Is Mullvad safe? Numbered accounts, Cure53 audits and Swedish law

Yes, Mullvad is safe on privacy: it asks for no email, keeps no activity records of any kind, and Cure53 has checked its infrastructure. Privacy scores 6.9 out of 10 in our data and security 5.7, both well above the consumer medians of 2.7 and 2.1. The lost points come from items the source pages do not confirm (kill switch, DNS leak protection, warrant canary, transparency report) and from the absence of a court test of the no-logs claim.

What Mullvad can link to you

Signing up gives you a random account number, which serves as the entire login. No email field, no phone number, no identity verification. The link between a person and a subscription depends entirely on how you pay.

• Cash in an envelope (EUR, USD, GBP, SEK and several other currencies) or Monero leaves no banking trail behind the account. Crypto payments get a 10% discount; Bitcoin and Bitcoin Cash are accepted too.
• Card payments via Stripe, PayPal, bank wire, Swish, iDEAL/Wero and a few other methods create a payment reference that Mullvad keeps for 20 days.

That payment reference plus the stored WireGuard public key and tunnel address are the technical threads connecting a device to an account.

What the policies keep, and for how long

The no-logging policy excludes records of traffic, DNS queries, connection times, IP addresses and bandwidth. Retention applies only to the margins:

Support email only exists if you write to support in the first place, and crash reports only if you deliberately send one. The policy is dated 10 July 2025, and data is shared only with the email service and payment processors.

Cure53 and the other audits

Cure53 audited Mullvad's server infrastructure, with the work described in a 2021 blog post, and that audit is what backs the no-logs claim from outside the company. Mullvad also states that its apps have been audited independently. What the record does not contain is any court order or server seizure that tested the policy under legal pressure, so that criterion scores zero. No public security incidents appear in the data either.

Mullvad VPN AB, Swedish law and the 14 Eyes

The company behind the service is Mullvad VPN AB, registration number 559238-4001, based in Gothenburg. Swedish law and GDPR apply, with IMY as the regulator, though no data protection officer is named. Sweden is a 14 Eyes member, which costs the alliance criterion 1.2 of its 2 points. Our position: for a provider that stores neither an email nor activity records, jurisdiction weighs less than for one that ties accounts to real identities. Mullvad ranks first of six among VPNs registered in Sweden on our Sweden jurisdiction page.

Protections: confirmed versus unconfirmed

"Not confirmed" means the pages our data covers leave the feature undocumented, so it scores zero. It says nothing about whether the apps actually ship it. Before relying on the tunnel over hostile Wi-Fi, check the app settings yourself, because the kill switch is what stops traffic when the connection drops. Post-quantum tunnels protect recorded traffic against future decryption, and open code lets researchers read the clients rather than take marketing at its word.

Where the 6.9 and 5.7 lose their points

Confirmed strengths carry most of both scores. Privacy drops points for the missing warrant canary and transparency report, the 14 Eyes seat and the untested court record. Security loses six points, with the unconfirmed kill switch and DNS leak protection accounting for 3.5 of them.

Mullvad safety FAQ

Is Mullvad VPN Russian?

No. Mullvad VPN AB is Swedish, registered in Gothenburg. The related brand Mullvad Browser is built with the Tor Project.

Is there a free version of Mullvad?

No free plan and no trial exists. One flat price of €5 per month on any term, with a 14-day refund option.

Does Mullvad work against heavy censorship?

Partially. Obfuscation, bridges and an onion service mirror help where plain WireGuard gets blocked, but stronger stealth protocols like VLESS Reality, Hysteria2 or Shadowsocks do not appear in the data, which is why censorship bypass scores only 2.4.

Can Mullvad hand over my browsing history?

Under its policy no activity, DNS or IP logs exist, so there is nothing of that sort to pass on. A legal request could touch payment references and support emails while they are still stored.

Should you trust Mullvad?

On its side the company holds an account number, a short-lived payment reference, and the WireGuard key and tunnel address; the no-logs policy is documented and externally audited, though no real-world legal test has confirmed it yet. Full scoring sits in the Mullvad review.