Digital Audit: Surfshark

Enterprise Technology Stack & Vendor Relationships

Surfshark B.V., based in Amsterdam, is the consumer-facing contracting entity identified in Surfshark’s current privacy policy, while its terms state that customer contracts are governed by British Virgin Islands law ¹².

Surfshark states that it merged with Nord Security under one holding company in 2022 while continuing to operate independently, and Nord Security’s 2022 report likewise describes the companies as continuing autonomously after the merger agreement ³⁴.

The consulted official materials do not identify the holding company’s legal name, ownership percentages, Surfshark B.V.’s direct parent, or ultimate beneficial owners ³⁴⁵.

Surfshark’s published privacy and cookie policies identify third-party providers across analytics, advertising, payments, storage and infrastructure, support, security, and alternative-number delivery ¹⁶.

Named disclosed providers include AppsFlyer, Firebase/Google, Iterable, Purchasely, BigQuery/Google, Zendesk, Cloudflare, Stripe, Adyen, Checkout, Coingate, and Telnyx ¹⁶.

AppsFlyer is disclosed as an analytics and advertising provider, but the reviewed evidence does not independently establish its domicile or demonstrate that Surfshark data is processed in Israel ⁶.

No public evidence identified of a direct Surfshark licensing, subscription, integration, or deployment relationship with Check Point, Wiz, SentinelOne, CyberArk, NICE, Verint, Claroty, Palo Alto Networks, or another specifically identified Israeli-origin enterprise-security vendor.

No public evidence identified of a named systems integrator, IT outsourcer, or digital-transformation consultancy delivering a major Surfshark technology programme that deployed Israeli-origin technology.

Surveillance, Biometrics & Retail Technology

No public evidence identified of Surfshark’s use of Israeli-origin facial recognition, biometric identification, gait analysis, retail analytics, predictive policing, sentiment analysis, social-media monitoring, behavioural analytics, or workforce-surveillance products.

No public evidence identified of third-party deployment of such tools into Surfshark through a managed-security provider or bundled enterprise suite.

Tactical Tech discusses Israeli military surveillance systems independently and states that a Surfshark CCTV-mapping research project covering 150 countries did not include Israel, East Jerusalem, or other occupied Palestinian territory ⁷.

That observation concerns the geographic scope of Surfshark’s research publication rather than evidence that Surfshark supplied, operated, or integrated the Israeli surveillance systems discussed by Tactical Tech ⁷.

Cloud Infrastructure, Data Residency & Sovereign Cloud Participation

Surfshark advertises eight Israeli VPN servers and directs users to select a Tel Aviv server location to obtain an Israeli IP address ⁸.

Surfshark’s global server list identifies Israel as an available server country ⁹.

Surfshark describes its Israeli servers as RAM-only and states that an Israel connection masks the user’s IP address and encrypts online activity ⁸.

Surfshark’s general server documentation explains that a virtual VPN server can provide an IP address for a country different from its physical location ⁹.

The Israel-specific page does not state whether Tel Aviv-labelled servers are physical servers in Israel, virtual servers elsewhere, owned hardware, leased hardware, or colocation capacity ⁸⁹.

Surfshark states that it does not retain browsing history, connection timestamps, bandwidth, traffic, or visited IP addresses, while a server temporarily retains a user ID and/or IP address plus VPN-server connection timestamps and deletes those details within 15 minutes after a session ends ¹.

Surfshark states that personal data may be stored or processed in countries where it has facilities or engages service providers ¹.

The privacy policy’s disclosed recipient-country entries identify the EEA, United States, United Kingdom, Sweden, France, Ireland, and the British Virgin Islands, but do not name Israel ¹.

The omission of Israel from those policy entries is not proof that no processing occurs in Israel ¹.

Surfshark identifies BigQuery/Google for storage, analysis, and data management, and Cloudflare for security and performance ¹.

Surfshark’s transparency report presents aggregate government-request information and describes an Amsterdam District Court warrant that disclosed account existence and payment-related information, rather than Israel-specific authority requests or data-residency arrangements ¹⁰.

No public evidence identified of Surfshark participation in Project Nimbus, Israeli government cloud tenders, Israeli sovereign-cloud programmes, or cloud-resilience and data-residency services contracted for Israeli state or military bodies.

Defence, Intelligence & Security Sector Technology Relationships

No public evidence identified of a Surfshark contract, partnership, service agreement, or product deployment involving the Israeli Ministry of Defence, IDF, intelligence agencies, police, or another Israeli security body.

No public evidence identified that Surfshark technology has been publicly documented as deployed for Israeli military, intelligence, or law-enforcement surveillance in Israel or the occupied territories.

No public evidence identified that Surfshark develops, sells, licenses, or maintains offensive-cyber capabilities, zero-day exploit tools, or digital weapons for Israeli state actors.

Surfshark describes its consumer offerings as VPN, Antivirus, Alert, Search, Alternative ID, Alternative Number, and Incogni ¹⁴.

These disclosed product descriptions establish privacy and security services, but the reviewed entity materials do not identify Israeli customers, Israeli state contracts, Israeli vendors, Israeli infrastructure, or Israeli-jurisdictional processing ¹⁴.

AI, Algorithmic & Autonomous Systems

No public evidence identified of Surfshark providing AI or machine-learning services, computer vision, automated decision-support, civilian-data training access, surveillance-derived datasets, or autonomous systems to Israeli state, military, or security bodies.

No public evidence identified of Surfshark providing autonomous target-generation, fire-control, kill-chain, or autonomous tracking systems.

The supplied full-text scan found no Surfshark mention in the UN Human Rights Council report A/HRC/59/23, so that report’s discussion of Project Nimbus, surveillance, AI, and related companies cannot be attributed to Surfshark ¹¹.

Technology Ecosystem & R&D Footprint

Surfshark states that it is based in the Netherlands and has offices in Vilnius and Kaunas, Lithuania; Warsaw, Poland; and Berlin, Germany ⁴.

The consulted corporate sources do not identify an Israeli office, R&D centre, data-centre location, subsidiary, or branch ⁴.

No public evidence identified of a Surfshark-operated Israeli R&D facility, engineering office, innovation lab, accelerator programme, acquisition of an Israeli technology company, Israeli startup or fund investment, patent-licensing arrangement, or university co-development programme.

Surfshark’s 2022 annual wrap-up identifies NetBlocks and the VPN Trust Initiative as NGO and industry partners, but does not identify an Israel-related charitable programme, state partnership, or research collaboration ¹².

The annual wrap-up is not an exhaustive disclosure of all Surfshark partnerships ¹².

Surfshark’s current public leadership page identifies Dovydas Godelis as CEO and Vytautas Kaziukonis as Chairman of the Board, and identifies Kaziukonis as Surfshark’s founder ⁴.

Surfshark’s 2024 Impact Report identified Kaziukonis as CEO, supporting a change in the publicly stated CEO role between that report and the current leadership page, although the reviewed materials provide no effective date or corporate filing for the change ⁴¹³.

Nord Security’s leadership page identifies Tomas Okmanas, Eimantas Sabaliauskas, and Jonas Karklys as co-founders, but does not publish equity stakes, board composition, or ultimate beneficial ownership ⁵.

No public evidence identified in the reviewed corporate and leadership materials of investments by Kaziukonis, Godelis, Okmanas, Sabaliauskas, or Karklys in Israeli cyber, surveillance, AI, defence, or intelligence-technology firms.

Civil Society Scrutiny & Regulatory History

The supplied deterministic full-text scan found no Surfshark mention in A/HRC/59/23 or the 2025 OHCHR settlement-business database ¹¹¹⁴.

The accountability review additionally records no Surfshark mention in its local scans of the 2023 settlement-business database and listed Al-Haq, Amnesty, Human Rights Watch, PAX, BankTrack, Who Profits, BDS, and Don’t Buy Into Occupation materials ¹¹¹⁵.

These findings are document-scoped and do not establish absence from all UN, civil-society, government, or future database records ¹¹¹⁴¹⁵.

OHCHR announced an update to its database of businesses involved in certain settlement-related activities in September 2025 ¹⁵.

No public evidence identified of an organised boycott, divestment, sanctions, export-control, regulatory, court, parliamentary, or legal action specifically concerning Surfshark’s technology provision to Israeli state entities or operations in occupied territory.

The accountability research excluded unsupported social-media allegations because no underlying primary source was identified ¹¹¹⁵.