Surfshark Review: Good Price, Complicated Ownership
Verdict
Surfshark is a competent, affordable VPN — but the moment you look past the pricing, the ownership picture gets complicated in ways that matter. Nord Security, the same Lithuanian company behind NordVPN, owns Surfshark. That consolidation of two of the world's largest VPN brands under one corporate roof is not a minor footnote — it is the central fact of this Surfshark review, and it shapes every trust judgment that follows. Add a Netherlands headquarters (EU jurisdiction, subject to data retention frameworks and law enforcement cooperation), and you have a VPN that sells hard on value while carrying structural privacy trade-offs that budget-focused buyers often overlook.
If your threat model is geo-restrictions and streaming, Surfshark is a reasonable buy. If your threat model is genuine privacy from surveillance — which, as a UAE-based user, mine includes — the ownership and jurisdiction combination demands a harder look.
Quick Stats
| Factor | Detail |
| Vendor | Nord Security |
| Incorporated | Lithuania (founded) |
| HQ | Amsterdam, Netherlands |
| Jurisdiction | Netherlands (EU) |
| Device limit | Unlimited simultaneous connections |
| Notable | Proprietary VPN protocol (Nexus) |
Jurisdiction & Ownership
Surfshark operates out of Amsterdam. The Netherlands sits inside the EU, which means it is subject to the EU's legal frameworks, including mutual legal assistance treaties and data retention directives. For a UAE user connecting through a Surfshark server, this is not an abstract concern — it is the legal environment governing what Surfshark can be compelled to hand over, and to whom.
The ownership layer compounds this. Surfshark merged with Nord Security in 2022, bringing it under the same corporate umbrella as NordVPN. Both brands continue to operate independently in terms of product, but they share an owner. The Hacker News thread on this — "Who owns ExpressVPN, Nord, Surfshark? VPN relationships explained" — drew 427 comments in 2024, which is the single most-discussed Surfshark-related item in that community by a significant margin. That level of engagement on an ownership-transparency thread tells you something: privacy-aware users care about this, and they were not reassured by the answer.
The counterargument is that Lithuania, where Nord Security is incorporated, is not traditionally associated with aggressive surveillance infrastructure. But the Netherlands HQ is what matters operationally — that is where Surfshark's servers and business entity are anchored — and the Netherlands has a documented history of cooperation with international law enforcement requests.
For most users, none of this triggers a practical problem day-to-day. For users with genuine privacy requirements, it is a legitimate constraint.
Trust Track Record
There are three documented trust-relevant events in the verified data, each worth unpacking.
The NordVPN ownership disclosure. The thread "Surfshark reveals ties to NordVPN" is a separate, earlier discussion from the 2024 ownership explainer — suggesting the relationship was not proactively disclosed with full clarity when the merger happened, and that community discovery drove the conversation rather than vendor transparency. That sequence matters. A VPN company that leads with privacy as a selling point should be proactive about ownership changes, not reactive to community investigation.
The fake news warning incident. "Free fake news warning from Surfshark VPN" — this refers to a Surfshark feature that flagged certain news sites, which generated criticism about a VPN vendor making editorial judgments about information sources. A VPN's job is to carry your traffic, not editorialize about the content you access. This is a mission-creep issue, and it's a meaningful one: a tool marketed on privacy and neutrality should not be in the business of labeling content. The fact this generated public pushback suggests the community agreed.
The proprietary protocol. Surfshark released a new proprietary VPN protocol called Nexus, which drew one comment on Hacker News — minimal engagement, no red flags surfaced publicly. Proprietary protocols are neither automatically good nor bad; they require independent security audits to evaluate. No audit data was provided in the verified data for this review, so I cannot assess it. What I can say: unaudited proprietary protocols carry more inherent uncertainty than established open-source protocols like WireGuard.
The picture that emerges is a company that has had to play catch-up on transparency rather than leading with it — not a catastrophic trust record, but not a clean one either.
Detailed Breakdown
Device policy. Unlimited simultaneous connections is Surfshark's clearest, most defensible differentiator. For a UAE household or a user running multiple devices — phone, laptop, router, work machine — this removes a genuine friction point that competitors like NordVPN (which caps connections) impose. If you are choosing between Surfshark and NordVPN purely on device coverage, Surfshark wins that comparison outright. The irony is that both are now owned by the same parent, so Nord Security captures the sale either way.
Pricing. Surfshark is positioned as a budget option, and it competes on multi-year plan pricing. Verified pricing figures were not provided in the data for this review, so I will not invent numbers — what is documented is that budget positioning is a core part of Surfshark's market identity, and that it has consistently undercut premium competitors on headline price.
The proprietary Nexus protocol. Surfshark has moved to develop its own protocol rather than relying purely on WireGuard or OpenVPN. The practical implication for UAE users is relevant: UAE telecom providers (Etisalat/e&, du) actively block or throttle VPN traffic, and a less-recognized proprietary protocol may slip through detection more reliably than a well-known one. However, without independent audit results, trusting a proprietary protocol on a privacy tool is an act of faith, not a reasoned security decision.
The Nord Security umbrella. Owning both NordVPN and Surfshark gives Nord Security a dominant position across the mid-market and budget VPN segments. From a user standpoint, the concern is not immediate — there is no documented evidence that consolidation has degraded Surfshark's technical product. The concern is structural: a privacy tool's independence from corporate incentives is part of its value proposition. When two major competing VPNs are owned by the same entity, that independence is reduced, regardless of whether the products currently behave well.
Pricing
Surfshark is explicitly budget-positioned. The verified data confirms this market positioning without providing specific current prices. Long-term plan pricing is where Surfshark offers the sharpest value — monthly pricing is less competitive. For UAE users, it is worth checking whether Surfshark's checkout uses regional pricing, which can vary significantly from the advertised rates. The unlimited device policy means the per-device cost comparison almost always favors Surfshark over per-connection-limited competitors, even at similar headline prices.
User Signals
Community signal on Surfshark is mixed in an informative way. The most-discussed thread — 427 comments on ownership and corporate relationships — is not a product discussion. It is a trust discussion. The community's primary engagement with Surfshark, at least on Hacker News, has been about who owns it and what that means, not about whether the VPN works. That tells you where technically-informed users direct their scrutiny.
The fake news warning controversy surfaced independently, suggesting Surfshark's feature decisions have generated their own criticism beyond the ownership question. And the proprietary protocol thread, with one comment, drew almost no engagement — meaning neither strong validation nor strong criticism from that community.
The composite signal: privacy-aware users are watching the ownership structure closely, have flagged specific feature decisions as problematic, and are not particularly excited about the proprietary protocol. Surfshark's mainstream user base appears broadly satisfied — the product works — but informed privacy users carry real reservations.
Who This Is For
- Multi-device households who want one subscription covering every device without counting connections.
- Budget-conscious users whose primary use case is accessing geo-restricted streaming content rather than high-stakes privacy.
- Casual users in lower-risk environments who want basic traffic encryption on public Wi-Fi.
- Users who have already accepted Nord Security's ecosystem and want a second VPN profile or backup option within it.
Who This Is Not For
UAE users with genuine privacy requirements — journalists, activists, or anyone whose traffic could attract serious attention — should not rely on Surfshark as their primary privacy tool. The Netherlands jurisdiction means EU legal frameworks apply, and the Nord Security ownership means your privacy depends on a corporation that also runs NordVPN, a brand that has itself attracted scrutiny. The fake news labeling feature demonstrated a willingness to make editorial decisions inside a product that should be neutral. The proprietary protocol is unaudited in the verified public record. None of these are dealbreakers in isolation; together, they describe a tool optimized for commercial value, not for adversarial privacy. If your threat model is real, look at providers with cleaner jurisdiction, independently verified infrastructure, and no consolidated ownership entanglements.
vs. Alternatives
The most pointed comparison is against NordVPN directly: both are now Nord Security products. NordVPN has undergone more independent auditing, has a longer public track record, and has recovered — at least partially — from a 2018 server breach through documented remediation. Surfshark does not yet have the same audit depth in the verified public record. If you are choosing between the two Nord Security products, NordVPN has more documented trust infrastructure; Surfshark wins on unlimited connections and price.
Against genuinely independent providers operating outside EU jurisdiction — Mullvad (Sweden, yes, but with RAM-only servers and a documented no-account model) or ProtonVPN (Switzerland, with audited open-source apps) — Surfshark's trust architecture is weaker. You pay less and get more devices; you also get more structural uncertainty.
Bottom Line
Surfshark works. The price is competitive, the unlimited device policy is a real advantage, and for straightforward use cases it delivers what it promises. But this is a privacy tool owned by a corporate conglomerate, headquartered in EU jurisdiction, with a track record of reactive rather than proactive transparency on ownership. The community's dominant conversation about Surfshark is about who controls it — not whether it works. That is telling.
In my opinion, Surfshark earns its place as a budget streaming VPN for users with low threat models. For anyone in the UAE who needs a VPN because the stakes are actually high, the ownership and jurisdiction combination makes this the wrong choice. Pay more, get a cleaner structure.
Methodology Note
This review is based on verified public data: documented ownership structure, corporate jurisdiction, community discussion threads with engagement data, and reported notable events. No proprietary speed tests or connection measurements were conducted. Claims about Nord Security's ownership, Netherlands jurisdiction, and specific community discussions reflect verified public information available as of the data provided. Pricing details were not verified in the source data and are not stated as specific figures in this review.