Mullvad
grade A
Mullvad is a VPN service that helps keep your online activity, identity, and location private
grade A
What the documents mean for you
Mullvad keeps payment records up to seven years under accounting law and passes payment and email data to Stripe, PayPal, its bank and its mail host. It stores no activity logs, IPs or connection times, and sign-up needs only a generated account number.
Nothing in the corpus mentions identity verification, KYC, source-of-funds checks, transaction screening or blocking. The sign-up flow explicitly asks for no personal information at all, and the privacy policy states that no automated decision making or profiling takes place.
Nothing in these documents triggers an identity check: the service asks for no name, email or password and generates a random account number instead. The only identity exposure comes from the payment method you pick — card, PayPal, Swish and bank wire go through Stripe, PayPal or the bank SEB, which record who paid, while cash, Bitcoin, Bitcoin Cash and Monero go to wallets Mullvad hosts itself. The documents describe no situation in which the service demands documents or withholds your money.
Warnings
Cash, Bitcoin, Bitcoin Cash and Monero go to wallets Mullvad hosts itself. Card, PayPal, Swish and bank wire go through Stripe, PayPal or the bank SEB, which log the payment and link it to you.
If you pay by bank wire, your Mullvad account number ends up in the message field of the bank transaction, tying your bank identity to that account.
Mullvad says it usually cannot hand you a copy of your data because it stores almost nothing and cannot identify you from payment data. Exercising your GDPR rights can also cut off support that needs that data, such as issuing a refund or recovering a lost account.
How the score was reached
Privacy100/100
Trust83/100
Overall = (privacy × 0.6 + trust × 0.4) / 10, rounded = 9/10, grade A. Each attribute above rests on a clause quoted below or was assigned by a moderator; the rest is what the listing knows.
Attributes13 moved the score
Refunds may require KYCprivacy -3 · trust -3
KYC or personal information may be needed for a refund when funds are flagged for AML risk.
Identity-free registrationprivacy +10
Users can create accounts without giving personal information such as a full name, address or phone number.
Creating an account requires no personal details of any kind.
“When you sign up for Mullvad, we do not ask for any personal information – no username, no password, no email address.”
Privacy policy, mullvad.net
Verifiedtrust +10
Passed repeated checks over time and showed consistent behavior.
Strict no-log policyprivacy +5 · trust +3
The service has a strict no-log policy: it does not collect or store any information about its users.
Open source codetrust +7
The source code of the service is publicly available and licensed as open source.
RAM-only infrastructureprivacy +3 · trust +3
Servers run from memory only, so nothing about users survives a reboot or a seizure. (Points not confirmed against the live site.)
Accepts Moneroprivacy +5
This service accepts Monero, a privacy-focused cryptocurrency that provides enhanced anonymity.
Auditedtrust +5
The service has been audited by an independent third party.
The policy references an infrastructure audit carried out by the external security firm Cure53 and a finding resolved from it.
“This was a way of resolving [MUL-03-002 WP2 from our Infrastructure Audit](https://mullvad.net/blog/2021/1/20/no-pii-or-privacy-leaks-found-cure53s-infrastructure-audit/) in 2020.”
Privacy policy, mullvad.net
Has Onion or I2P URLsprivacy +5
Onion (Tor) and I2P URLs enhance privacy and anonymity.
Mature servicetrust +5
This service has been operational for 17 years. While this indicates stability, it is not a future-proof guarantee.
Legally registeredtrust +2
Legally registered as Mullvad VPN AB in Sweden.
Token-based loginprivacy +1
Access is through a secret token rather than a username and personal details.
Access to the service is through a randomly generated account number, not a username and personal details.
“Instead, a random account number is generated, a so-called numbered account. This number is the only identifier a person needs in order to use a Mullvad account.”
Privacy policy, mullvad.net
Basic customer supporttrust +1
Customer support is average: questions are answered and problems fixed in reasonable time.
What costs you most first. Tap one to read the clause it rests on, or what the listing knows, priced as kycnot.me prices it.
What the documents say
Swedish accounting law forces Mullvad to keep certain payment data for seven years after the end of the fiscal year before it deletes it.
“Certain payment data must be kept for the statutory retention period described in applicable local laws such as the Swedish Accounting Act (some information must be stored for seven years from the end of the fiscal year).”
Privacy policy, mullvad.net
Mullvad deletes most crypto payment details after 20 days, but keeps the Monero transaction hash longer to stop double-crediting.
“For Monero payments we store the transaction hash, or tx_hash. This is stored beyond 20 days in order to prevent double-crediting.”
Privacy policy, mullvad.net
Mullvad runs its own full node and self-hosted wallet for each supported cryptocurrency, so no outside payment processor sees crypto payments.
“We run our own full node for each currency and we self-host all wallets. No third parties are involved.”
Privacy policy, mullvad.net
Emails and problem reports you send are permanently erased 70 days after the case closes, including from sent items, trash and archives.
“After 70 days, all emails/problem reports sent to our support address are automatically, permanently erased (from inbox, deleted items, sent items, trash, and archives).”
Privacy policy, mullvad.net
Mullvad states it stores and processes personal data only within the EU/EEA and makes no transfer to a third country.
“No. We only store and process your personal data within the EU/EEA.”
Privacy policy, mullvad.net
The privacy policy states that no automated decision making or profiling is applied to you.
“No automated decision making (including profiling) takes place.”
Privacy policy, mullvad.net
Web server access logs are kept for up to 5 minutes without IP addresses, after which only aggregate request counts remain.
“We store Nginx access logs for up to 5 minutes in the following format (which does not contain IPs): $server_name [$time_local] $request $status”
Privacy policy, mullvad.net
Documents read
Community
Write a reviewCancel
No reviews yet. If you have used it, say what actually happened.
The average is weighted by each reviewer's standing: verified reviews and accounts with karma count more, new or untrusted accounts less. How karma works.