-
Run strict no-logs deployments on RAM-only servers.
-
Ensuring personal data stays on the device, make telemetry optional, and block permanent storage of user data on servers.
-
Strip passwords from diagnostic logs and warn users before exporting settings that contain credentials.
-
Enforce safe memory handling and secure encryption to block common attacks and protect stored data, even on a lost device.
-
Undergo automated and manual testing for known exploits before updates reach users.
-
Install critical security patches the first time the VPN is switched on.
-
Ensuring VPN clearly labels the level of security and privacy offered to different use cases (from journalists to households).
-
Extend protection to modern, decentralized infrastructure like mesh networks.
Surfshark helps create new official EU security standards for the whole VPN Industry
TechnologyNeel Achary15 Aug 2026
Surfshark, alongside other companies, such as ZTE Corporation, BSI, Palo Alto Networks, Google, and Nord Security, has helped create the world's first official security standard for VPNs, supporting the EU's new Cyber Resilience Act. The work was led by Surfshark's Miguel Fornés, Information Security Manager, who authored and refined many of the rules that VPN products are now expected to follow to keep users' data private and secure.
The standard (EN 304 620 – Cybersecurity requirements for VPNs) was developed through ETSI, the European Telecommunications Standards Institute, one of the official bodies the European Union relies on to write technical standards. These new rules support the EU's Cyber Resilience Act, a landmark law that sets mandatory security requirements for digital products. The standard becomes public in August, while the regulation will be enforced on December 11th, 2027. Fines of up to EUR 15 000 000 or, if the offender is an undertaking, up to 2,5 % of its total worldwide annual turnover will apply.
Miguel Fornés, representing Surfshark as an official ETSI Member Delegate, served as a contributing technical expert for the development of the Cyber Resilience Act (CRA) supporting standards.
“Until now, there were no official rules for how safe a VPN had to be. Any provider could call its app "secure" without having to prove it. That is now changing. The shift is comparable to the arrival of safety rules for cars. Before crash tests and seatbelt laws, drivers simply had to hope their car was safe. Once official safety standards existed, every car had to meet them. Surfshark is helping do the same thing for VPNs,” says M. Fornes, Information Security Manager at Surfshark.
What sets the Cyber Resilience Act apart is the EU's proactive approach: rather than mandating complex legalese, it partnered with leading industry experts to co-author practical, actionable standards.
“Think of it like building a secure fortress. Instead of simply passing a law demanding 'strong walls,' the EU enlisted master architects, the expert committees, to draft the precise blueprints. We're proud that Surfshark's expertise helped shape the ETSI VPN Standard, setting the minimum security, resilience, and privacy requirements for the digital products people depend on,” adds M.Fornes.
What the standard changes
The new rules make VPNs safer and more private by default. Among the requirements Surfshark contributed to, the standard now expects VPNs to:
“The new standard recognizes that protecting your privacy online is a basic right. We're making sure strong protection isn't just a promise from one company. Every VPN sold in Europe will eventually have to meet it. That gives consumers across Europe grounds to trust that their VPN is genuinely built to protect them, “ says M.Fornes. “Ultimately, this means that now, all users will be using universally more secure services.”
Technology
SK Telecom Unveils A.X K2, Driving AI Adoption in Industry and Daily Life
Technology
ITM School of FutureTech Fuels the Next Generation of Entrepreneurs with Student-Led Startups
Technology
AI Goes Mainstream: Gemini User Base Soars to 950 Million Worldwide
Technology