KPMG Confirms Surfshark VPN Does Not Track Users’ Online Activity

Most VPN users cannot see what happens to their traffic once it leaves their device, so they have to take a provider’s word for it. Surfshark says KPMG has verified that word, confirming the VPN does not monitor or keep logs of what users do online.

The verification is Surfshark’s third independent no-logs assurance report, released in November 2026. KPMG, one of the Big Four auditing firms, examined the company’s Privacy Policy and internal processes as part of the engagement.

What KPMG Checked at Surfshark

Surfshark head of product Gabriele Sinkeviciute said outside auditors answer a question users cannot. “Users have no direct way to see how a VPN handles their traffic, so we rely on external auditors to answer that question on their behalf.”

Sinkeviciute said KPMG covered the core of the no-logs claim. “One of the Big Four auditing firms, KPMG, reviewed our server configurations, handling of temporary login data, and employee access controls, confirming that we do not log or monitor online activity.”

According to Surfshark, KPMG confirmed its VPN servers do not collect logs of user activity after login. That includes browsing history, traffic destination, data content and connection logs.

KPMG also verified that temporary login data is stored only briefly and deleted within a defined timeframe. It assessed that usage analytics collection aligns with Surfshark’s Privacy Policy.

The firm evaluated security measures that protect customers from potential compromises of third-party services in the server infrastructure. It also reviewed change management procedures so system updates are properly authorized and documented.

KPMG inspected how privileged user access is managed and logged to ensure compliance with internal security policies. Surfshark says the assessment confirms its compliance with its Privacy Policy.

Surfshark VPN’s Third Independent Audit

Sinkeviciute said repeat reviews matter. “Undergoing these reviews year after year, rather than pointing back to a single past audit, proves that our no-logs commitment remains true as our network expands.”

The KPMG report follows earlier no-logs assurance reports from Deloitte in 2023 and 2025. The detailed KPMG report, prepared under the ISAE 3000 standard, is available on Surfshark’s website.

Surfshark lists its previous independent verifications and certifications in its trust center. The company says it is committed to continuing these checks regularly.