contracting entity, spend, start date, or deployment scale.⁶

Likewise, Tel Aviv-labelled VPN service does not establish physical infrastructure in Israel. Surfshark’s own general documentation explains that virtual servers can provide an IP address associated with a country other than the server’s physical location.² The Israel-specific page does not disclose host, hardware owner, data-centre address, local contracting entity, or endpoint location.^{1, 2} No public evidence identified of Project Nimbus participation, Israeli sovereign-cloud tenders, Israeli security-agency deployments, offensive-cyber tools, or Israeli-origin surveillance/biometrics integration.

Named Entities and Evidence Map

Surfshark B.V.: Advertises Israeli VPN access and discloses third-party technology providers.^{1, 4}
AppsFlyer Ltd.: Israeli-incorporated provider; Surfshark identifies AppsFlyer for analytics and advertising.^{4, 5}
Google/BigQuery and Cloudflare: Disclosed storage, analysis, security, and performance providers; the reviewed record does not establish an Israel nexus from those disclosures.⁸
Israeli government and security agencies: No public evidence identified of direct contract, deployment, or data-residency arrangement.

Economic: Economic

Mechanism of Involvement

Apple’s Israel App Store lists Surfshark’s consumer app, and Surfshark markets Israeli VPN access.^{3, 1} The storefront is the direct consumer sales/distribution-channel anchor. These sources do not measure completed sales, subscriptions, customer numbers, Israel-specific revenue, commissions, local tax contribution, or profit flows.^{3, 1}

The disclosed AppsFlyer relationship is also an economic connection to an Israeli-incorporated commercial provider, but the record does not disclose commercial terms, payments, contract value, or actual contractual allocation.^{4, 5, 6}

Counter-Arguments and Evidence Limits

No public evidence identified of physical-goods purchasing, importing, distribution, white-labelling, agricultural sourcing, Israeli importer-of-record arrangements, settlement-origin goods, or country-of-origin-labelling claims. No public evidence identified of direct investment in Israel or occupied territory, Israeli acquisitions, Israeli R&D facilities, Israel-focused fund holdings, public Israeli tax residency, or preferred-technology-enterprise status.

The marketed VPN endpoint does not establish a physical Israeli operation, host, local workforce, branch, tax registration, support centre, warehouse, retail site, or occupied-territory location.^{1, 10} No public evidence identified of activity in West Bank, East Jerusalem, or Golan Heights settlements.

Named Entities and Evidence Map

Surfshark B.V.: Dutch consumer-service entity, with no disclosed Israel-segment financial reporting.⁷
AppsFlyer Ltd.: Israeli-incorporated disclosed analytics and advertising provider; commercial magnitude remains unverified.^{4, 5, 6}
Nord Security investors: Novator Ventures, Burda Principal Investments, General Catalyst, and Warburg Pincus are documented financiers; announcements do not establish Surfshark ownership or Israeli investment exposure.^{12, 13}

Political: Political

Mechanism of Involvement

Surfshark frames its public mission around online privacy, security, and an open internet.¹⁰ Its facial-recognition research separately identifies “Palestine” because of Israeli-government facial-recognition monitoring of Palestinians in the West Bank.¹⁵ This is surveillance-research context, not a scored political act or a conflict-position statement.

Surfshark also makes its consumer VPN available in Israel and is listed in Apple’s Israel App Store.^{1, 3} These facts establish consumer availability, not a state relationship, physical Israeli establishment, public-sector use, local revenue, or territorial presence.³

Counter-Arguments and Evidence Limits

No public evidence identified in the audit searches of a Surfshark statement specifically addressing Israel–Palestine, Gaza, 7 October, peace, support for either party, or conflict-related humanitarian aid. No public evidence identified in the bounded searches of Israel/Palestine advocacy, military-welfare or settlement support, anti-BDS roles, lobbying, donations, or conflict-related asset mobilisation by named Surfshark and Nord Security executives. The audits and supplementary search notes retain the exact-name coverage and its limits.

The identified surveillance research does not state a position on military operations, settlements, civilian harm, or the wider conflict.¹⁵ The separate Ukraine-related philanthropic record concerning Tomas Okmanas and Eimantas Sabaliauskas is not an Israeli state honour or a documented contribution to an Israeli recipient, and does not establish Surfshark corporate funding.²³

Named Entities and Evidence Map

Surfshark: Provides Israel-facing consumer VPN availability.^{1, 3} No verified Israel/Palestine conflict statement or state-partnership record was identified by the audit searches.
Vytautas Kaziukonis and Dovydas Godelis: Founder/Chair and CEO respectively; no public evidence identified in bounded checks of Israel/Palestine-related conduct requiring attribution to Surfshark. The corporate page identifies their roles.¹⁰
Tomas Okmanas and Eimantas Sabaliauskas: Nord Security co-founders; publicly documented Ukraine-related philanthropy does not establish an Israel nexus or Surfshark funding.^{22, 23}
UN/OHCHR materials: Document-scoped checks found no Surfshark mention in the identified settlement-business and Human Rights Council records; this does not establish universal absence from all future or non-reviewed sources.^{17, 18}

BDS-1000 Score

Method: V6.5.

Domain	I	M	P	V-Domain Score
Military	0.00	0.00	0.00	0.00
Digital	2.50	7.00	9.00	2.50
Economic	2.50	7.00	9.00	2.50
Political	3.50	5.50	9.00	2.75

V_MAX: 2.75 Avg_OTHERS: 1.67
BRS Score: 257 Tier: D (Moderate Complicity)

V_MAX is driven by Business-as-Usual public market conduct: I=3.5, M=5.5 and P=9 give Political=2.75. Digital and Economic each use the current direct consumer-service and sales-channel finding at 2.5/7/9, yielding 2.50; the generic magnitude guidance treats that current offering as a standard instance without inferring measured revenue. The dedicated political table requires stronger institutional commitment for magnitude 6.1+, so it receives a separate discount. AppsFlyer is retained as a lower, non-controlling digital frame; facial-recognition research and Ukraine philanthropy do not contribute to the numeric score. The score does not treat unresolved infrastructure, customer, data-processing, or ownership questions as established facts, and Military remains zero because no verified defence or security relationship was identified.

This is a scale-free, evidence-only, human-vetted assessment: it measures documented activity type, scale, and directness rather than implying a universal conclusion about all possible operations.

Methodology Note

Evidence is limited to the four supplied domain audits and their cited source record; claims outside that record are excluded.
Impact is assessed by activity type; M assesses documented scale; P assesses directness of the evidenced nexus.
The analysis is scale-free: undisclosed revenue, customer, ownership, or infrastructure details are not inferred from consumer availability or vendor identity alone.
Divested or exited operations would mitigate assessment where verified; no verified former Israeli military, settlement, or state relationship was identified here.
Entity attribution is not transitive: references to Nord Security, investors, executives, vendors, or litigants are not treated as proof of Surfshark control, ownership, or conduct absent evidence.
Settlement operations, if established, would be assessed in both Economic and Political; no public evidence identified of such operations in this record.
“No public evidence identified” records the outcome of bounded checks and does not assert universal or future absence.