Compare AirVPN and Surfshark on capabilities, jurisdiction, assurance, and fit for European buyers.
Both listed as alternatives to: ExpressVPN, Private Internet Access
Italy· VPN Services
Needs review
Strong European option when you need remote port forwarding, Dynamic DNS, and open-source clients. Skip for enterprise fleet VPN or ISO/SOC-led vendor risk — consider WireGuard mesh (e.g. Tailscale/NetBird) or audited privacy VPNs such as Mullvad.
Netherlands· VPN Services
Needs review
Shortlist Surfshark when you need unlimited concurrent devices, a large RAM-only commercial VPN network, and optional Surfshark One suite tools under a Dutch legal entity. Skip when you need ownership diversification away from the Nord Security group, open-source clients, cash-only anonymous accounts, or hard EU-only account processing without US-group SaaS — consider Proton VPN or Mullvad instead.
Highlighted rows differ between the two products.
| Feature | AirVPN | Surfshark |
|---|---|---|
| Country of origin | Italy | Netherlands |
| Category | VPN Services | VPN Services |
| Open source | Yes | No |
| Self-hosted | No | No |
| Headquarters | Italy | Netherlands |
| Legal entity | AirVPN di Paolo Brini (also Air di Paolo Brini), Perugia | Surfshark B.V. (Kabelweg 57, 1014BA Amsterdam, the Netherlands) |
| Governing law | Italian courts / EU private international law framing (per ToS) | Netherlands / EU GDPR as controller per Privacy Policy |
| US parent / control | No known US parent | No known US parent |
| CLOUD Act exposure (indicative) | Low | Medium |
| Hosting / residency | Multi-region servers (EU and outside EU). Confirm exit-node policy if you need EU-only traffic. | Global RAM-only VPN server network (vendor: 4,500+ servers / 100+ countries). Account/support/analytics/payments subprocessors per Privacy Policy include Google (Firebase Analytics, BigQuery), Cloudflare, Zendesk, Stripe and other PSPs, AppsFlyer, Iterable, Purchasely, Telnyx, plus group companies in EEA, UK, and the United States. Transfers use SCCs or adequacy. |
| Summary | Italian OpenVPN/WireGuard VPN with remote port forwarding, Dynamic DNS, and open-source Eddie clients—strong for technical privacy use, not enterprise fleet VPN. | Dutch-registered VPN and Surfshark One cybersecurity suite: unlimited devices, RAM-only servers, audited no-logs claims, and optional antivirus, leak alerts, and identity tools. |
| Tags |
| At a glance | AirVPN | Surfshark |
|---|---|---|
| HQ / entity | Perugia, Italy — AirVPN di Paolo Brini (sole proprietorship) | Not listed |
| Protocols | OpenVPN, WireGuard; OpenVPN over SSH/SSL/Tor | Not listed |
| Clients | Eddie GPLv3 (desktop + Android); configs without GUI | Not listed |
| Inbound ports | Up to 5 reserved remote ports + optional *.airdns.org DDNS | Not listed |
| Sessions | Five simultaneous connections per account | Not listed |
| Commercial model | Prepaid access (see vendor site for current plans) | Not listed |
| Independent audit | No public no-logs audit found | Not listed |
| B2B packaging | Self-serve ToS; no productized enterprise pack found | Not listed |
| HQ / legal entity | Not listed | Surfshark B.V., Amsterdam, Netherlands |
| Ownership | Not listed | Merged holding with Nord Security (2022); brands operate separately |
| Deployment | Not listed | Cloud VPN / SaaS suite (not self-hosted) |
| Open source | Not listed | No (closed-source clients) |
| Device model | Not listed | Unlimited simultaneous connections (paid plans) |
| VPN network | Not listed | 4,500+ RAM-only servers, 100+ countries (vendor-stated) |
| Primary audits | Not listed | Deloitte no-logs 2023/2025; Cure53; SecuRing |
| Key capabilities | AirVPN | Surfshark |
|---|---|---|
| EU-operated | Yes | Not listed |
| Open-source client (GPLv3) | Yes | Not listed |
| Remote port forwarding | Yes | Not listed |
| WireGuard + OpenVPN | Yes | Not listed |
| Prepaid access | Yes | Not listed |
| Unlimited devices | Not listed | Yes |
| RAM-only servers | Not listed | Yes |
| NL legal entity | Not listed | Yes |
| Deloitte no-logs (claimed) | Not listed | Yes |
| VPN + One suite | Not listed | Yes |
| Closed source | Not listed | Yes |
Remote port forwarding and airdns.org DDNS
Reserve up to five inbound remote ports (TCP/UDP) while a plan is active, optionally map to different local ports, and attach optional *.airdns.org names that follow the VPN exit IP—useful for P2P, seedboxes, and self-hosted services.
Open-source Eddie client with Network Lock
Official GPLv3 client for major desktops and Android with firewall-based Network Lock (blocks traffic outside the tunnel), CLI, multi-provider mode, and hostile-network layering (SSH/SSL/Tor with AirVPN).
OpenVPN, WireGuard, and layered entry
Choose WireGuard or OpenVPN; OpenVPN is available on multiple ports and can run over SSH, SSL, or Tor when middleboxes block or throttle plain VPN handshakes. Dual-stack IPv4/IPv6 and internal VPN DNS with optional block lists.
Minimal identity requirements
Signup does not require real identity fields; email is optional for support. Payment processors handle their own data when used.
Transparent capacity and multi-session use
Five simultaneous connections, free server switches, public live server load, and a stated minimum allocated bandwidth per session. Commercial access is prepaid—see the vendor site for current plans.
Unlimited simultaneous VPN connections
One subscription covers every concurrent device the account can run — phones, laptops, TVs, routers — without the 5–12 device caps common on rival plans. Best for households and multi-device freelancers; confirm current ToS limits for free trials.
RAM-only global VPN network with modern protocols
Vendor-stated 4,500+ RAM-only servers across 100+ countries; WireGuard, OpenVPN, IKEv2, and in-house Dausos. Nexus features include MultiHop, IP Rotator, Everlink self-healing, and FastTrack routing. Server counts and locations change — verify live map before region-critical use.
Surfshark One security suite (beyond the tunnel)
Optional bundling of antivirus (AV-TEST scored), Alert leak monitoring, Alternative ID (disposable persona/email/number), private Search, and Incogni data-broker removal on higher tiers. Suite tools process extra personal data by design — read the Privacy Policy scopes before enabling them.
Nexus MultiHop, IP Rotator, and CleanWeb
Dynamic MultiHop for entry/exit pairing, periodic IP rotation without full disconnect, CleanWeb ad/tracker blocking, plus kill switch and bypass controls. Useful for privacy-sensitive browsing and shared networks; not a substitute for endpoint hardening on high-risk devices.
Audited no-logs posture and public security tests
Deloitte no-logs assurance reported for 2023 and 2025 (account-gated full reports); public Cure53 and SecuRing assessment PDFs for infrastructure/apps. Treat as strong consumer-grade transparency, not automatic enterprise ISO/SOC coverage.
| Assurance & compliance | AirVPN | Surfshark |
|---|---|---|
| Independent no-logs / security audit | Not found Privacy notice describes no mass-storage activity/IP logs; architecture claims are first-party only. | Vendor claimed Deloitte no-logs assurance reports for 2023 and 2025 (ISAE 3000 framing per vendor; full reports account-gated). Public Cure53 and SecuRing security/infrastructure PDFs also published on Trust Center. |
| ISO 27001 | Not found | Not found Not found as a primary advertised company-wide certification on Trust Center pages reviewed for this draft. |
| SOC 2 / SOC 3 | Not found | Not found Not found as a primary advertised company-wide certification on Trust Center pages reviewed for this draft. |
| GDPR / EU data protection | Vendor claimed EU (Italian) operator; privacy notice cites GDPR and related EU directives. | Vendor claimed Dutch B.V. controller; Privacy Policy cites GDPR, DSAR rights, SCCs/adequacy for transfers. Not legal advice. |
| US CLOUD Act exposure (indicative) | Vendor claimed No known US parent from public research — indicative exposure low vs US-owned brands; multi-region exits still matter. | Partial EU entity / no known US parent, but Privacy Policy lists US-group subprocessors (Google analytics/storage, Cloudflare, Zendesk, Stripe, AppsFlyer, Telnyx, US group companies) for account/support/marketing/payments paths. VPN no-logs claims do not eliminate account-data exposure. Indicative only — not legal advice. |
| Data processing agreement (B2B) | Not found No productized enterprise DPA flow found; consumer ToS/privacy notice only. | Not found No clear public self-serve B2B DPA package found on primary pages; Teams is sales/quote-driven. Confirm contract language before enterprise use. |
| EU AI Act | Not applicable VPN connectivity product; not an AI system under typical procurement framing. | Not applicable Consumer VPN/security suite; AI-assisted scam-check features exist but product is not AI-centric as primary category. |
| VPN Trust Initiative seal | Not listed | Vendor claimed Vendor displays VTI certification/seal on About and Trust materials; confirm current listing on vpntrust.net if required. |
| Considerations & known limitations | AirVPN | Surfshark |
|---|---|---|
| Italian resident restriction | High ToS and footer ban residents of Italy. Orgs with Italian-based staff cannot use AirVPN as a universal approved VPN; exclude that population or choose another vendor. | Not listed |
| No public independent no-logs audit | Medium If vendor risk requires ISO/SOC or a no-logs audit letter, treat this as a gap until evidence is obtained offline. | Not listed |
| Multi-region exit nodes | Medium Traffic can exit outside the EU depending on server choice. Strict residency policies need operational controls, not just EU HQ. | Not listed |
| Small operator / sole proprietorship | Medium Long-running activist project with a small operating structure; set continuity and support expectations accordingly. | Not listed |
| US CLOUD Act (indicative) | Low No known US parent from public research. Not a guarantee against other LE cooperation or non-EU exits. | Not listed |
| Shared holding with Nord Security | Not listed | Medium After the 2022 merger, Surfshark and Nord brands sit under one industry group even if infrastructure is separate. Shortlists that need ownership diversification should not treat NordVPN as an independent alternative. |
| US-group SaaS in account data path | Not listed | Medium Privacy Policy names Google, Cloudflare, Zendesk, Stripe, AppsFlyer, Telnyx and US group companies among recipients. Practical impact: account, support, billing, and marketing data may be reachable via US legal process even when VPN activity is claimed unlogged. |
| Limited public enterprise certs / DPA | Not listed | Medium Strong consumer-facing audit marketing (Deloitte, Cure53, SecuRing) but ISO 27001/SOC 2 and a self-serve DPA were not found on primary pages. Regulated buyers need extra contract and evidence work. |
| Suite features expand personal data processing | Not listed | Low Alert, Alternative ID/number, email scam checker, and Incogni process additional identifiers or content by design. Enabling the full One suite widens the privacy surface beyond pure VPN tunneling. |
| Closed-source client applications | Not listed | Low Clients are not open source; buyers who require public code review of VPN apps should prefer peers with OSS clients. |
When: You need enterprise fleet / zero-trust mesh connectivity
Consider: Tailscale, NetBird, or self-hosted WireGuard
Different product class: org network access vs consumer privacy VPN with inbound ports.
When: You prioritise audited no-logs / accountless anonymity over inbound ports
Consider: Mullvad
Mullvad is stronger on the public no-logs narrative; weaker on multi-port forwarding / airdns.org-style DDNS.
When: You want a free tier and a broader consumer privacy suite
Consider: Proton VPN
When: You want open-source clients, a free tier option, and a privacy stack outside the Nord/Surfshark group
Consider: Proton VPN
Smaller device cap than Surfshark’s unlimited concurrent connections; stronger open-source posture.
When: You prioritize account-number privacy, minimal identity linkage, and a tunnel-focused product
Consider: Mullvad
Fewer lifestyle suite tools; different commercial and account model.
When: You want peer-reviewed AirVPN-style advanced networking features and a non-Nord ownership path
Consider: AirVPN
Different audience and ops model; check current catalog status and docs.
When: You already standardize on Nord products and only need another brand under the same holding
Consider: NordVPN
Sibling brand after 2022 merger — not ownership diversification.