Back to the Mullvad VPN review

Research record

What the public record says about Mullvad VPN privacy and security

We read what auditors, courts, security researchers and the press have published about Mullvad VPN, then kept only the claims that two separate sources back. This is a record of what is published, not a lab test.

Claims researched
29
Cleared for this page
11
Separate sources behind them
9
Research completed
October 3, 2026

What the evidence supports

Claims that two or more separate sources back

Each statement below is followed by the sources it rests on. A verdict describes what the sources say. It is not our endorsement.

Logging and no-logs audits

Whether outside firms have checked the no-logs promise, and what they could see.

Sources agree

Cure53 audited Mullvad's infrastructure in November-December 2020 (first infrastructure audit) and was unable to discover any personally identifiable information attached to end-users; the report is public on cure53.de.

2 separate sources: Cure53 and Mullvad VPN

Sources and caveats (2)

  1. Cure53 · Audit report · Published January 19, 2021

    As expected, Cure53 was unable to discover any leaks of Personally identifiable information (PII) attached to the Mullvad’s end-users.

    Counts toward the two-source rule

    Conflict of interest: Commissioned and paid for by Mullvad

  2. Mullvad VPN (mullvad.net blog) · Provider own statement · Published January 19, 2021

    Cure53 did not find any Personally Identifiable Information (PII) or potentially privacy-compromising information.

    Counts toward the two-source rule

Researcher notes

Two groups: Cure53's report (read raw) and Mullvad's blog. The same report found six vulnerabilities from informational to high severity and raised container and defense-in-depth concerns (see T4-03). Cure53 is paid by Mullvad.

Sources agree

Mullvad's own accounts of its infrastructure audits state the audited servers were staging or freshly provisioned machines that no customers connected to (Assured 2022, RoS 2023, Cure53 2024).

2 separate sources: Mullvad VPN and Radically Open Security

Sources and caveats (3)

  1. Mullvad VPN (mullvad.net blog) · Provider own statement · Published June 22, 2022

    meaning they were not being used by customers at the time Assured AB gained access.

    Counts toward the two-source rule

  2. Mullvad VPN (mullvad.net blog) · Provider own statement · Published June 27, 2024

    Our staging environment is configured identically to production, bar that no customers connect to it, and the servers are virtual on hardware we own.

    Counts toward the two-source rule

  3. Radically Open Security (public report on GitHub) · Audit report · Published August 7, 2023

    During the test we found no logging of user activity data, however we have no way of validating whether the real production machines are set up in the same way

    Counts toward the two-source rule

    Conflict of interest: Commissioned and paid for by Mullvad

Researcher notes

Two groups: Mullvad's three posts and RoS's own statement that it cannot validate production. Mullvad's RoS post also says the test servers 'have never been utilised' for customers. This limits what any infrastructure audit proves about production and is a finding in its own right.

Security reviews

Penetration tests and code reviews of the apps and servers.

Sources agree

X41 D-Sec audited the Mullvad VPN apps (Android, iOS, desktop) from 23 October to 28 November 2024, found six vulnerabilities (none critical, three high, two medium, one low), concluded the apps have a high security level, and Mullvad fixed them; the report is public.

2 separate sources: X41 D-Sec GmbH and Mullvad VPN

Sources and caveats (2)

  1. X41 D-Sec GmbH · Audit report · Published December 11, 2024

    A total of six vulnerabilities were discovered during the test by X41.

    Counts toward the two-source rule

    Conflict of interest: Commissioned and paid for by Mullvad

  2. Mullvad VPN (mullvad.net blog) · Provider own statement · Published December 11, 2024

    None were rated as having a critical severity, three as high, two as medium, and one as low.

    Counts toward the two-source rule

Researcher notes

Two groups (X41 and Mullvad). The most serious finding became CVE-2024-55884 (CVSS 9.0 per NVD) and the Windows installer finding MLLVD-CR-24-06 was also rated high. Mullvad notes the audit found issues earlier audits missed and that it deliberately uses a different auditor each time. X41's full PDF was not downloaded; quotes are from X41's news page, read raw.

Sources agree

Cure53's June 2024 audit of one OpenVPN and one WireGuard staging server found two issues (one low, one medium) plus informational notes, judged the security posture very positive, and found no way to compromise user traffic anonymity or integrity.

2 separate sources: Cure53 and Mullvad VPN

Sources and caveats (2)

  1. Cure53 · Audit report · Published June 27, 2024

    The team’s overall verdict on the current security posture of the assessed items within the scope is very positive.

    Counts toward the two-source rule

    Conflict of interest: Commissioned and paid for by Mullvad

  2. Mullvad VPN (mullvad.net blog) · Provider own statement · Published June 27, 2024

    Cure53 found two issues, with one rated low, and one rated medium.

    Counts toward the two-source rule

Researcher notes

Two groups. Cure53's own report counts five issues in total (two vulnerabilities, three miscellaneous), consistent with Mullvad's summary. Scope was a staging pair, not production. Cure53 is paid by Mullvad.

Sources disagree or leave it open

Cure53's first Mullvad infrastructure audit (November-December 2020) found six vulnerabilities and six miscellaneous issues ranging up to high severity and raised concerns about container design and defense in depth; Mullvad says all were resolved.

2 separate sources: Cure53 and Mullvad VPN

Sources and caveats (2)

  1. Cure53 · Audit report · Published January 19, 2021

    Cure53 raised concerns regarding defense-in-depth and topology design of the container ecosystem deployed throughout the Mullvad compound.

    Counts toward the two-source rule

    Conflict of interest: Commissioned and paid for by Mullvad

  2. Mullvad VPN (mullvad.net blog) · Provider own statement · Published January 19, 2021

    Cure53 identified six (6) vulnerabilities that ranged from “informative” to “high”.

    Counts toward the two-source rule

Researcher notes

Mixed because the same report that found no PII also found more issues than any later audit (Cure53 attributes this to infrastructure not having been audited before). Two groups. Mullvad's response on the Docker finding says Docker was used for dependency handling, not isolation.

Sources agree

Assured audited the Mullvad web application in August 2025 (critical 0, high 0, medium 0, low 1, five notes, five good practices); the low and four notes were fixed on verification and one note accepted.

2 separate sources: Assured Security Consultants and Mullvad VPN

Sources and caveats (2)

  1. Assured Security Consultants · Audit report · Published September 30, 2025

    Overall, the Mullvad VPN web application and its administrative CMS application implement good security practices with only minor security-related issues found.

    Counts toward the two-source rule

    Conflict of interest: Commissioned and paid for by Mullvad

  2. Mullvad VPN (mullvad.net blog) · Provider own statement · Published June 1, 2026

    Assured completed an independent security assessment of our web app. The assessment found no critical, high, or medium-severity issues.

    Counts toward the two-source rule

    Conflict of interest: Provider's own index of its audits

Researcher notes

Two groups. Scope excluded backend APIs and payment services (separately audited by X41 per Mullvad, report not located).

Ownership and jurisdiction

Where the company is incorporated, who owns it, and which laws reach it.

Sources agree

Mullvad VPN AB is a Swedish limited company seated in Gothenburg, organisation number 559238-4001, a subsidiary of Amagicom AB; Swedish prosecutors' 2023 search order named both companies.

2 separate sources: Mullvad VPN and Bolagsfakta

Sources and caveats (3)

  1. Mullvad VPN (mullvad.net) · Provider own statement · No publication date stated

    Mullvad VPN AB and its parent company Amagicom AB are 100% owned by founders Fredrik Strömberg and Daniel Berntsson who are actively involved in the company.

    Counts toward the two-source rule

  2. Bolagsfakta (aggregator of Swedish company-registry data) · Analysis · No publication date stated

    Mullvad VPN AB är ett dotterbolag

    Counts toward the two-source rule

  3. Mullvad VPN (mullvad.net blog) · Provider own statement · Published May 2, 2023

    In accordance with this request, on February 17, 2023, I granted a search of the premises of Mullvad VPN AB and Amagicom AB. This decision was implemented on April 18, 2023.

    Listed for context, adds no independence

    Conflict of interest: Reproduces the prosecutor's letter in translation and an SVT interview; original letter not seen by us

Researcher notes

Two counted groups: Mullvad's about page and Swedish registry data via Bolagsfakta (an aggregator, not Bolagsverket itself); the prosecutor's letter naming both companies is listed but only seen via Mullvad. Bolagsfakta lists Amagicom AB as parent and group parent and Daniel Berntsson as the only beneficial owner listed (25-50% control).

Incidents and vulnerabilities

Breaches and published software flaws, and how they came to light.

Sources agree

The NVD lists five CVEs for Mullvad software: CVE-2023-50446 (Windows, 2023), CVE-2024-34446 (Android DNS blocking state, 2024), CVE-2024-55884 (signal-handler stack, CVSS 9.0, 2024), CVE-2026-32323 (macOS installer, 2026) and CVE-2026-19380 (wireguard.sys 0.10.1, 2026).

2 separate sources: NIST National Vulnerability Database and Mullvad VPN

Sources and caveats (3)

  1. NIST National Vulnerability Database · Regulator record · No publication date stated

    An issue was discovered in Mullvad VPN Windows app before 2023.6-beta1. Insufficient permissions on a directory allow any local unprivileged user to escalate privileges to SYSTEM.

    Counts toward the two-source rule

  2. NIST National Vulnerability Database · Regulator record · Published December 12, 2024

    In the Mullvad VPN client 2024.6 (Desktop), 2024.8 (iOS), and 2024.8-beta1 (Android), the exception-handling alternate stack can be exhausted, leading to heap-based out-of-bounds writes

    Counts toward the two-source rule

  3. Mullvad VPN (mullvad.net blog) · Provider own statement · Published May 3, 2024

    On Monday 22 of April we became aware of a user report on Reddit of a DNS leak.

    Counts toward the two-source rule

Researcher notes

NVD records parsed locally. CVE-2024-55884 was rated CVSS 3.1 9.0 by NVD; Mullvad and X41 describe exploitation as non-trivial and the fix shipped in desktop 2024.8 and Android 2024.9. CVE-2026-19380 is a VulDB-sourced local-access report against 'Mullvad wireguard.sys 0.10.1', CVSS v3.1 2.3; whether that component is Mullvad's fork of the WireGuard NT driver was not verified. All five are client-side local or edge-case issues; none is a server breach. Counting CVEs is an inventory, not a score: every large client has them. Counted groups: the NVD records and Mullvad's own disclosure of the DNS issue; X41 (who found CVE-2024-55884) is referenced by the NVD record but not counted separately here.

Court cases and legal demands on the provider.

Sources agree

On 18 April 2023 at least six officers of the Swedish police's National Operations Department searched Mullvad's Gothenburg office under a warrant to seize computers with customer data, and left without taking anything or obtaining any customer information.

2 separate sources: Mullvad VPN and SVT Nyheter

Sources and caveats (4)

  1. Mullvad VPN (mullvad.net blog) · Provider own statement · Published April 20, 2023

    After demonstrating that this is indeed how our service works and them consulting the prosecutor they left without taking anything and without any customer information.

    Counts toward the two-source rule

  2. SVT Nyheter (Swedish public broadcaster) · Press report · Published April 21, 2023

    Polisen bekräftar via sin presstjänst att de varit på plats vid företaget men kan inte ge några detaljer i nuläget.

    Counts toward the two-source rule

  3. Mullvad VPN (mullvad.net blog) · Provider own statement · Published May 2, 2023

    In accordance with this request, on February 17, 2023, I granted a search of the premises of Mullvad VPN AB and Amagicom AB. This decision was implemented on April 18, 2023.

    Listed for context, adds no independence

    Conflict of interest: Reproduces the prosecutor's letter in translation and an SVT interview; original letter not seen by us

  4. Gizmodo · Press report · Published April 21, 2023

    The Sweden-based VPN provider Mullvad says that it was recently served with a search warrant by police that demanded the company turn over logs of user data.

    Listed for context, adds no independence

Researcher notes

Two counted groups: Mullvad and SVT, whose report quotes co-owner Daniel Berntsson and carries the police press office's confirmation that they were on site (but gives no detail on what was or was not seized beyond Mullvad's account); plus the Swedish Prosecution Authority's letter, reproduced in translation on Mullvad's blog (listed but not counted: original not seen). Gizmodo restates Mullvad's post and shares its group. The 'nothing seized' fact rests on Mullvad's and SVT's reporting of Mullvad; police declined to detail the outcome. NOA later said it considered it had done what the investigation order requested.

Transparency

What the provider publishes about requests and bug reports.

Sources agree

Mullvad's audit reports from Cure53, Assured, Radically Open Security and X41 are publicly downloadable without login (on the auditors' sites or a public GitHub repository).

4 separate sources: Cure53, Assured Security Consultants, Radically Open Security, and X41 D-Sec GmbH

Sources and caveats (4)

  1. Cure53 · Audit report · Published June 27, 2024

    No such issues were found, and no vulnerabilities affecting the core product were detected.

    Counts toward the two-source rule

    Conflict of interest: Commissioned and paid for by Mullvad

  2. Assured Security Consultants · Audit report · Published September 30, 2025

    Overall, the Mullvad VPN web application and its administrative CMS application implement good security practices with only minor security-related issues found.

    Counts toward the two-source rule

    Conflict of interest: Commissioned and paid for by Mullvad

  3. Radically Open Security (public report on GitHub) · Audit report · Published August 7, 2023

    During the test we found no logging of user activity data, however we have no way of validating whether the real production machines are set up in the same way

    Counts toward the two-source rule

    Conflict of interest: Commissioned and paid for by Mullvad

  4. X41 D-Sec GmbH · Audit report · Published December 11, 2024

    A total of six vulnerabilities were discovered during the test by X41.

    Counts toward the two-source rule

    Conflict of interest: Commissioned and paid for by Mullvad

Researcher notes

Four independent groups. Each PDF except X41's was downloaded and read. Contrast with providers whose no-logs assurance reports are readable only by logged-in customers.

Sources agree

Mullvad's VPN app is open source under GPL-3.0, its repository is public, and X41 audited it as a white-box test with source code access.

2 separate sources: Mullvad VPN and X41 D-Sec GmbH

Sources and caveats (3)

  1. Mullvad VPN (mullvad.net) · Provider own statement · No publication date stated

    All of Mullvad's open-source projects are available on GitHub.

    Counts toward the two-source rule

  2. GitHub (Mullvad's repository) · Provider own statement · No publication date stated

    Counts toward the two-source rule

    Conflict of interest: Provider-controlled repository

  3. X41 D-Sec GmbH · Audit report · Published December 11, 2024

    X41 performed a white box penetration test with source code access against the Mullvad VPN Application.

    Counts toward the two-source rule

    Conflict of interest: Commissioned and paid for by Mullvad

Researcher notes

Two groups (Mullvad; X41). GitHub API reports license GPL-3.0 and 7,621 stars on 2026-10-03. Reproducible Android builds (May 2025) are claimed on Mullvad's about timeline but were not verified.

What we cannot yet show

Where the record is thin

A claim stays off this page until two separate sources back it and an editor has cleared its wording. Each dot is one claim we researched. A filled dot is on this page. A hollow dot is not, yet.

  • Logging and no-logs audits2 of 5 shown
  • Security reviews4 of 6 shown
  • Servers and protocols0 of 2 shown
  • Ownership and jurisdiction1 of 3 shown
  • Incidents and vulnerabilities1 of 5 shown
  • Legal actions1 of 3 shown
  • Transparency2 of 4 shown
  • pr_topic_other0 of 1 shown

Not shown means one of two things: fewer than two separate sources, or still waiting for an editor to settle the wording or check a document. It does not mean the claim is false.

How this feeds the Trust Score

The evidence trail behind the number

The Trust Score has a criterion for security track record: audits, breaches and incidents. This page is the written trail for that kind of question, showing what was published, by whom, and how many separate sources agree.

Points are still assigned by the published formula. Read how in the methodology.

How the Trust Score works

See every published research record

How we research

Four rules we hold ourselves to

  1. Two separate sources, minimum

    Two outlets repeating one press release count as one source. Independence is decided by where the information came from, not by how many sites carry it.

  2. Primary documents first

    Auditor reports, court filings and regulator records come before commentary. A provider own page is evidence of what the provider says, never proof that it is true.

  3. Nothing found is a result

    When a search turns up nothing we record what we searched. We never present an empty search as a clean bill of health.

  4. No softening for partners

    A finding that the evidence qualifies is recorded as qualified, whoever the provider is.

VPN.com does not run its own testing lab. Every audit listed here was commissioned and paid for by the provider it examined, and we say so where it applies. We earn commission from some providers; see our disclosures.Read our disclosures