AzireVPN

A Stockholm VPN inside Malwarebytes

AzireVPN is a paid VPN service, and the VPN is the only product its site sells. The about page says it was founded in Stockholm, Sweden in 2012 by three friends and information security experts, and that it is now owned by Malwarebytes, which the same page places in Santa Clara, California. The timeline on that page dates the move to November 2024, and the team section says the company joined Malwarebytes in 2024 while keeping its entire original team in Sweden. The footer reads "© 2012- 2026 Malwarebytes". The about page also invites visitors to drop by the office in Stockholm.

Who can buy it: the site does not name any country where it will not sell, and it does not say that sales are limited to one region. Prices are shown in euros only. The pricing page lists PayPal and credit cards (VISA, MasterCard and American Express), and the about page adds JCB and SEPA Direct debit. Cash is no longer taken; the pricing page says it was dropped because of the administrative burden and the small number of customers who used it. The homepage says sign-up needs no email, address, phone number or credit card details, and the about page says an email address is optional and only helps with account recovery. On distribution, the about page's timeline records the Android app being released on Google Play in July 2019, the Windows, macOS and Linux app being released on GitHub in March 2017, and an iOS app on TestFlight in December 2019. The homepage lists dedicated apps for Windows, macOS, iOS and Android.

The X41 D-Sec audit and the logging claim

The provider's audit post, dated April 2, 2026, describes its first full third-party audit. It says AzireVPN partnered with X41 D-Sec, which the post calls an independent German security firm, and that the audit ran between December 1, 2025 and January 9, 2026. According to the post, it included a software audit and a hardware audit, with AzireVPN shipping servers to Germany so the researchers could run hands-on hardware penetration testing. The post adds that AzireVPN now shares infrastructure and server-side software with Malwarebytes Privacy VPN, so the audit covered both services at once. The about page describes the scope as "our infrastructure and server-side systems".

The post quotes X41's summary: "During our assessment, we did not observe evidence of user activity logging, and access to systems is tightly controlled, with no unnecessary remote, local, or SSH access exposed." It lists the findings as the provider reports their status: 1 critical issue fixed and 1 critical in progress, 2 medium fixed, 5 medium fixed on all new servers and 1 medium in progress, and 1 low fixed, 2 low fixed on all new servers and 1 low in progress. The two critical items it describes are an unverified Debian image checksum, which it says is fixed, and a network boot process without cryptographic signature verification, which it says needs deeper architectural changes and is still being worked on. The post links the full public report as a PDF.

Separately from the audit, the logging policy is the provider's own statement. The about page says AzireVPN does not record or store logs of traffic, user activity, timestamps, IP addresses or DNS requests, and that its servers "are designed to block access and provide no user information" under a court order. It says it stores no sensitive payment information, only an internal reference code, and that transaction information is deleted from its database after six months. The site links a transparency report and a monthly warrant canary. It makes no jurisdiction argument beyond noting its Swedish origins and its current owner.

Diskless servers, WireGuard and port forwarding

The service page says the network consists of 179 dedicated and owned diskless servers in 62 locations, and that it has used RAM-only servers since 2012. The about page says the servers have their hard drives removed, run a custom base image in RAM, and are hardened with what the provider calls Blind Operator 2.0, which blocks local (TTY) and remote (SSH) access so that no one can log in after deployment. The about page's timeline lists recent server additions in cities such as Jakarta, Johannesburg, Santiago, Bogotá, Tel Aviv and Osaka.

WireGuard is the headline protocol. The pricing page says AzireVPN was the first to implement WireGuard in 2017 and made a donation to its development, and the timeline records a WireGuard beta in September 2017; an older entry mentions OpenVPN in the desktop app. Other features the homepage lists: a built-in kill switch with an always-on mode, full IPv6 support, and port forwarding, which it says lets users direct incoming traffic to a specific device or service. The provider's blog also carries a port forwarding status update about server reboots and API changes. Router installation is possible, per the FAQ, if the router supports VPN configurations. The homepage describes "Ultra-fast 10G servers" and promises no bandwidth caps or throttling, but the site publishes no measured speed figures.

Torrenting: the homepage says peer-to-peer traffic and the BitTorrent protocol are allowed on all servers. Streaming: the FAQ answers the Netflix and BBC iPlayer question with "You can give it a try!", says the service is not specifically tailored for streaming platforms, says many users have accessed Netflix, Amazon Prime Video and Disney+, and warns that streaming services sometimes block IP addresses.

Plans, refunds and support

The pricing page shows three plans in euros: 1 month at 5.00 euros per month, 3 months at 4.00 euros per month (12.00 euros billed for the term), and 12 months at 3.75 euros per month (45.00 euros billed for the term). A banner calls this "Prices like it's 2017!" and says the service now starts at 3.75 euros per month on the 12-month plan. The site does not state a renewal price, so it is not clear whether these rates carry over when a term ends. There is no free plan, and the pricing FAQ says a free plan would almost always mean compromising on privacy, security or quality. The homepage lists 10 devices with 5 connections at a time. A 7-day money-back guarantee is offered, and the pricing page asks customers to contact support@azirevpn.com first. The service page also points to a Matrix chat group for real-time updates and direct chat with the team, and the about page says the ticket system and website analytics are open-source or custom software hosted in-house, with no Google Analytics or Facebook Pixel.

What the site leaves open, and who it suits

The site does not state renewal prices after the first term. The audit is recent, but by the provider's own count several findings, including 1 critical boot-chain issue, were still in progress when the post went up, and the site does not say when they will close. Malwarebytes ownership is stated plainly, though the site does not explain how data is shared, if at all, between AzireVPN and the Malwarebytes Privacy VPN that now runs on the same infrastructure. The streaming answer is hedged and names no tested services beyond what users reportedly reached, and the site does not list which apps support which features.

AzireVPN suits people who want port forwarding, torrenting on every server, a sign-up without personal details and a server fleet the provider says it owns and runs without disks. It is a weaker fit for anyone paying outside the euro, anyone who wants to pay in cash, which the site no longer takes, or anyone buying mainly to stream. Its audit post publishes both the findings and the unfinished fixes.