Mullvad
grade B
Mullvad is a VPN service that helps keep your online activity, identity, and location private
grade B
What the documents mean for you
Mullvad keeps payment records up to seven years under accounting law and passes payment and email data to Stripe, PayPal, its bank and its mail host. It stores no activity logs, IPs or connection times, and sign-up needs only a generated account number.
Nothing in the corpus mentions identity verification, KYC, source-of-funds checks, transaction screening or blocking. The sign-up flow explicitly asks for no personal information at all, and the privacy policy states that no automated decision making or profiling takes place.
Nothing in these documents triggers an identity check: the service asks for no name, email or password and generates a random account number instead. The only identity exposure comes from the payment method you pick — card, PayPal, Swish and bank wire go through Stripe, PayPal or the bank SEB, which record who paid, while cash, Bitcoin, Bitcoin Cash and Monero go to wallets Mullvad hosts itself. The documents describe no situation in which the service demands documents or withholds your money.
Warnings
Cash, Bitcoin, Bitcoin Cash and Monero go to wallets Mullvad hosts itself. Card, PayPal, Swish and bank wire go through Stripe, PayPal or the bank SEB, which log the payment and link it to you.
If you pay by bank wire, your Mullvad account number ends up in the message field of the bank transaction, tying your bank identity to that account.
Mullvad says it usually cannot hand you a copy of your data because it stores almost nothing and cannot identify you from payment data. Exercising your GDPR rights can also cut off support that needs that data, such as issuing a refund or recovering a lost account.
How the score was reached
Privacy83/100
Trust84/100
Overall = (privacy × 0.6 + trust × 0.4) / 10, rounded = 8/10, grade B. Each attribute above rests on a clause quoted below or was assigned by a moderator; the rest is what the listing knows.
Attributes6 from the documents
Identity-free registrationprivacy +10
Users can create accounts without giving personal information such as a full name, address or phone number.
Creating an account requires no personal details of any kind.
“When you sign up for Mullvad, we do not ask for any personal information – no username, no password, no email address.”
https://mullvad.net/help/no-logging-data-policy/
Token-based loginprivacy +1
Access is through a secret token rather than a username and personal details.
Access to the service is through a randomly generated account number, not a username and personal details.
“Instead, a random account number is generated, a so-called numbered account. This number is the only identifier a person needs in order to use a Mullvad account.”
https://mullvad.net/help/no-logging-data-policy/
Auditedtrust +5
The service has been audited by an independent third party.
The policy references an infrastructure audit carried out by the external security firm Cure53 and a finding resolved from it.
“This was a way of resolving [MUL-03-002 WP2 from our Infrastructure Audit](https://mullvad.net/blog/2021/1/20/no-pii-or-privacy-leaks-found-cure53s-infrastructure-audit/) in 2020.”
https://mullvad.net/help/no-logging-data-policy/
Third-party payment processorprivacy -2 · trust +1
Payments are handled through a third party such as Coinbase Commerce or CoinPayments, which sees them.
Card, PayPal, Swish and bank wire payments run through Stripe, PayPal and the bank SEB, which record the payment.
“For credit card, PayPal, Swish, and bank wire, we do use third parties: Stripe, PayPal, and our bank SEB (which handles both Swish and bank wire). These kinds of companies log everything.”
https://mullvad.net/help/no-logging-data-policy/
Account requiredprivacy -1
An account has to be created to access and use the service.
You need a numbered account to use the VPN, although you can create as many as you like.
“Anyone at anytime can create as many numbered accounts as they wish on our website. An account can be used by multiple people or by someone other than the person who initially generated it.”
https://mullvad.net/help/no-logging-data-policy/
Mobile app available
The service can be used through a mobile app.
The documents describe Android and iOS apps, including in-app purchases and an Android split tunneling feature.
“If the split tunneling feature is used on Android, then the app queries the system for a list of all installed applications in order to let the user choose which apps should communicate outside the VPN tunnel.”
https://mullvad.net/help/no-logging-data-policy/
Email required
A valid email address is needed to create an account.
No email address is asked for when creating an account.
“When you sign up for Mullvad, we do not ask for any personal information – no username, no password, no email address.”
https://mullvad.net/help/no-logging-data-policy/
Has Onion or I2P URLsprivacy +5
Onion (Tor) and I2P URLs enhance privacy and anonymity.
Accepts Moneroprivacy +5
This service accepts Monero, a privacy-focused cryptocurrency that provides enhanced anonymity.
Verifiedtrust +10
Passed repeated checks over time and showed consistent behavior.
Mature servicetrust +5
This service has been operational for 17 years. While this indicates stability, it is not a future-proof guarantee.
Legally registeredtrust +2
Legally registered as Mullvad VPN AB in Sweden.
Tap an attribute to see the clause it rests on. Ruled-out ones score nothing; a documented “no” is recorded because it is worth reading. What comes from the listing is what the site knows about the service, priced as kycnot.me prices it.
What the documents say
Swedish accounting law forces Mullvad to keep certain payment data for seven years after the end of the fiscal year before it deletes it.
“Certain payment data must be kept for the statutory retention period described in applicable local laws such as the Swedish Accounting Act (some information must be stored for seven years from the end of the fiscal year).”
https://mullvad.net/en/help/privacy-policy
Mullvad deletes most crypto payment details after 20 days, but keeps the Monero transaction hash longer to stop double-crediting.
“For Monero payments we store the transaction hash, or tx_hash. This is stored beyond 20 days in order to prevent double-crediting.”
https://mullvad.net/help/no-logging-data-policy/
Mullvad runs its own full node and self-hosted wallet for each supported cryptocurrency, so no outside payment processor sees crypto payments.
“We run our own full node for each currency and we self-host all wallets. No third parties are involved.”
https://mullvad.net/help/no-logging-data-policy/
Emails and problem reports you send are permanently erased 70 days after the case closes, including from sent items, trash and archives.
“After 70 days, all emails/problem reports sent to our support address are automatically, permanently erased (from inbox, deleted items, sent items, trash, and archives).”
https://mullvad.net/en/help/privacy-policy
Mullvad states it stores and processes personal data only within the EU/EEA and makes no transfer to a third country.
“No. We only store and process your personal data within the EU/EEA.”
https://mullvad.net/en/help/privacy-policy
The privacy policy states that no automated decision making or profiling is applied to you.
“No automated decision making (including profiling) takes place.”
https://mullvad.net/en/help/privacy-policy
Web server access logs are kept for up to 5 minutes without IP addresses, after which only aggregate request counts remain.
“We store Nginx access logs for up to 5 minutes in the following format (which does not contain IPs): $server_name [$time_local] $request $status”
https://mullvad.net/help/no-logging-data-policy/
Documents read
Community
Write a reviewCancel
No reviews yet. If you have used it, say what actually happened.
The average is weighted by each reviewer's standing: verified reviews and accounts with karma count more, new or untrusted accounts less. How karma works.