Surfshark
Verified“EU-incorporated, Lithuania-run — but the data plumbing is US-wired.”
- Group valuation
- $3B
- VPN servers
- 4,500+
- Surfshark staff
- 400-500+
- Merged
- 2022
63 = midpoint of Control 71 & Data 54
Sovereignty Quadrant
Control ↑ who owns & governs the company · Data → where your data lives. Every dot is a company — click to open it.
Every number below traces to 14 sourced facts across 9 independent sources, last verified 2026-06-12. 3 open questions hold confidence at 80% — they lower confidence, never the score.
Control ↑
Who legally and economically controls the company
Legal & Jurisdiction
80
Service entity Surfshark B.V. is incorporated and registered in the Netherlands (Amsterdam), is the named GDPR data controller, and is fully reachable by EU law. It relocated onshore from the British Virgin Islands in 2021, removing the old offshore shield. EU-incorporated and EU-operating with clear EU enforceability.
Why 80? 3 sourced facts · click to expand
Service operated by Netherlands-registered entity
Surfshark Privacy Policy · as of 2026-06-12
Relocated from BVI to Netherlands
Wikipedia: Surfshark B.V. · as of 2026-06-12
Control & Ownership
62
Group holding company Cyberspace B.V. is Dutch-registered; Lithuanian founders (Kaziukonis of Surfshark; Okman & Sabaliauskas of Nord) retain voting control. However, US private-equity firm Warburg Pincus led a $100M round at a $3B valuation in 2023 (a minority stake structured to preserve founder influence), alongside Novator (Iceland/UK), Burda (Germany) and General Catalyst (US). EU voting control, but meaningful non-EU economic participation. Exact stake percentages are not disclosed.
Why 62? 4 sourced facts · click to expand
Group sits under Dutch holding company
LegalClarity ownership analysis · as of 2026-06-12
US PE firm took minority stake
Warburg Pincus · as of 2026-06-12
Founders retain control post-investment
Private Equity Insights · as of 2026-06-12
Data →
Where your data lives and who can reach it
Data & Infrastructure
35
VPN traffic runs on 4,500+ RAM-only, no-logs servers across 100+ countries, independently audited by Deloitte (2022, 2025) — strong for the tunnel itself, but those servers are rented infrastructure, not EU-owned. The bigger exposure is the account/data layer: Surfshark's own privacy policy says data may be processed in the United States and names US subprocessors (Google BigQuery, Firebase Analytics, Cloudflare, AppsFlyer, Stripe, Zendesk). That puts account and analytics data under US-law (CLOUD Act) reach, mitigated by EU Standard Contractual Clauses but not eliminated.
Why 35? 4 sourced facts · click to expand
Privacy policy lists US data processing and US subprocessors
Surfshark Privacy Policy · as of 2026-06-12
VPN fleet is RAM-only / no-logs
Surfshark Trust Center · as of 2026-06-12
No-logs independently audited
Wikipedia: Surfshark B.V. · as of 2026-06-12
Cross-border transfers use EU safeguards
Surfshark Privacy Policy · as of 2026-06-12
Operations & People
82
Operations are firmly EU-centered. Surfshark is run out of Lithuania (Vilnius and Kaunas) with additional EU offices in Warsaw and Berlin; founder-CEO Vytautas Kaziukonis is Lithuanian, and the merged group's engineering and business teams are Lithuania-based. Workforce is 400-500+ at Surfshark, all within the EU. The main non-EU pull is the US PE investor and the reporting/valuation being quoted in USD.
Why 82? 3 sourced facts · click to expand
Run from Lithuania with EU offices
Surfshark Press / About · as of 2026-06-12
Group operationally headquartered in Lithuania
LegalClarity ownership analysis · as of 2026-06-12
Aligned to the EU Commission’s official Cloud Sovereignty Framework (SEAL, Jun 2026) →
What we don’t know
3 open questions — they lower confidence, never the score
- ?
Exact ownership/voting percentages held by founders vs. Warburg Pincus and other investors
Not publicly disclosed; if external investors collectively exceed founder voting control the ownership score would fall. Scored on the stated minority/founder-influence structure.
- ?
Where account and billing data physically resides by default (EU regions vs. US)
Privacy policy permits US processing and names US subprocessors but does not confirm primary storage region; affects how much CLOUD Act exposure is theoretical vs. routine.
- ?
Whether the VPN server fleet uses any EU-owned data centers vs. US-owned hosting providers
RAM-only/no-logs is confirmed, but the underlying datacenter ownership is not detailed; relevant to true infrastructure sovereignty.
EU Cloud Sovereignty Framework lens
SEAL is designed for cloud infrastructure providers; this is an analogous sovereignty mapping for a consumer VPN vendor, not a certification.
Strategic
EU-founded and EU-run, but a US PE investor (Warburg Pincus) holds a stake and the group benchmarks valuation in USD.
Legal & jurisdictional
Incorporated in the Netherlands, GDPR data controller, fully EU-enforceable; relocated onshore from BVI in 2021.
Data & AI
Privacy policy permits US data processing and names US subprocessors (BigQuery, Firebase, Cloudflare, AppsFlyer, Stripe, Zendesk); CLOUD Act exposure mitigated only by SCCs.
Operational
Run from Lithuania with EU-only offices (Vilnius, Kaunas, Warsaw, Berlin) and an EU workforce.
Supply chain
Core analytics, payment, support and data-warehouse vendors are US firms; VPN servers are rented third-party infrastructure.
Technological
Proprietary RAM-only, no-logs server fleet (Deloitte-audited) is a genuine strength, but built atop non-EU hosting and tooling.
Security & compliance
Independent Deloitte no-logs assurance reports in 2022 and 2025; published transparency reports and trust center.
Environmental sustainability
No verified data-center energy or emissions disclosures found within scope of this review.
EU alternatives
Strong privacy reputation and owns much of its own infrastructure, but Switzerland is non-EU (EEA adequacy applies, not EU membership).
EU-incorporated and EU-run, anonymous accounts, owns a large share of its own bare-metal servers; minimal third-party data dependency.
Privacy-focused and audited, but Gibraltar is a British Overseas Territory, outside the EU.
How the method works
Methodology v2 (provisional): the score is the midpoint of two axes — Control (who owns and governs the company) and Data (where your data lives and who can reach it). Each axis is scored only on verified evidence; unknowns reduce confidence, never the score. Every input below is sourced; the weights and judgments are open to challenge.
Spotted an error? Every claim is sourced — challenge it and we correct the record.
- 2026-06-12 — Initial golden profile, authored from primary sources (human + AI review).
Report Incorrect Data
Found an error in this company's profile? Help us improve our data by submitting a correction.
Verified 2026-06-12 · Human + AI joint review (sources independently checked) · Methodology