Mullvad VPN AB is a wholly-owned subsidiary of Amagicom AB, founded in 2009 in Gothenburg, Sweden by Fredrik Stromberg and Daniel Berntsson, who each hold exactly 50% of shares. There are no external investors, no venture capital, and no acquisition plans. The company does not run an affiliate program — meaning review sites earn nothing from recommending it, which some argue results in fewer glowing reviews from monetized comparison platforms.
The account model is the most anonymous in the industry. Signing up generates a random number — no email address, no name, no personal data required. Payment can be made with cash sent by mail in ten currencies, Monero, Bitcoin, or traditional methods. This combination makes Mullvad the only major VPN where anonymous usage is genuinely achievable without friction.
The strongest real-world validation of Mullvad's no-logs policy came on April 18, 2023, when at least six officers from Sweden's National Operations Department (NOA) raided Mullvad's Gothenburg office with a search warrant to seize computers containing customer data for a German criminal investigation. Mullvad demonstrated to prosecutors that no customer data exists. The police left empty-handed. This is arguably the most convincing no-logs proof any VPN has ever produced — more definitive than an audit because it was adversarial rather than cooperative.
Technical infrastructure reflects the same philosophy. All servers run in RAM-only mode using the System Transparency bootloader, wiping all data on reboot. Mullvad physically owns servers in key EU locations including Germany, France, Finland, and Sweden. Remaining servers are dedicated (not shared) rentals with no virtual locations anywhere. All client applications are open-source on GitHub and have been audited multiple times by Cure53, Assured AB, Atredis Partners, and Radically Open Security.
DAITA (Defense Against AI-guided Traffic Analysis), launched in May 2024 with a v2 update in March 2025, is genuinely novel. It pads all packets to constant size and injects random dummy traffic bidirectionally, disrupting the pattern recognition that AI-based surveillance systems use to identify VPN user activity even through encrypted tunnels. Built on the academically peer-reviewed Maybenot framework, it addresses a threat most VPNs do not acknowledge.
The WireGuard-first approach delivered strong speeds in testing: BleepingComputer measured an average of 666 Mbps globally, with minimal degradation to Hong Kong (676 Mbps). vpnMentor recorded lower figures with 27-45% speed loss, likely reflecting different baselines and methodologies. OpenVPN was fully deprecated in January 2026 — Mullvad is now WireGuard-only, which may affect users on older routers or legacy configurations.
Streaming is Mullvad's deliberate weakness. It cannot reliably unblock Netflix US, Hulu, Amazon Prime Video, Disney+, or most major streaming platforms. This is not a technical failure but a conscious choice — Mullvad does not invest in IP rotation or streaming-specific infrastructure because doing so would conflict with its privacy-first model. Some UK services (BBC iPlayer, ITV, Channel 4) work intermittently.
Port forwarding was removed on July 1, 2023 after abuse — users were hosting malicious content and services, causing law enforcement contacts, IP blacklisting, and hosting providers canceling Mullvad's server contracts. The removal caused significant backlash from legitimate users who needed it for torrenting and self-hosting, driving some to migrate to AirVPN or Windscribe.
The flat pricing of 5 EUR/month (~$5.50) with no long-term discounts is both a strength and weakness. It is transparent and honest — no bait-and-switch renewal pricing. But it is more expensive over two years than NordVPN, Surfshark, PIA, or CyberGhost on their introductory plans. Mullvad has approximately 68,000 active subscribers, making it a niche player compared to NordVPN's estimated 15 million.
Sweden's 14 Eyes membership is a theoretical concern, but Mullvad's extreme data minimization — no accounts, no logs, no stored metadata — means there is nothing to compel disclosure of. Support is email-only with 12-24 hour response times, and the maximum of 5 simultaneous connections is below the industry standard of 10+.
The Tailscale partnership (September 2023) allows Tailscale mesh network users to route outbound traffic through Mullvad's WireGuard servers, extending Mullvad's privacy to an existing network infrastructure. The Mullvad Browser, a Firefox fork co-developed with the Tor Project, provides additional fingerprint resistance for web browsing.