empathize (this review is well over 3,000 words).
The company is emphatic that it does not log user
WUDI¿F'16UHTXHVWVDQ\NLQGRIFRQQHFWLRQ
timestamp, IP addresses, or bandwidth use. That’s all
excellent and slightly edges out much of the
competition in terms of what information is stored.
To its credit, Mullvad is very clear about its business
practices. The company does not pay for reviews or
VXSSRUWDI¿OLDWHSDUWQHUV:KHQ,DVNHGLI0XOOYDGKDG
revenue from sources beyond VPN subscriptions, the
answer was a simple, “No.” Mullvad is organized under
the parent company Amagicom AB; it’s based in
Gothenburg, Sweden, and operates under Swedish law.
Understanding which laws apply to your VPN provider
is useful for understanding how your data is protected.
Mullvad goes far beyond others by offering up an
extensive list of legislation that applies to the company.
The company says that while it would comply with a
legal request for information by law enforcement, it
would do so only after investigating the claim, and
points out that it retains very little information that
could be obtained. It goes further by committing to
“shut down the service” if it’s ever legally required to
spy on its users. I haven’t seen any other company make
the same commitment.
Many VPN companies have commissioned third-party
audits to establish their trustworthiness. In general, this
is a good development for the industry, although some
audits aren’t as useful as others. Mullvad was last
audited in 2018 by Cure53, which focused on
SHQHWUDWLRQWHVWLQJRILWVDSSV 3')OLQN :KLOH
Mullvad has gone to lengths to make its practices
transparent, I would still like to see public evaluations
of its server infrastructure. TunnelBear, for example,
has committed to exhaustive annual audits.
When I asked
whether
Mullvad had
revenue from
sources
beyond VPN
subscriptions,
the answer was
a simple, ‘No.’