ExpressVPN, founded 2009 and based in the British Virgin Islands under Kape Technologies, runs RAM-only TrustedServer infrastructure audited by KPMG and Cure53. Surfshark, founded 2018 in the Netherlands under the Nord Security group, holds a 2026 SecuRing infrastructure audit and MASA certification. Neither is an obvious all-round winner.
VPN comparison
ExpressVPN vs Surfshark: An Honest Comparison (2026)
By Editorial Team · Last updated 25 June 2026
ExpressVPN vs Surfshark: the verified facts
| VPN | Trust & certifications | pricing | money-back | Actions |
|---|---|---|---|---|
| ExpressVPN Since 2009 | Independent no-logs audits (KPMG, Cure53, PwC) | — | — | |
| Surfshark Since 2018 | Independent infrastructure audit (SecuRing, 2026) | — | — |
ExpressVPN Since 2009
- Trust & certifications
- Independent no-logs audits (KPMG, Cure53, PwC)
- pricing
- —
- money-back
- —
Surfshark Since 2018
- Trust & certifications
- Independent infrastructure audit (SecuRing, 2026)
- pricing
- —
- money-back
- —
Only fields we can verify (certifications, confirmed specs, launch year) are shown.
How do they compare on the facts?
ExpressVPN was founded in 2009 and is headquartered in the British Virgin Islands, a jurisdiction outside the 5-Eyes, 9-Eyes, and 14-Eyes surveillance alliances. It is owned by Kape Technologies, a publicly listed company that also owns CyberGhost and Private Internet Access. ExpressVPN's most distinctive technical feature is its RAM-only TrustedServer architecture, which means no data is written to disk and everything is wiped on reboot. That architecture was audited by Cure53 in 2022. Its no-logs policy has been independently examined by PwC (2019), KPMG (2022), and KPMG again (2023), making it one of the more repeatedly audited no-logs claims in the industry.
Surfshark was founded in 2018 and is registered in the Netherlands, an EU member state and part of the 9-Eyes intelligence-sharing arrangement. It sits within the Nord Security group, which also owns NordVPN. Surfshark has undergone no-logs audits in 2023 and 2025, an earlier server-infrastructure audit by Cure53, and — most recently — an infrastructure audit by SecuRing published in January 2026. It also holds a MASA (Mobile Application Security Assessment) certification, which covers the security posture of its mobile applications specifically. The Netherlands jurisdiction is a meaningful difference from BVI: EU data protection law applies, but so do EU-level legal cooperation frameworks.
Who suits whom?
ExpressVPN suits readers who weight audit longevity and RAM-only server architecture heavily. Its audit trail runs back to 2019 across three separate firms — PwC, KPMG, and Cure53 — which gives a longer-running independent record than most competitors. The BVI jurisdiction sits outside major intelligence alliances, though the Kape Technologies ownership is a factor worth weighing: Kape is a listed company with shareholders and regulatory obligations in multiple jurisdictions, which some privacy-focused users consider material. If your priority is a well-documented, independently verified no-logs claim with a distinctive server architecture, ExpressVPN's record is hard to dismiss.
Surfshark suits readers who value recent, layered audit coverage and mobile security certification, particularly those comfortable with an EU jurisdiction. The combination of a 2025 no-logs audit, a fresh 2026 SecuRing infrastructure audit, and MASA mobile certification represents a broad recent sweep across different attack surfaces. Nord Security group ownership means Surfshark and NordVPN share a common parent, which is relevant if you are trying to diversify away from a single corporate group. Neither provider is independently owned — ExpressVPN by Kape, Surfshark by Nord Security — so readers seeking genuinely independent ownership should look at alternatives such as Mullvad or Proton VPN.
Frequently asked questions
Which is better, ExpressVPN or Surfshark?
Neither is objectively better across every dimension. ExpressVPN has a longer independent audit history (PwC 2019, KPMG 2022 and 2023, Cure53 2022) and a RAM-only TrustedServer architecture. Surfshark has more recent multi-layer audit coverage, including a 2026 SecuRing infrastructure audit and MASA mobile certification, plus a 2025 no-logs audit. The BVI jurisdiction (ExpressVPN) sits outside intelligence alliances; the Netherlands (Surfshark) is EU-regulated. Both are owned by corporate groups — Kape Technologies and Nord Security respectively — rather than being independently held.
Is ExpressVPN owned by a trustworthy company?
ExpressVPN is owned by Kape Technologies, a publicly listed company that also owns CyberGhost and Private Internet Access. Kape's history — it was previously known as Crossrider and had a background in ad-tech — is a matter of public record that some privacy researchers flag. On the other hand, ExpressVPN's no-logs policy has been audited by three separate independent firms (PwC, KPMG, Cure53) across multiple years, which provides a concrete, verifiable track record independent of corporate reputation.
Does Surfshark's Netherlands base affect privacy?
The Netherlands is an EU member state and part of the 9-Eyes intelligence-sharing arrangement, which is a different legal environment than the British Virgin Islands where ExpressVPN is based. EU law — including GDPR — imposes data protection obligations but also means Dutch authorities can act on legitimate legal requests. Surfshark's 2023 and 2025 no-logs audits, together with the January 2026 SecuRing infrastructure audit, are the most direct evidence of what data the service actually holds. Jurisdiction matters, but so does what data exists to be handed over.