Mullvad VPN is a Sweden-based VPN service operated by Mullvad VPN AB, 100% owned by parent company Amagicom AB and its two founders. Its own no-logging policy states it never asks for personal information to create an account (anonymous numbered accounts, no username/email/password), accepts cash and self-custodied cryptocurrency, and states it logs nothing connected to a numbered account's traffic, DNS requests, connections, or bandwidth. The VPN infrastructure has been migrated entirely off disks to RAM-only servers and has undergone at least four named-firm infrastructure audits (Cure53, Radically Open Security) plus a 2025 web-app audit by Assured, with the 2023 Radically Open Security audit independently confirming it found no logging of user activity data on the audited servers. Warts: some payment methods (bank wire, PayPal, Stripe, Swish) route personal data through third-party processors that retain their own records outside Mullvad's control, and Mullvad itself states those processors 'log everything.'
TIMELINE
1 ENTRY
[2026-08-30] · NEW RECEIPTS
8 new sources on file for Mullvad VPN.
Mullvad VPN's file gained 8 new sourced claims since its last review.
Mullvad's no-logging policy states that signing up requires no personal information whatsoever -- no username, password, or email address -- and instead generates a random numbered account, which is the only identifier needed to use the service; the same page states cryptocurrency payments run through Mullvad's own self-hosted full nodes with no third party involved.
Mullvad's About page discloses that Mullvad VPN AB is owned by parent company Amagicom AB, and that both entities are 100% owned by the two named founders, who remain actively involved in the company.
Mullvad announced it completed migrating its entire VPN server fleet to RAM-only infrastructure, removing all traces of disk storage, an architectural change that has since been the focus of its infrastructure audits.
Mullvad's privacy policy states its underlying policy is to never store any activity logs or metadata and to keep data retention as minimal as possible, limiting what personal data could ever be shared with a third party in the first place.
Mullvad's blog publishes the results of its third infrastructure audit, by Radically Open Security in 2023, which independently states it found no logging of user activity data on the RAM-only servers it tested, in addition to describing the architecture as mature.
Mullvad's blog discloses it contracted Cure53 to perform its fourth VPN infrastructure security audit in June 2024, covering one OpenVPN and one WireGuard server with white-box access including the deployment code.
Mullvad's blog discloses that an independent 2025 security assessment of its web app by Assured found no critical, high, or medium-severity issues, with one low-severity input-validation weakness identified and promptly fixed.
Mullvad's no-logging policy states it logs nothing connected to a numbered account's activity: no traffic, no DNS requests, no connection metadata or timestamps, no IP addresses, and no bandwidth usage.