Mullvad VPN

A numbered account, a flat price and a Gothenburg address

Mullvad VPN is run by Mullvad VPN AB, whose address on every page of the site is a post office box in Gothenburg, Sweden. The about page says Mullvad VPN AB is owned by the parent company Amagicom AB, and that both are 100% owned by the founders Fredrik Strömberg and Daniel Berntsson, who are actively involved in the company. The VPN is the main product but not the only one: the site also offers Mullvad Browser, which it says is developed together with Tor and is free whether or not someone is a VPN customer, a browser extension, and a search service called Leta, which the about page says launched in June 2023.

Who can buy it: the site sells directly and does not describe any country restriction on sales. Accounts can be created on the website, in the app, or through the site's onion address in Tor Browser. Time can be added on the website, through Apple in-app purchase in the iOS app, or through Google in-app purchase in the Android app. The apps download from the website, from Mullvad's GitHub page, and on Android also from Google Play or F-Droid. Prices are quoted in euros, with the pricing page converting 5 euros to $5.72, £4.29, SEK 56.33, A$8.05 and CA$8.05. The site's help guide notes one market where buying through Apple no longer works: it says Apple removed the iOS app from the App Store in Russia due to laws and regulations, and that in-app purchases no longer work there for people who already have it. The pricing page also mentions resellers that sell Mullvad VPN at different price models, and the about page says physical activation codes have been sold on Amazon in certain countries since July 2022.

What the audit examined, and what the provider says it logs

Mullvad's audit post, dated June 22, 2022, says the company tasked the Gothenburg based security consulting firm Assured AB with a security audit of its VPN infrastructure, concluded in May 2022 with fixes deployed in early June 2022. The post calls it the company's second security audit of its VPN infrastructure. It says Mullvad deployed 3 freshly installed servers that were not in customer use, and that Assured AB audited 2 WireGuard servers (1 running with no disks in use) and 1 OpenVPN server, with full SSH access. Assured AB was asked to verify the internal and external security and setup of the servers and "whether or not we log customer activity". According to the post, Assured AB found no information leakage or logging of customer data, identified 21 issues ranging from low to medium, and found none in the critical or high categories. The post quotes the auditors saying "the configuration is sound and did not display signs of any direct customer information", and says the full report is available on Assured AB's website. The post itself carries a note that it is 4 years old and may be out of date.

That 2022 audit is not the only one on the site. The blog's audit tag lists later work the provider describes: an infrastructure audit by Radically Open Security in August 2023, a fourth infrastructure audit by Cure53 carried out between June 3 and June 14, 2024, an assessment of the Android app by NCC Group in March 2025, a white-box source-code audit of the payment and account API by X41 D-Sec GmbH published in January 2026, and a second Android assessment by Leviathan Security Group in June 2026. These are the provider's own one-line summaries of each engagement, and the Assured AB post is the one that sets out scope and findings in detail.

The logging policy is the provider's statement, and it goes into detail. It says Mullvad logs no traffic, no DNS requests, no connection times or durations, no IP addresses and no user bandwidth. What it says it does keep: the account number and its expiry date, a WireGuard public key and tunnel address if WireGuard is used, and payment records that differ by method. Card, PayPal, Swish and bank wire payments pass through Stripe, PayPal and the bank SEB, which the policy notes "log everything", and some details must be kept for up to 7 years under the Swedish Accounting Act. Transaction identifiers and the time part of timestamps are deleted 20 days after payment. Support emails are erased after 70 days, and web server access logs, without IP addresses, are kept for up to 5 minutes. The why page describes Sweden as "a safe place for us and your privacy", which is the provider's own view of its jurisdiction.

Apps, protocols and the censorship toolkit

The homepage lists apps for Windows, macOS, Linux, iOS and Android, and the features table marks every one as open source. The service is WireGuard-based: the technical section lists which WireGuard implementation each platform uses, including GotaTun, which the about page describes as Mullvad's own fork of BoringTun written in Rust and introduced in December 2025. Features the table lists across platforms include multihop through 2 or more servers, custom DNS, DNS content blockers, automatic key rotation, quantum-resistant tunnels, and DAITA, which the site describes as Defense Against AI-guided Traffic Analysis. Split tunneling appears in the table too, with a note that on macOS it needs version 13 or later. The kill switch is built in and, per the site, stops all network traffic if connectivity drops. The pricing page answers the port forwarding question with a plain "No". The site's pages do not publish a server count or a country count, and they do not discuss streaming services or torrenting.

For restrictive networks, the help guide lists these anti-censorship methods: a changed WireGuard port, LWO (Lightweight WireGuard Obfuscation), QUIC on UDP port 443, Shadowsocks, and UDP-over-TCP. It names China, Egypt, Iran, Pakistan, Russia, Saudi Arabia, Turkey, Turkmenistan, the United Arab Emirates and Uzbekistan as places where connecting to a VPN is difficult. It is frank about limits: it says Roskomnadzor is blocking most Mullvad servers in Russia, and that the Great Firewall is blocking all Mullvad servers in Asia, suggesting servers in the USA with obfuscation instead. Bridge servers help the app reach the website and API where they are blocked.

One rate for every term, and how to pay it

The pricing page shows 1 month, 1 year and 1 decade all at 5 euros per month, including VAT, with the note that the price has not changed since the service launched in 2009. There are no sales and no introductory rate, so the renewal question most VPN listings leave open does not arise: the page states the same rate for every term. Accepted payment methods are cash, Bitcoin, Bitcoin Cash, Monero, bank wire, credit card, PayPal, Swish, Eps transfer, Bancontact, iDEAL and Wero, and Przelewy24. Cash is sent by post in an envelope with a randomly generated payment token, in euros, US dollars, pounds, Swedish or Norwegian kronor, Swiss francs, or Canadian, Australian or New Zealand dollars, and the policy page says the envelope is shredded after the time is added. Cryptocurrency payments get a 10% discount, which the page attributes to lower fees and less administration. One account works on up to 5 devices.

Refunds: the site offers a 14-day money back guarantee, except for cash payments, which it excludes because of anti-money laundering regulations. There is no free plan, and the pricing page explains why in its own words, saying free services "nearly always come at some cost". Support is in-house, by email at support@mullvadvpn.net or through the in-app problem report, with PGP encryption offered for sensitive messages.

What the site leaves open, and who it suits

The most recent infrastructure audit the blog lists is from June 2024, and the Assured AB post describes work from 2022, so a reader wanting a current, full infrastructure review will want to check the audit tag for anything newer. The site's policy, pricing and feature pages do not publish a server or country count, and they say nothing about streaming or torrenting, so anyone buying for either should look elsewhere on the site first. Port forwarding is not offered. The numbered account is the whole identity, and the site does not describe a recovery route if the number is lost, so keeping it safe matters.

Mullvad suits people who want to pay for a VPN without handing over an email address, who value a published, detailed account of what is and is not stored, and who work in networks where obfuscation matters. It is a poorer fit for anyone who wants a free tier, a multi-year discount, or a service sold on streaming. On ownership, logging and audits, its own pages name the owners, list what is stored, and point to the audit reports.