Two years of independently audited infrastructure, prosecutor-quoted correspondence on a 2023 warrant, and the real gap between what Mullvad claims and what’s been verified
Mullvad makes one of the more absolute privacy claims of any mainstream VPN provider: it says it never stores activity logs, and does not collect user data at all.
That’s a bigger promise than a typical “no activity logs” policy. It’s a claim about identity as well as behavior, and it deserves more scrutiny, not less, because of how much room it leaves for being wrong.
This investigation separates two different things that are easy to blur together: what has actually been independently tested, and what is simply stated with confidence. Those turn out to be different-sized claims, and holding that distinction is the point of this investigation.
We evaluate Mullvad across the same five lenses used throughout STACK’s privacy investigations: what it says it collects (Privacy Model), what evidence supports those claims (Trust Architecture), how strong that evidence actually is (Evidence Architecture), where personal data touches the business beyond the VPN tunnel (Privacy Surface), and how the claims have held up under scrutiny (Criticisms).
Privacy model
The core claim
Mullvad’s stated privacy model says it never stores activity logs of any kind, and does not collect user data, built on data-minimization principles.
That’s a company statement, and it should be weighed as one. It carries low-to-moderate confidence rather than high confidence, precisely because it’s self-reported rather than independently confirmed at the level of the whole company and its full history. A reader shouldn’t equate “Mullvad says it does not collect data” with “it has been shown that Mullvad does not collect data” — those are different claims, and this investigation keeps them separate throughout.
What’s actually been independently tested
Independent support for a bounded version of this model does exist. A 2022 audit by the independent security firm Assured examined Mullvad’s production relay servers and API infrastructure directly, and found no direct customer traffic or PII logging on the systems tested. The API audit, conducted under detailed white-box access, recorded no critical, high, or medium-severity findings.
That confirms the no-logging model held up under independent examination — but only for the systems, timeframe, and configuration actually tested in 2022.
Mullvad also describes its infrastructure as (L)RAM-only(L), running under a “System Transparency” model. The evidence available is broader in scope than what the audit directly confirms: the 2022 relay audit references RAM-booted systems without providing fleet-wide attestation across Mullvad’s full infrastructure. That’s real, but it should be read as low-to-moderate confidence rather than a company-wide guarantee.
Trust architecture
What’s independently verifiable
The strongest element of Mullvad’s trust architecture is its willingness to publish full, primary audit reports rather than summaries alone. The 2022 relay-server and API audits specify their methodology, access level, and findings in enough detail to be independently checked: which is why they carry high confidence even as other claims in this investigation don’t.
Verifiability at the level of a named methodology and a specific audit period is what separates this evidence from a general assurance claim. (See (L)how VPN audits work(L) for what this kind of engagement does and doesn’t establish.)
What rests on company statement
Mullvad’s jurisdiction and government-request claims (including its position that Swedish law (LEK) doesn’t apply to VPN services and doesn’t mandate traffic logging) rest on the company’s own legal interpretation. No independent statutory analysis is available in the evidence reviewed.
A confident legal position stated by the party that benefits from that position isn’t the same thing as an independently confirmed legal conclusion, and this investigation treats it as interpretation rather than established fact.
The 2023 search-warrant account
Mullvad states that Swedish police executed a search warrant targeting equipment believed to hold customer data, and left without seizing anything or obtaining customer data. On its own, that’s a company account, carrying low-to-moderate confidence.
A subsequent Mullvad update adds something more: it quotes correspondence attributed to the Swedish Prosecution Authority, confirming German cooperation and citing secrecy-law restrictions under Chapter 18, Section 17 of Sweden’s Public Access to Information and Secrecy Act.
That’s a meaningfully different kind of evidence than the original narrative alone. It’s still mediated by Mullvad (this isn’t a court docket or a police record) but it includes the substance of an external party’s own words, not just Mullvad’s paraphrase of events. That earns moderate confidence, above a bare company assertion but below an independent record. No official warrant protocol or police execution record is available in the evidence reviewed, so the warrant’s precise scope and disposition remain unverified.
Ownership
Registry-derived sources (Bolagsfakta for Mullvad VPN AB, and NorthData for (L)Amagicom AB(L)) support the existence of both entities as Swedish companies based in Göteborg, at moderate confidence. NorthData additionally describes Amagicom AB’s stated corporate purpose as related to protection against eavesdropping, which is consistent with, though it doesn’t independently prove, the founders’ account of how the two companies relate.
The specific claims that Amagicom AB owns Mullvad VPN AB, and that the founders own both companies outright, carry low confidence. Neither is supported by certified shareholder, board, or beneficial-ownership records in the evidence reviewed. (For more on this structure, see who owns Mullvad?)
Evidence architecture
This investigation weighs its evidence in tiers rather than as a single undifferentiated pool, and its confidence language follows those tiers directly.
The strongest tier: primary audits
The 2022 Assured relay-server and API audit reports are independently produced, methodologically detailed, with their own scope and limitations documented as part of the record. This is the only evidence in this investigation carrying high confidence for its specific findings.
Registry-derived data: supportive, not conclusive
Bolagsfakta and NorthData support entity existence and basic corporate facts at moderate confidence, but this kind of commercial registry data is explicitly distinct from certified company-registry filings, which aren’t present in the evidence reviewed.
Prosecutor-quoted correspondence: stronger than a bare assertion
A company update quoting official prosecutorial correspondence sits above a bare company assertion but below an independent record, and is treated at moderate confidence.
The largest category: company assertion and legal interpretation
By volume, most of the evidence here is company assertion and legal interpretation: the no-logging and data-collection policies, the ownership and founder-control claims, the Swedish legal-interpretation pages, and the original warrant narrative. All of these are rated low or low-to-moderate confidence, regardless of how confidently Mullvad itself states them.
What remains entirely missing from the evidence base
Certified company-registry extracts. Official warrant protocols or court dockets. Independent statutory analysis of Swedish and EU legal frameworks. Full audit reports for web-app and mobile-client systems since 2022. Detailed payment and account-generation architecture. Any reproducible-build or cryptographic attestation evidence connecting production systems to the audited configurations.
Privacy surface
The audited surface
Within the 2022 audit scope, the picture is clear and independently checked. Relay servers and API infrastructure were reviewed using remote administrative access and, for the API, white-box access, and no direct customer traffic or PII logging was found. This is the one part of Mullvad’s privacy surface where “no logging” isn’t just claimed, it’s tested.
Internal hardening gaps, within that same surface
Both reports document weaknesses that limit how absolute the “no data” language can be taken, even where no customer logging was found: permissive firewall policy, shared SNMP credentials, unauthenticated Grafana Loki, and plaintext internal protocols on the relay side; and on the API side, unencrypted Redis and metric traffic, secrets stored in docker-compose.yml and environment variables, and account numbers appearing in URLs alongside other low-severity exposures.
These are internal surfaces adjacent to customer data. They aren’t evidence of customer activity logging, but they do limit how far a company-wide “we do not collect data” claim can reasonably be extended.
Outside the audited surface
Payment gateways, bank transfers, cash and cryptocurrency processing, and account-number generation are all architecture that hasn’t been independently reviewed in the evidence available.
RAM-only infrastructure and the System Transparency initiative are real, with partial technical support, but no fleet-wide attestation or reproducible-build evidence confirms that production systems match what was audited. A reader can’t extend the 2022 findings to systems, time periods, or infrastructure the audits didn’t cover, no matter how consistent Mullvad’s public messaging is across those areas.
Criticisms
Ownership isn’t closed by certified records
Registry-derived sources support that Mullvad VPN AB and Amagicom AB exist, but no certified shareholder or board record confirms the specific ownership percentages or governance structure Mullvad describes. The precise legal chain of control remains, on this evidence, a company account rather than a verified fact.
The warrant record remains incomplete, even with new correspondence
The prosecutor-quoted material strengthens confidence that a warrant event occurred and involved German cooperation and Swedish secrecy-law considerations. But no court docket, warrant protocol, or police execution record establishes the event’s precise legal scope, authorization, or final disposition.
The strengthening here is real, but partial: it shouldn’t be read as resolving the event.
Legal claims rest entirely on Mullvad’s own interpretation
No independent statutory analysis of Swedish surveillance law, EU frameworks, or mutual legal assistance mechanisms, as applied to VPN providers specifically, is available in the evidence reviewed. A company’s confident legal position is not the same as an independently confirmed legal conclusion.
Audited systems don’t represent the whole company
The 2022 audits are strong evidence for what they tested. Backend payment systems, account-generation architecture, and any infrastructure changes since 2022 fall outside their scope. Mullvad’s public privacy claims are stated without that qualification, even though the evidence supporting them is narrower than the claims themselves.
STACK view
Mullvad’s core no-logs claim is genuinely well-tested where it’s been tested at all, and genuinely under-verified everywhere else, and the gap between those two positions is the central fact a reader needs.
The architecture is where confidence is properly high: two independently produced 2022 audits, one using deep white-box access, both confirming no direct customer logging while transparently documenting internal hardening weaknesses rather than hiding them.
The company’s broader identity adds useful context without changing the evidence picture: a long operating history since its 2009 launch, early adoption of privacy-oriented payment methods like Bitcoin and cash, and a stated corporate purpose, for its parent entity, tied to protection against eavesdropping. None of this is independent verification; it’s registry-derived and self-described context.
Incentives are the least evidenced layer here. Founder ownership through Amagicom AB would suggest a closely held company with direct control over its own privacy commitments, but no certified filing confirms that structure, so it can’t be described as more than a company assertion.
The 2023 warrant sequence is where the evidence moved furthest during this investigation, from a single company account toward something with an external anchor point: prosecutor-quoted correspondence that confirms part of the story independently. It doesn’t close the event, and this investigation doesn’t treat it as closed.
None of these gaps contradict Mullvad’s core privacy claims. They define, honestly, where the independently verifiable evidence currently ends, and for a company that states its claims this absolutely, that boundary is worth stating just as plainly.
Conclusion
On the specific relay-server and API systems Assured tested in 2022, no direct customer traffic or PII logging was found, and the API audit recorded no critical, high, or medium-severity issues under detailed white-box review. This is the strongest and most independently verifiable finding in this investigation.
Mullvad VPN AB and Amagicom AB exist as Swedish entities based in Göteborg, per registry-derived sources rather than certified filings. The April 2023 warrant event, including German cooperation, is supported at moderate confidence by the combination of Mullvad’s narrative and prosecutor-quoted correspondence.
Mullvad’s company-wide statements that it never stores activity logs and does not collect user data are company assertions that extend beyond what the 2022 audits directly tested, and carry low-to-moderate confidence accordingly.
The specific claims of full founder ownership and the Amagicom-to-Mullvad parent relationship, absent certified shareholder or board records, carry low confidence : as does Mullvad’s legal interpretation that Swedish law doesn’t apply to it and can’t compel logging, absent independent statutory analysis.
This investigation does not resolve, and does not claim to resolve: certified corporate ownership and governance; the precise legal scope, authorization, and disposition of the 2023 warrant; independent Swedish and EU legal analysis; the findings of any audit conducted after 2022; the architecture of payment, cash, and cryptocurrency processing; or whether production systems can be shown, through reproducible builds or cryptographic attestation, to match what was audited.
Readers whose primary concern is whether Mullvad’s tested relay and API infrastructure logged customer data in 2022 have strong, independently grounded evidence for confidence. Readers relying on Mullvad’s broader, company-wide claims (about logging across all systems and time periods, about legal immunity from compelled disclosure, or about full corporate ownership and control) are relying on company assertions that this investigation rates at low to low-moderate confidence. The gap between how absolute Mullvad’s public language is, and how narrow its independently verified evidence is, is the fact a reader needs to make an informed decision.
Related investigations
- Who owns Mullvad?
- (L)How VPN audits work(L)
- (L)What is a no-logs policy?(L)
- Is NordVPN private?
- Is ExpressVPN private?
- Is Proton VPN private?
Methodology
This investigation is based on Assured’s 2022 relay-server and API audit reports, Mullvad’s official no-logging, data-collection and government-request policy statements, Mullvad’s disclosure of a 2023 police search-warrant visit together with a subsequent update quoting correspondence attributed to the Swedish Prosecution Authority, and registry-derived corporate data (Bolagsfakta, NorthData).
Claims sourced solely to Mullvad’s own documentation, and findings resting on registry-derived rather than certified sources, are identified as such throughout.