Surfshark VPN: Fast VPN App Security & Privacy Scorecard
by Surfshark · iOS
App usage, installs, and in-app activity are tracked by AppsFlyer and Firebase Analytics and shared with multiple marketing and analytics companies. Purchase behavior is monitored through Iterable and Purchasely for targeting. The VPN connection itself is well-protected, but user activity within the app is broadly collected.
Best for
Users who want reliable VPN with solid security
Avoid if
You want minimal data collection and tracking
Findings
- 0 critical
- 0 high
- 1 medium
- 1 low
- 11 info
1 issue identified across security and privacy analysis.
Top security issues
- App-Wide Default Data Protection Class Is Not Maximum Strength
- Cleartext HTTP IP Geolocation Endpoint (ip.intservers.net)
- Staging CleanWeb Domain Hardcoded in Production WireGuard Binary
Top privacy issues
- Iterable CRM SDK Collects Email Address, Phone Number, and Device ID Linked to Identity
- AppsFlyer Attribution SDK Present Without ATT Disclosure to Users
- Analytics and Crash Reporting Opt-Out Buried in iOS Settings App
Full analysis
Version: 3.34.1 (Build 6) | Analyzed: 2026-04-09
What This Means for You
App usage, installs, and in-app activity are tracked by AppsFlyer and Firebase Analytics and shared with multiple marketing and analytics companies. Purchase behavior is monitored through Iterable and Purchasely for targeting. The VPN connection itself is well-protected, but user activity within the app is broadly collected.
Recommendation: Use With Caution
Best For: Users who want reliable VPN with solid security
Avoid If: You want minimal data collection and tracking
Key Findings
Data Security - 6 findings (1 medium, 1 low, 4 info)
Network Security - 1 finding (1 info)
Code Safety - 0 findings
Privacy - 3 findings (3 info)
Privacy Concerns
What Data is Collected
The app collects data about user installs, app usage patterns, in-app activity, and purchase behavior. Analytics services track how users interact with the app, and diagnostics services gather device and session information when errors occur.
Third-Party Data Sharing
User data is shared with the following third-party services:
- AppsFlyer - Mobile attribution and marketing analytics
- Firebase Analytics / Google App Measurement - Usage and behavioral tracking
- Firebase Crashlytics - Crash diagnostics and error reporting
- Firebase Messaging / Firebase Installations - Push notification delivery
- Sentry - Error monitoring and diagnostics
- Iterable - Marketing automation and behavioral targeting
- Purchasely - Subscription and purchase behavior tracking
- Zendesk - Customer support
- GoogleSignIn / AppAuth / GTMAppAuth - Authentication services
Additional libraries detected: VonageClientSDK, TelnyxRTC, RealmSwift, Alamofire, RxSwift, ReactiveSwift, SDWebImage, CocoaLumberjack, Lottie, SwiftProtobuf
Understanding the Scores
| Category | Score |
|---|---|
| Security | 94/100 |
| Privacy | 35/100 |
| Data Security | 90/100 |
| Network Security | 95/100 |
| Code Safety | 97/100 |
| Data Collection | 25/100 |
| Data Sharing | 30/100 |
| User Control | 38/100 |
Positive Security Features
- Strong network protection with high-grade connection handling, reflected in the 95/100 network security score
- Robust code safety practices with a 97/100 code safety rating, indicating well-structured and defensively written code
- High data security score of 90/100, indicating that data stored and transmitted by the app is handled with care
Areas for Improvement
- Behavioral data is collected and shared with multiple marketing and analytics companies, giving users little practical control over how in-app activity is used for advertising.
- Purchase and subscription behavior is sent to third-party targeting services that go beyond what is needed to provide a working VPN connection.
- The breadth of data shared with analytics and marketing partners is broader than expected for an app whose core purpose is protecting user privacy online.
About This Analysis
This scorecard is based on automated static analysis of the app's code and configuration. Scores reflect observed security and privacy practices at the time of analysis and are intended to help you make an informed decision about installing and using this app.
App Details
| Field | Value |
|---|---|
| Package | com.surfshark.vpnclient.ios |
| Version | 3.34.1 (Build 6) |
| Scan Date | 2026-04-09 |
Versions & scan history
| Scan | Date | Overall score |
|---|---|---|
| #1 (current) | 53/100 |