KPMG Audit Finds Surfshark's RAM-Only Servers Match Its No-Logs Claims

Surfshark's latest independent review is less about a new promise and more about a specific test. KPMG, one of the Big Four accounting firms, examined the server configuration behind the service and reported that its systems operate in line with the company's no-logs policy. The finding matters because it addresses the question that most VPN privacy claims dodge: what actually happens on the machines that carry your traffic.

Most VPN providers say they keep no records of user activity. Few let an outside party check the infrastructure in a way that goes beyond written policy. That gap is why audits carry weight, and why this one is worth reading closely for anyone comparing services on privacy rather than price.

What the auditors actually tested

The review covered three server types: standard nodes, static IP locations and multi-port routing setups. Auditors looked at the technical configuration of production servers and asked whether day-to-day operations matched the guarantees in Surfshark's no-logs policy. According to the company's announcement, the audit specifically checked whether user traffic could be monitored or retrieved from live server memory.

That last point is the one to focus on. Plenty of logging problems don't come from a database quietly storing records. They come from diagnostic tools, debugging hooks or memory dumps that capture data while a server is running. A test aimed at live memory goes after that category directly. The reported conclusion was that the review found no discrepancies.

The findings described cover four categories: browsing histories, IP addresses, connection timestamps and outgoing traffic. The audit confirmed Surfshark does not store any of them. If you're reading the claim as a checklist, those four items are the core of what a no-logs policy usually promises, so it's useful that each was named.

Why RAM-only servers change the picture

The audit also confirmed that Surfshark runs entirely on RAM-only servers. The practical effect is simple. A server with no traditional hard drive has nowhere persistent to write temporary operational data. When the machine reboots or loses power, whatever was held in memory disappears.

That's a meaningful design choice, not just a marketing detail. Storage that's never installed can't be seized, copied or accidentally retained through a forgotten backup job. It also narrows the window of exposure: data that only lives in volatile memory is gone after a restart. The trade-off is operational. Teams running RAM-only infrastructure have to build around frequent reboots and can't rely on local disks for caching or troubleshooting, which means more reliance on careful engineering and monitoring.

Here's the thing, though: RAM-only design doesn't remove the need for an audit. A server can be built without disks and still run software that logs more than it should. That's why the live-memory test is the detail that makes this review more than a restatement of architecture.

A track record of repeated checks

This isn't Surfshark's first trip through an external review. The company's earlier work included a first no-logs audit that was verified years ago. Last year it also cleared an independent audit with Deloitte, a second Big Four firm. Having two different auditors across several cycles gives a clearer picture than a single report, since it shows the company is willing to be checked repeatedly and by more than one party.

For readers tracking the VPN market, the pattern is what stands out. Independent reviews are becoming a common way for providers to back up privacy language, but their value depends on frequency, scope and how much of the report is published. A one-off report with a vague scope tells you much less than a series of reports that name what was examined.

What an audit can't tell you

An audit is a snapshot. It establishes that, on the days KPMG tested the network, the configurations matched the stated policy. It doesn't show what engineers changed afterward, whether a new feature introduces logging next quarter, or how the service behaves under conditions the testers didn't simulate.

It also doesn't make a VPN a complete privacy tool. A VPN hides your IP address from the sites you visit and encrypts traffic between your device and the server. It doesn't stop websites from fingerprinting your browser, following you through logged-in accounts or protecting you from malware. A no-logs audit addresses one part of the threat model, namely what the provider itself retains.

Even so, routine public testing is the strongest tool consumers have for checking a provider's claims. When a company publishes full findings, you can read the methodology and judge whether the scope matches your concerns. If you want to see the specifics, the KPMG audit report is the place to start.

What to look for in the next round

If you're evaluating VPNs on privacy, a few questions help separate useful audits from reassuring headlines. Check who performed the audit and whether the firm's scope covered production servers rather than a sample environment. Look for whether live memory and runtime behavior were tested, not only stored data. Note the date, because an audit from a year ago describes a system that may have changed since. And read whether the full report is available, since a summary alone can't show what was excluded.

Surfshark's latest review checks several of those boxes. The next useful question is whether future audits keep the same scope and whether independent testers keep finding nothing to flag. That repeated, specific verification, more than any single certificate, is what would make the no-logs claim easier to trust over time.