NordVPN vs Surfshark — Australia 2026

Evidenced differences

• Simultaneous connections. NordVPN help documents 10 devices on one account at the same time. Surfshark help documents unlimited simultaneous VPN devices on Starter/One/One+, with a fair-usage limit against resale-scale use and a 3-device cap during the 7-day trial. Antivirus on Surfshark One/One+ is a five-device cap and is not the VPN SKU. We did not measure how many tunnels actually stay up.
• No-logs report access. NordVPN’s sixth Deloitte Lithuania ISAE 3000 engagement (report dated 12 Dec 2025) is described on the vendor blog; the full report is behind a Nord Account login and was not independently inspected. Surfshark’s Deloitte Lietuva ISAE 3000 report dated 10 June 2025 was downloaded over HTTPS and inspected; it is a point-in-time configuration opinion with printed out-of-scope items. A public PDF is not a numeric security score and not proof of zero retained account data.
• Listed tax treatment. NordVPN AU cards print “GST may apply”; gst_basis is unknown because checkout was not started. Surfshark listed cards are before tax; the AU payment API returned vatPercentage 10 (Starter 24-month totalPriceVat A$103.65) and gst_basis is exclusive. Those API VAT figures are not observed checkout totals.
• Linux protocol and split tunnel. NordVPN documents NordLynx and OpenVPN on Linux, with Kill Switch and an allowlist split tunnel. Surfshark’s current Linux GUI documents OpenVPN and Kill Switch; WireGuard is not listed for Linux, and Bypasser is not documented on Linux. This is vendor documentation, not an app test.
• Split tunnel on Apple platforms. NordVPN’s split-tunneling how-to covers Windows/Android/Linux allowlist and does not give macOS or iOS app steps (unknown on those platforms). Surfshark Bypasser is documented on macOS and Android (apps and websites), on iOS as website bypassing only, and not on Linux.
• Surfshark One 24-month intro. Two headed Chrome sessions on 11 Sep 2026 printed different One 24-month billed totals (A$105.03 and A$113.13). Terms disclose A/B price testing. That SKU is not used in the cash table. Starter billed totals were stable across those sessions.
• Legal entities after the 2022 merger. NordVPN’s controller is nordvpn S.A. in Panama. Surfshark’s controller is Surfshark B.V. in the Netherlands; Surfshark terms are governed by BVI law. Surfshark says the brands run separate infrastructure after the 2022 holding-company merger with Nord Security. Five Eyes is no on both legal entities. Neither jurisdiction is Australian data residency.
• Consumer versus business products. This pair is personal VPN only. NordLayer and Surfshark for Teams are separate business offerings and are not scored here. Do not infer SSO or private-resource access from a consumer tier.

Buyer scenarios

Reproducible prepaid cash example

Horizons are cash charged, not prorated service. A 24-month prepaid is billed in full inside 12 months. Australian checkout totals stay unknown. Open the same plans in the cost tool

Hand checks: 12933/27=479; 479*12=5748 ≠ 12933; 12933+18708=31641; 9423/27=349; 349*12=4188 ≠ 9423; 9423+11012=20435.

• Cash outlay counts billed charges when they are taken. A 24-month prepaid is billed in full inside a 12-month horizon.
• The effective monthly figure is an average of the introductory billed total over covered months. It is not the cash charged each month.
• Australian checkout totals are unknown. Checkout was not started. Card FX fees are omitted.
• GST treatment is unknown on at least one listed total. Those figures are not GST-inclusive Australian checkout prices.
• Exclusive listed amounts are before tax. VAT/GST that a checkout might add is not in the cash column.

Unknown on this pair

• Australian checkout totals (checkout was not started; NordVPN GST unknown; Surfshark listed amounts are before tax)
• Surfshark One 24-month introductory billed total (A$105.03 versus A$113.13 the same day)
• Physical versus virtual Australian exits on both products
• Account and control-plane data residency (data_hosting remains unknown)
• Independent speed, leak-test or streaming-unblocking results — not tested
• Whether Surfshark fair-usage would cap a household in practice — not measured

Original conclusions from the record

• On the stored 11 Sep 2026 AUD cards, Surfshark Starter 2-year listed cash (A$94.23 intro; A$204.35 over 36 months if the documented A$110.12/year renewal is taken) is lower than NordVPN Basic 2-year (A$129.33 intro; A$316.41 over 36 months at A$187.08/year). 12-month cash equals those intros, not 479×12=5748 or 349×12=4188. Surfshark amounts are before tax; NordVPN GST is unknown; charged Australian totals stay unknown.
• The documented simultaneous-connection cap is the clearest product difference: 10 (NordVPN) versus unlimited VPN devices (Surfshark, with fair-usage and trial/antivirus caps). That is help-centre copy, not a measured session count.
• Inspectable audit access differs: Surfshark’s June 2025 Deloitte PDF was opened; NordVPN’s 2025 Deloitte report was not. That is a report-availability difference, not a claim that one product is more secure.
• Linux split tunnel and WireGuard documentation favour NordVPN on the stored help articles; Apple split-tunnel documentation favours Surfshark. Apps were not run.
• Both advertise Australian city exits. Neither record establishes Australian data residency. Both retain account and short-lived session identifiers despite no-logs claims.
• This is not a ranked winner, not a numeric security score, and not a speed or streaming result. Business private-resource access is out of scope for both consumer listings.

Sources

• NordVPN pricing (11 Sep 2026)
• NordVPN device limit
• NordVPN 2025 no-logs announcement
• NordVPN advertised Australian exits
• Surfshark pricing (11 Sep 2026)
• Surfshark simultaneous devices
• Surfshark Deloitte ISAE 3000 PDF (10 June 2025)
• Surfshark advertised Australian exits
• Surfshark protocol list
• NordVPN split tunneling how-to

Calculation clock 2026-09-12. Product research dates stay 2026-09-11. Changing the evaluation time does not rewrite those checked dates.