Surfshark's No-Logs Policy Gets a KPMG Assurance Report

Surfshark has a new report on its no-logs policy, and this time it comes from KPMG rather than Deloitte. Surfshark announced the report on its blog on 11 November 2026, and its report page describes what KPMG delivered.

We read both pages on 13 November and compared them with our Surfshark review and with the audit records we keep for every provider.

What happened

The report page names the auditor as KPMG Baltics, UAB and KPMG AB. It calls the work “an independent reasonable assurance report under ISAE 3000 (Revised)”. The report covers “the description and the design and implementation of controls supporting the Surfshark no-logs VPN service as at 30 October 2026”, and it is dated 9 November 2026.

Surfshark’s blog post lists what KPMG did. It says KPMG “Confirmed that Surfshark’s VPN servers do not collect logs of user activity after login, including browsing history, traffic destination, data content, or connection logs”. The post lists four more checks:

• how long temporary login data is kept
• whether usage analytics match Surfshark’s privacy policy
• how the server setup is protected against problems at third-party services
• how changes and privileged user access are managed and logged

Why it matters

A no-logs promise is hard to check from outside, so reports like this are the best evidence a reader gets. Surfshark now has three, after the Deloitte reports it announced in January 2023 and June 2025. A second firm reaching the same view adds weight.

The report has limits, though. It describes how the controls were designed and put in place on one day, 30 October 2026, not how they worked over months. Reasonable assurance is the stronger of the two levels in the ISAE 3000 standard. The full PDF opens only after you accept KPMG’s terms, which forbid quoting it, and Surfshark’s Trust Center still listed only the Deloitte reports on 13 November.

The report also comes two months after Surfshark disclosed that an outsider reached one of its internal test servers in September. Surfshark says that incident did not affect user data or the VPN service.

What to do

1. Read the notice and the blog post if you want the scope in Surfshark’s own words. Both are public.
2. Compare dates, not just names. Our no-logs explainer shows what these audits test and how recent each one is.
3. Test it within the refund window. Surfshark refunds within 30 days of your first order, but not after a renewal.

What we changed

We added the KPMG report to our Surfshark data, along with the September incident, which our record had missed. We updated our Surfshark review, our Surfshark deal page and the Surfshark pick in our UK guide. Surfshark’s score does not change, because its June 2025 Deloitte report already earned full credit for a recent no-logs audit.