VPNInfobase
VPN review

Mullvad review

Mullvad is operated by Amagicom AB and based in Sweden. The register records 16 independent audits (8 with a linked report), 1 incident and a lowest verified price of €5.00 per month on a 1 month term.

Published Facts checked By VPNInfobase editorial

Compiled from the vendor's own pages, auditors' reports and named news outlets, checked .

Verified facts

Checked 28 Sept 2026ActiveFrom the vendor's own pages, auditors' reports and named news outlets. Not our measurements.
Owner
Amagicom AB sourceUltimate owner: Fredrik Strömberg and Daniel Berntsson (100% owners of Amagicom AB and Mullvad VPN AB, per Mullvad) source
Jurisdiction
Sweden (Gothenburg) source
Logging policy
Mullvad states it does not keep activity logs of any kind; accounts are anonymous random numbers with no email or personal data. sourceThis is the vendor's claim, paraphrased. An audit below is what tests it.
Independent audits
  • Leviathan Security Group1 Jun 2026MASA (mobile app security assessment) of Android app, second pass report
  • Assured Security Consultants6 Mar 2026Audit of GotaTun (WireGuard implementation used in Android app) report
  • X41 D-Sec GmbH21 Jan 2026White-box source code audit of payment and account API and backend services report
  • Assured23 Oct 2025Assessment of web app; no critical/high/medium issues, one low fixed report
  • NCC Group27 Mar 2025MASA of Android app (version 2024.9) report
  • Not stated on listing (third-party)11 Dec 2024Report for 2024 security audit of the Mullvad VPN app vendor page (report not linked)
  • Cure5327 Jun 2024VPN infrastructure audit (fourth infrastructure audit, 3-14 June 2024) report
  • Radically Open Security9 Aug 2023VPN infrastructure audit (third) report
  • Assured AB16 May 2023Leta search service (assessment 2023-03-27 to 2023-03-31) report
  • Assured AB17 Feb 2023Account and payment services (2022-11-07 to 2022-11-29) vendor page (report not linked)
  • Not stated on listing21 Oct 2022Security assessment of Mullvad VPN apps vendor page (report not linked)
  • Assured AB14 Sept 2022Authoritative DNS servers vendor page (report not linked)
  • Assured AB22 Jun 2022VPN server infrastructure; no information leakage or logging of customer data found vendor page (report not linked)
  • Cure5320 Jan 2021First infrastructure audit (completed Dec 2020) vendor page (report not linked)
  • Not stated on listing25 Jun 2020Mullvad VPN app audit report vendor page (report not linked)
  • Not stated on listing24 Sept 2018External audit of VPN app version 2018.2 vendor page (report not linked)
Incidents
  • 18 Apr 2023Swedish police visited Mullvad's Gothenburg office with a search warrant to seize customer data; Mullvad says none existed and police left without taking anything. source
Transparency report
Not verified from a primary source
Open-source apps
Not verified from a primary sourceMullvad says the majority of software it uses and develops is open source, with projects on GitHub; a per-client statement was not verified. source
RAM-only servers
all VPN servers (Mullvad says RAM-only migration completed September 2023) source
Refund window
14-day money-back guarantee, starting when payment is made source
Price per month
Mullvad VPN price per month by billed term, in the vendor's own currency
Billed termPer monthCharged up frontNote
1 month€5.00not verifiedFlat EUR 5 per month incl. VAT; no promo/renewal difference stated. source
12 months€5.00not verifiedPricing page shows the same EUR 5 per month for 1 year; upfront total not stated. source
billing period not verifiednot verifiednot verifiedPricing page lists 1 month, 1 year and 1 decade only; no 2-year term. source
Per-month figures are the vendor's displayed monthly equivalent for the whole billed term, so terms of different length are not like for like. No currency conversion.
Not verified
  • Transparency report: none found (published=null).
  • openSourceClients: per-client claim not verified (about page says "majority" open source).
  • Audits: reportUrl null for older audits (only the blog tag listing seen); auditor not named on listing for 2024-12, 2022-10, 2020-06, 2018-09; reportUrl for others is the announcement post, PDF not opened.
  • 1-year/1-decade upfront totals not stated; 2-year not offered (decade term exists).

To check current terms, go to Mullvad's own site.

Visit mullvad.net

Mullvad is a Swedish VPN with one price, EUR 5 a month whatever the term, and accounts that are random numbers rather than emails. Its audits are technical tests by several firms, not an assurance report on its no-logs policy. Its 2023 search-warrant post is the one incident on the register.

Ownership and how you pay

Mullvad’s about page says Mullvad VPN AB is owned by parent company Amagicom AB, which it says is 100% owned by its two founders, with the address in Gothenburg. The ownership table shows how few providers say this. Its pricing page lists cash, Bitcoin, Bitcoin Cash, Monero, bank wire, card, PayPal and local schemes, with 10% off for the three cryptocurrencies, up to five devices per account and a 14-day guarantee that excludes cash payments.

The audits: many, and mostly technical

Mullvad’s audit list runs from 2018 to June 2026. It includes four infrastructure audits (the fourth by Cure53, June 2024; a third by Radically Open Security, August 2023), a payment and account API source review by X41 D-Sec (January 2026), a web app assessment by Assured (October 2025), Android app assessments by NCC Group (March 2025) and Leviathan (June 2026) and an audit of its WireGuard implementation GotaTun (March 2026). A June 2022 Assured audit says it found no information leakage or logging of customer data on the servers.

What the register does not hold is a report by an accounting-style firm testing the written no-logs policy, as Proton, NordVPN and others publish. Its audits test systems rather than a written policy. The audit tracker shows the split. Several older entries on Mullvad’s list do not name the auditor.

The 2023 search warrant

On 18 April 2023 Mullvad says Swedish police visited its Gothenburg office with a search warrant to seize computers with customer data. Mullvad’s post says that “such customer data did not exist” and that, after it demonstrated this and the police consulted the prosecutor, they left without taking anything. This is Mullvad’s account; we found no police statement in what we read. It appears in the incidents timeline beside cases that ended differently.

Price, and the unknowns

EUR 5 a month for one month, one year or one decade, with no promo or renewal gap stated, so its cost equals its headline on the renewal price table. Mullvad states its RAM-only migration was completed in September 2023. We could not confirm from the pages read whether it publishes a transparency report, and open-source scope is stated for “the majority” of its software, not per client.

Who it fits, going by the register fields

  • Pick it if you want to pay without an email or card, a price that does not change, and a long public record of technical audits.
  • Look at others if you want an assurance report on the no-logs policy itself, or a free tier. Proton VPN offers both.

See it against the other two privacy-first services in Proton VPN vs Mullvad vs IVPN. This is our reading of the vendor’s pages, not a measured result.

Alternatives

  • IVPN: founder-owned, annual Cure53 audits
  • Proton VPN: annual no-logs audits, free tier
  • Windscribe: free tier, priced by billing term

For a direct comparison with NordVPN, see Mullvad vs NordVPN.

Sources

Update log

  1. Body rewritten. Ownership, pricing, payment methods and the warrant post re-read on Mullvad's own pages; audits arranged by what they examined; no-logs assurance gap stated. Ownership sentence tightened to the about page's wording; all audit dates, price and warrant wording re-verified.
  2. Page rebuilt on the VPN audit register; facts re-checked against the vendor's own pages and auditors' reports on this date.